Restructure flake into per-host modules

Move host-specific files under hosts/<name>/ so a second machine can be
added without forking the repo. Split system/users.nix and
system/display-manager.nix into per-option subfolders, separate the
home-manager packages list into a shared base and a personal bundle,
extract networking.hostName out of the shared networking module, and
inline the git identity into the per-host home.nix. Add .gitignore
guardrails to keep secrets out.

.gitignore

@@ -1,2 +1,10 @@
 .claude
 docs/
+
+# secret guardrails — keep credentials out of the repo
+secrets/
+*.age
+*.key
+*.pem
+.env
+.env.*

configuration.nix

@@ -1,21 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ./hardware-configuration.nix
-    ./system/boot.nix
-    ./system/networking.nix
-    ./system/locale.nix
-    ./system/xserver.nix
-    ./system/picom.nix
-    ./system/display-manager.nix
-    ./system/fonts.nix
-    ./system/users.nix
-    ./system/programs.nix
-    ./system/packages.nix
-    ./system/ssh.nix
-    ./system/nix.nix
-  ];
-
-  system.stateVersion = "26.05";
-}

flake.nix

@@ -9,20 +9,27 @@
 		};
 	};
 
-	outputs = { self, nixpkgs, home-manager, ... }: {
-		nixosConfigurations.hivebrain = nixpkgs.lib.nixosSystem {
+	outputs = { self, nixpkgs, home-manager, ... }:
+	let
+		mkHost = { hostPath, username, homePath }: nixpkgs.lib.nixosSystem {
 			system = "x86_64-linux";
 			modules = [
-				./configuration.nix
+				hostPath
 				home-manager.nixosModules.home-manager {
 					home-manager = {
 						useGlobalPkgs = true;
 						useUserPackages = true;
-						users.marvin = import ./home.nix;
+						users.${username} = import homePath;
 						backupFileExtension = "backup";
 					};
 				}
 			];
 		};
+	in {
+		nixosConfigurations.hivebrain = mkHost {
+			hostPath = ./hosts/hivebrain;
+			username = "marvin";
+			homePath = ./hosts/hivebrain/home.nix;
+		};
 	};
 }

home.nix

@@ -1,17 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ./home/zsh.nix
-    ./home/git.nix
-    ./home/rofi.nix
-    ./home/yazi.nix
-    ./home/packages.nix
-    ./home/symlinks.nix
-    ./home/fonts.nix
-  ];
-
-  home.username = "marvin";
-  home.homeDirectory = "/home/marvin";
-  home.stateVersion = "26.05";
-}

home/git.nix

@@ -1,11 +0,0 @@
-{ ... }:
-
-{
-  programs.git = {
-    enable = true;
-    settings.user = {
-      name = "MDietermann";
-      email = "marvin.dietermann@hive-brain.de";
-    };
-  };
-}

home/packages-base.nix

@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+
+{
+  home.packages = with pkgs; [
+    neovim
+    nerd-fonts.jetbrains-mono
+    ripgrep
+    unzip
+  ];
+}

home/packages-marvin.nix

@@ -6,17 +6,13 @@
     claude-code
     gcc
     lua-language-server
-    neovim
-    nerd-fonts.jetbrains-mono
     nil
     nixpkgs-fmt
     nodejs
     obsidian
     pkg-config
-    ripgrep
     rustup
     steam
-    unzip
     xwallpaper
   ];
 }

home/zsh.nix

@@ -19,7 +19,7 @@
 
     shellAliases = {
       btw = "echo I use NixOS";
-      reload-nixos = "sudo nixos-rebuild switch --flake ~/nixos-dotfiles#hivebrain";
+      reload-nixos = "sudo nixos-rebuild switch --flake ~/nixos-dotfiles";
     };
   };
 }

hosts/hivebrain/default.nix

@@ -0,0 +1,26 @@
+{ ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+
+    # shared
+    ../../system/boot.nix
+    ../../system/networking.nix
+    ../../system/locale.nix
+    ../../system/fonts.nix
+    ../../system/nix.nix
+    ../../system/ssh.nix
+    ../../system/programs.nix
+    ../../system/packages.nix
+
+    # marvin-only
+    ../../system/xserver.nix
+    ../../system/picom.nix
+    ../../system/display-managers/ly.nix
+    ../../system/users/marvin.nix
+  ];
+
+  networking.hostName = "hivebrain";
+  system.stateVersion = "26.05";
+}

hosts/hivebrain/home.nix

@@ -0,0 +1,25 @@
+{ ... }:
+
+{
+  imports = [
+    ../../home/zsh.nix
+    ../../home/fonts.nix
+    ../../home/rofi.nix
+    ../../home/yazi.nix
+    ../../home/symlinks.nix
+    ../../home/packages-base.nix
+    ../../home/packages-marvin.nix
+  ];
+
+  home.username = "marvin";
+  home.homeDirectory = "/home/marvin";
+  home.stateVersion = "26.05";
+
+  programs.git = {
+    enable = true;
+    settings.user = {
+      name = "MDietermann";
+      email = "marvin.dietermann@hive-brain.de";
+    };
+  };
+}

system/networking.nix

@@ -1,6 +1,5 @@
 { ... }:
 
 {
-  networking.hostName = "hivebrain";
   networking.networkmanager.enable = true;
 }