From ded6559afe4c45b19a6796c1e346cae812103838 Mon Sep 17 00:00:00 2001
From: Jordan Ashurst <ashurstdev@proton.me>
Date: Fri, 18 Sep 2026 04:23:28 -0700
Subject: [PATCH] hosts/dogma-wsl: add headless WSL host

- hostName dogma-wsl, wsl.enable, disable systemd-boot/graphics/pipewire/sunshine/libvirtd/docker
---
 hosts/dogma-wsl/default.nix | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 hosts/dogma-wsl/default.nix

diff --git a/hosts/dogma-wsl/default.nix b/hosts/dogma-wsl/default.nix
new file mode 100644
index 0000000..b19c617
--- /dev/null
+++ b/hosts/dogma-wsl/default.nix
@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }: {
+  imports = [
+    ../common/default.nix
+  ];
+
+  networking.hostName = "dogma-wsl";
+
+  # WSL-specific: no bootloader, no hardware-configuration.nix
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
+
+  # WSL uses nixos-wsl module injected via flake; ensure systemd is enabled
+  wsl.enable = true;
+  wsl.defaultUser = "mask";
+
+  # Headless - explicitly disable desktop/server features that may leak via common
+  # (common/default.nix is minimal, but ensure graphics/desktop stays off)
+  services.xserver.enable = lib.mkForce false;
+  programs.hyprland.enable = lib.mkForce false;
+  services.pipewire.enable = lib.mkForce false;
+  services.sunshine.enable = lib.mkForce false;
+  virtualisation.libvirtd.enable = lib.mkForce false;
+  virtualisation.docker.enable = lib.mkForce false;
+
+  # No bridged networking in WSL
+  networking.firewall.trustedInterfaces = lib.mkForce [];
+}