Use a makefile for utility snippets

Makefile

@@ -0,0 +1,15 @@
+# Lockfile utils
+update-lockfile:
+	nix flake update --commit-lock-file
+update-lockfile-without-commit:
+	nix flake update
+
+# Agenix utils
+edit-secret:
+	cd secrets && agenix -e $(filter-out $@,$(MAKECMDGOALS))
+rekey-secrets:
+	cd secrets && agenix -r
+
+# NixOS utils
+clean-old-nixos-profiles:
+	doas nix-collect-garbage -d

common/boot/bios.nix

@@ -10,6 +10,10 @@ in
     device = mkOption {
       type = types.str;
     };
+    configurationLimit = mkOption {
+      default = 20;
+      type = types.int;
+    };
   };
 
   config = mkIf cfg.enable {
@@ -19,7 +23,7 @@ in
         enable = true;
         device = cfg.device;
         useOSProber = true;
-        configurationLimit = 20;
+        configurationLimit = cfg.configurationLimit;
         theme = pkgs.nixos-grub2-theme;
       };
     };

common/boot/efi.nix

@@ -7,6 +7,10 @@ in
 {
   options.efi = {
     enable = mkEnableOption "enable efi boot";
+    configurationLimit = mkOption {
+      default = 20;
+      type = types.int;
+    };
   };
 
   config = mkIf cfg.enable {
@@ -19,7 +23,7 @@ in
         efiSupport = true;
         useOSProber = true;
         #       memtest86.enable = true;
-        configurationLimit = 20;
+        configurationLimit = cfg.configurationLimit;
         theme = pkgs.nixos-grub2-theme;
       };
     };

common/default.nix

@@ -61,6 +61,7 @@
     lm_sensors
     picocom
     lf
+    gnumake
   ];
 
   nixpkgs.config.allowUnfree = true;

lockfile-update.sh

@@ -1,4 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p bash
-
-nix flake update --commit-lock-file

machines/ponyo/hardware-configuration.nix

@@ -16,6 +16,7 @@
   bios = {
     enable = true;
     device = "/dev/sda";
+    configurationLimit = 3; # Save room in /nix/store
   };
 
   remoteLuksUnlock.enable = true;

secrets/rekey.sh

@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-agenix -r
-git commit . -m "Rekey secrets"

update.sh

@@ -1,6 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p bash
-
-git pull
-nix flake update # intentionally ignore the lockfile
-sudo nixos-rebuild switch --flake .