[rrvsh]

Summary

Nemesis previously ran slskd as a manually started transient user service, while Alpha had no declarative package or service. This adds managed slskd services for both hosts with sops-encrypted credentials.

Both hosts share one encrypted base identity and append their hostname at runtime, producing distinct Soulseek sessions without duplicating secrets. Web credentials are shared.

Nemesis uses the Nixpkgs slskd module. Completed downloads are shared back to Soulseek and remain writable by slskd and accessible to MusicGrabber through the shared users group. The Nixpkgs service normally makes every shared directory read-only, so this configuration removes that restriction for the directory that also receives completed downloads. Soulseek port 50300 is opened through the NixOS firewall; web ports remain closed by that firewall.

Alpha packages the pinned upstream ARM64 macOS release and runs it as a user LaunchAgent. Its private state lives under ~/Library/Application Support/slskd. The previous mutable Alpha state was removed before activation. slskd uses its default HTTP and HTTPS listeners on Alpha.

Validation

• nix develop -c just format-nix
• nix develop -c just check-nix
• built the complete Nemesis and Alpha system configurations
• rebuilt and activated Nemesis and Alpha after the shared-credential refactor
• verified both hosts decrypt the shared sops file outside the Nix store
• verified the hostname-suffixed identities log in to Soulseek simultaneously
• verified slskd web authentication on both hosts
• completed live Soulseek searches through MusicGrabber on both hosts
• completed controlled Soulseek downloads through MusicGrabber on both hosts
• verified completed source files remain in each host's shared slskd download directory
• verified the Alpha LaunchAgent remains healthy and exposes slskd's default HTTP, HTTPS and peer listeners