refactor(installer): path: flake so the installed host stays gitignored + writable repo

[phorcys420]

What

Make the installed box's /etc/nixos-repo behave like a normal, user-editable git checkout, and stop staging per-host secrets into the git index.

Problems

1. Secrets were staged. The generated per-host dir hosts/<host>/ is gitignored (it holds install-answers.json and local.nix). A git flake only sees tracked/staged files, so install.sh force-added the host with git add --intent-to-add -f purely so Nix could find it — which staged the secrets and left the tree permanently dirty.
2. Repo was root-owned. git pull / edits needed sudo.
3. No branch checked out. A baked image's .git is a detached, branchless CI checkout, so git pull on the box failed with "not currently on a branch".

Change

Reference the repo as a path: flake (path:/etc/nixos-repo) instead of a git flake. A path: flake copies the directory verbatim — gitignored files included — so the host is visible without any staging. The git add --intent-to-add -f is removed entirely; the host dir is now truly untracked (never staged, never in git status, secrets never enter the index).

All install-time and on-box flake commands use path: refs: nix eval/nix build, disko --flake, nixos-install --flake, and coder-reset's nixos-rebuild switch.

Installed repo is now a usable checkout: after copying, install.sh does chown -R root:wheel + chmod -R g+w so wheel users git pull / edit without sudo, and checks out a main branch tracking origin so git pull works out of the box.

Rebuild command is now sudo nixos-rebuild switch --flake path:/etc/nixos-repo. Docs (README, agents.md, hosts/incus-vm/README) updated; the stale intent-to-add / "tree is dirty" guidance is removed.

Why path: over keeping a git flake

A strict git flake can't see an untracked host, so the only alternatives were committing secrets (no) or intent-adding them (the staging problem). The other way to keep a git flake is to move secrets out of the repo and import them by absolute path under --impure — more invasive, less reproducible, and it changes host discovery. path: is the smallest change that keeps the hosts/<hostname>/ layout, keeps the host gitignored, and lets git pull work normally. Tradeoff: path: ignores .gitignore and copies the whole dir (incl. .git) each eval — negligible on the box.

Validation

Proved the mechanism on a truly untracked, gitignored host (no intent-add):

git flake   .#…_pathtest…          -> error: does not provide attribute (can't see it)
path: flake path:.#…INITIAL_USER_PASSWORD -> p$"\x   (reads the secret from install-answers.json)
path: flake path:.#…toplevel.drvPath      -> /nix/store/…-nixos-system-…drv   (full system evals)

• git status shows the host dir nowhere (fully ignored, unstaged).
• shellcheck / shfmt / bash -n clean on install.sh; nix fmt clean.
• No nixos-rebuild was run anywhere; validation is nix eval only.

---

Generated by Coder Agents on behalf of @phorcys420.