Merge development into master (sync latest)

.github/workflows/ci.yml

@@ -32,9 +32,6 @@ jobs:
           - name: "8amps-linux (Home Manager)"
             os: ubuntu-latest
             attr: "homeConfigurations.8amps-linux.activationPackage"
-          - name: "linux-generic (System Manager)"
-            os: ubuntu-latest
-            attr: "systemConfigs.linux-generic.config.build.toplevel"
 
     steps:
       - name: Checkout repository

.sops.yaml

@@ -0,0 +1,20 @@
+# sops creation/decryption rules.
+#
+# `keys` defines the canonical age recipients. To rotate or add a new
+# machine, add its age recipient here, then `sops updatekeys <file>` on
+# every encrypted file so its data key gets re-wrapped.
+#
+# `creation_rules` controls what recipients sops uses when ENCRYPTING new
+# files matching `path_regex`. Each matched file gets its data key
+# encrypted to every listed recipient.
+#
+# The age private key is *derived at runtime* from the user's SSH ed25519
+# key via sops-nix's `sops.age.sshKeyPaths`, so there's no separate age
+# private key to back up or rotate.
+keys:
+  - &user_8amps age1alw70v2xd80yrkn2ukap264c64fa64qjq7rr4uh07amu8ahm9uzs9z485w
+creation_rules:
+  # General secrets file (openai API key etc.).
+  - path_regex: secrets/secrets\.yaml$
+    age:
+      - *user_8amps

README.md

@@ -6,9 +6,9 @@ Personal, declarative system configuration built by **Alex Spaulding (aspaulding
 
 Following the [dendritic pattern](https://github.com/mightyiam/dendritic), this repository should be cloned to the system configuration directory for your platform. The config is system-wide and shared across all users — editing requires admin privileges.
 
-| Platform | Path |
-|---|---|
-| **NixOS** | `/etc/nixos/` |
+| Platform               | Path                         |
+| ---------------------- | ---------------------------- |
+| **NixOS**              | `/etc/nixos/`                |
 | **macOS (nix-darwin)** | `/etc/nix-darwin/.dotfiles/` |
 
 ```bash
@@ -29,7 +29,7 @@ The install script will automatically clone the repository to `/etc/nix-darwin/.
 nix run github:aspauldingcode/.dotfiles#install
 ```
 
-*(Alternatively, if you have `git` installed and prefer to authenticate over SSH, you can run `nix run git+ssh://git@github.com/aspauldingcode/.dotfiles.git#install`)*
+_(Alternatively, if you have `git` installed and prefer to authenticate over SSH, you can run `nix run git+ssh://git@github.com/aspauldingcode/.dotfiles.git#install`)_
 
 ## Daily Usage
 
@@ -49,12 +49,17 @@ nh os switch /etc/nixos -H my-nixos-host
 ```
 
 ### Pro Tips for `nh`
+
 - Use **`--ask`** to see a diff of what will change before confirming.
 - Use **`--update`** to update all your flake inputs (packages) to their latest versions.
 - The `NH_FLAKE` variable is set to `/etc/nix-darwin/.dotfiles#mba` (macOS) or `/etc/nixos` (NixOS), so `nh` always knows which host to build by default.
 
 ## Documentation
 
+- **[Dendritic Nix Documentation Suite](docs/dendritic-nix/README.md)** — Full multi-file deep dive: foundations, mechanics, repo implementation, real examples, migration, and anti-patterns.
+- **[Dendritic Nix: Patterns, Den, and Dendrix](docs/dendritic-patterns.md)** — Single-file overview of the pattern and ecosystem.
+- **[Den — Deep Reference](docs/den.md)** — Detailed documentation on Den: aspects, hosts, policies, classes, pipeline, and how this flake uses them.
+- **[sops-nix Documentation Suite](docs/sops-nix/README.md)** — Full multi-file reference for sops-nix: architecture, key management, authoring, templates, operations, and troubleshooting.
 - **[Zsh Plugins & Shell Extensions](docs/zsh-plugins.md)** — Full reference of all curated zsh plugins, CLI tools, and Nix-specific integrations.
 - **[Tmux Master Guide](docs/tmux.md)** — Learn how to use your optimized terminal multiplexer with interactive hints.