cc46ae01

By: ananjiani <ananjiani@noreply.codeberg.org>

feat(steammachine): add Jovian NixOS host for Valve fremont hardware (#347)

Replaces stock SteamOS on the Steam Machine's internal NVMe with Jovian NixOS.

Jovian's Steam Machine support is **unmerged upstream** ([PR #584](https://github.com/Jovian-Experiments/Jovian-NixOS/pull/584)), so this pins the author's fork branch as a separate `jovian-fremont` input. Only `hosts/steammachine` imports it; `steamdeck` stays on chaotic's vendored Jovian.

## Host decisions

**GRUB with `efiInstallAsRemovable`.** `efibootmgr -v` on the machine shows no explicit OS boot entry — only `Boot0001`, an `{auto_created_boot_option}` for the NVMe. The firmware resolves that by scanning for `\EFI\BOOT\BOOTX64.EFI`, so the removable path is the primary path, not a fallback. An NVRAM-only install would leave the box unable to boot.

**The host does _not_ set `nixpkgs.overlays`.** Importing `jovian-fremont.nixosModules.default` already pulls in `modules/jovian/overlay.nix`, which sets `nixpkgs.overlays`. Setting it again runs the overlay twice; the second pass re-appends patches (`pkgs/mangohud` does `old.patches or [] ++ [...]`), which breaks the build.

**BIOS updates stay manual.** `enableFwupdBiosUpdates` is on and `autoUpdate` keeps its default of `false`. A BIOS flash cannot be rolled back by a NixOS generation.

**Theoden's game archive is mounted read-only host-locally** rather than through `modules/nixos/nfs-client.nix`, which hardcodes its mount flags and exposes no read-only option. Uses `systemd.mounts`, not `fileSystems` — the automount units `fileSystems` generates do not support reload and roll back deploy-rs activations.

**Managed Home Manager**, so one `nixos-anywhere` run covers system and user config.

## Module change: `gaming.desktop`

Adds one option, defaulting to `true`, so no existing host changes behaviour. It gates the desktop Steam extras: `gamemode`, the NixOS `gamescope` module, the 8BitDo udev rules, SteamTinkerLaunch, and the launcher packages and programs (Hydra, Heroic, Lutris, BoilR, protonup-qt, protontricks, winetricks, Vesktop, capture tools).

Checked against the pinned Jovian revision. It already supplies:

- Steam, via `programs.steam.enable = mkDefault true`
- gamescope plus `security.wrappers.gamescope` with `cap_sys_nice+pie`
- `KERNEL=="hidraw*", TAG+="uaccess"` with **no** vendor/product filter, which already covers the 8BitDo devices
- `hardware.steam-hardware.enable = mkDefault true`, so controller rules come from nixpkgs
- MangoHUD

A grep over Jovian finds zero references to `gamemode`/`gamemoderun`. Its performance path is gamescope plus `dmemcg-booster`, so `gamemode` would sit inert: nothing wraps Gaming Mode launches in `gamemoderun`.

**Both Jovian hosts now set `desktop = false`** — the Steam Machine and the Steam Deck. This also removes Hydra from the Deck, which previously inherited it unconditionally. Save sync is untouched: the Syncthing folder, Ludusavi, its timer and the backup wrapper all stay shared and in one place.

## `hardware-configuration.nix` is a placeholder

It exists so the flake evaluates. `nixos-anywhere --generate-hardware-config` fills it in from its own installer environment during install. **Do not deploy before that runs.**

## Expected CI outcome

`nixos-steammachine` is added to `checks`. The first build may be slow: no chaotic substituter is configured for this host, and `linux_jovian` may compile from source. That would be a cache problem, not a config problem.

## Follow-ups, not in this PR

- DHCP reservation needs `tofu apply` (`terraform/devices.tf`, `terraform/opnsense.tf`). Apply before deploying, or AdGuard's `steammachine.lan` rewrite for `192.168.1.111` points at nothing.
- SteamOS recovery USB. Valve publishes one image for "Deck/Machine/PC"; reach the BIOS with `Esc` at boot. Needed to restore, not to install.
- No HDMI-CEC. `modules/steamos/cec.nix` is absent from the pinned revision, and the branch that restores it also reintroduces `Keyring=none` and is 26 commits behind.
- Neither host sets a password for `ammar`, so `sudo` is unusable until you SSH as root and run `passwd ammar`. `autoStart` autologins, so you would not notice until you need it.
- An ADR for pinning an unmerged fork branch over waiting for release.

## Deploy

```
nixos-anywhere --flake .#steammachine root@192.168.1.237
```

Requires the desktop key in `/root/.ssh/authorized_keys` on the target for the SteamOS-side bootstrap. After install, `modules/nixos/ssh.nix` declares root's keys from the config, so no manual step is needed again.

Co-authored-by: Ammar <ammar.nanjiani@gmail.com>
Reviewed-on: https://codeberg.org/ananjiani/infra/pulls/347

Total

8m30s

Timeline