alpha
Login
or
Join now
hermes.pds.lassul.us
/
superconfig
forked from
lass.pds.lassul.us/superconfig
Star
0
Fork
0
Atom
Configure Feed
Issues
Pull Requests
Commits
Tags
Feed URL
Select the types of activity you want to include in your feed.
This repository has no description
Star
0
Fork
0
Atom
Configure Feed
Issues
Pull Requests
Commits
Tags
Feed URL
Select the types of activity you want to include in your feed.
Overview
Issues
Pulls
Pipelines
superconfig
/
machines
20 folders
at
77233bd48661a2cbdde0b2b07b59414e83afe807
lassulus
Merge branch 'Lassulus/build-farm'
8d ago
be6c7d60
acheron
configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover
2 weeks ago
aergia
configs: remove dunst
1 week ago
atlas
configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover
2 weeks ago
barnacle
configs.nix-farm: add nix-grpc-store farm and niks3 cache on neoprism Single node: nix-grpc-daemon (builder+scheduler, mTLS, retiolum only) publishing to niks3 (local postgres, Backblaze B2), cache.lassul.us proxying the public bucket. barnacle gets the grpc:// plugin and the shared client cert; all NixOS machines substitute from the cache once the signing key exists. The shared nix-farm-ca generator deploys nothing: clan requires a shared generator to be defined identically on every machine, so per-machine generators copy out what each needs with their own owner/mode (nix-farm-server: server cert + ca.crt; nix-farm-client: ca.crt + client cert/key). The daemon reads its TLS files via LoadCredential: gRPC's cert file watcher treats mtime 0 as a stat failure, and clan unpacks /run/secrets with mtime 0, so pointing it at /run/secrets resets every handshake. MemoryMax is raised from upstream's 2G to 8G: `niks3 push` runs in the daemon's cgroup and got OOM-killed on large NARs (kernel modules), taking the daemon down with it.
1 week ago
coaxmetal
machines.coaxmetal.hermes: enable home assistant plugin
1 week ago
daedalus
configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.
1 week ago
green
machines.green: disable eternal-terminal eternal-terminal 7.0.0 fails to build in the current nixpkgs (cmake_pch.hxx.gch), which failed green's toplevel in the CI farm.
1 week ago
hilum
configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover
2 weeks ago
icarus
configs.phonetpm-ssh: init, use on ignavia, icarus and shodan
1 week ago
ignavia
configs.phonetpm-ssh: init, use on ignavia, icarus and shodan
1 week ago
mors
configs: remove dunst
1 week ago
neoprism
configs.nix-farm: add nix-grpc-store farm and niks3 cache on neoprism Single node: nix-grpc-daemon (builder+scheduler, mTLS, retiolum only) publishing to niks3 (local postgres, Backblaze B2), cache.lassul.us proxying the public bucket. barnacle gets the grpc:// plugin and the shared client cert; all NixOS machines substitute from the cache once the signing key exists. The shared nix-farm-ca generator deploys nothing: clan requires a shared generator to be defined identically on every machine, so per-machine generators copy out what each needs with their own owner/mode (nix-farm-server: server cert + ca.crt; nix-farm-client: ca.crt + client cert/key). The daemon reads its TLS files via LoadCredential: gRPC's cert file watcher treats mtime 0 as a stat failure, and clan unpacks /run/secrets with mtime 0, so pointing it at /run/secrets resets every handshake. MemoryMax is raised from upstream's 2G to 8G: `niks3 push` runs in the daemon's cgroup and got OOM-killed on large NARs (kernel modules), taking the daemon down with it.
1 week ago
orange
modules.sync-containers3: move options to lass.sync-containers3
1 week ago
radio
modules.sync-containers3: move options to lass.sync-containers3
1 week ago
shodan
configs.phonetpm-ssh: init, use on ignavia, icarus and shodan
1 week ago
starkstrom
configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover
2 weeks ago
styx
configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).
1 week ago
virtulus
configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover
2 weeks ago
xerxes
configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover
2 weeks ago
yellow
modules.sync-containers3: move options to lass.sync-containers3
1 week ago