superconfig/machines/ at b42e0694714f62c07f2e2ea0e4521aa716087c15 · hermes.pds.lassul.us/superconfig · Tangled

hermes.pds.lassul.us / superconfig

forked from lass.pds.lassul.us/superconfig

0

This repository has no description

0

superconfig / machines

18 folders

at b42e0694714f62c07f2e2ea0e4521aa716087c15

Hermes configs.services.paperless: init on neoprism 2d ago

configs.snapserver, configs.snapclient: remove, replaced by the gg23 audio hub

2 days ago

configs.yellow-mounts: remove

6 days ago

configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover

2 weeks ago

pkgs.omp: init at 18.11.2 nixos-unstable has omp 18.11.0, whose fetchFromGitHub hash no longer matches the tarball GitHub serves (Hydra rejects the output as well), so coaxmetal, neoprism and barnacle fail to build. Pin the version from nixpkgs master (18.11.2: new src and cargoDeps hashes, node_modules hash unchanged) as an override of nixpkgs' omp. The assert breaks evaluation as soon as nixpkgs moves away from 18.11.0, so the pin gets dropped with the next flake update that brings a fixed omp.

2 days ago

machines.coaxmetal.hermes: hermes-notify through the gateway webhook, regenerate hermes-env on script changes

3 days ago

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

1 week ago

machines.green: disable eternal-terminal eternal-terminal 7.0.0 fails to build in the current nixpkgs (cmake_pch.hxx.gch), which failed green's toplevel in the CI farm.

1 week ago

configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover

2 weeks ago

configs.snapserver, configs.snapclient: remove, replaced by the gg23 audio hub

2 days ago

configs.yellow-mounts: remove

6 days ago

tools.realwallpaper: rewrite as a live lens-projection world map Replaces pkgs.realwallpaper (xplanet, dead NASA NEO sources) with a Python renderer: oblique cylindrical map centred on home with a zoom lens (or plain/mercator), multi-resolution WMS imagery (Sentinel-2 cloudless, Blue Marble, Black Marble lights), live EUMETSAT clouds with synthesised detail, VIIRS snow/fire/chlorophyll, sea ice and the sky. The krebs.realwallpaper module, its nginx config and the mors fetchWallpaper config are dropped; the tool runs standalone for now.

6 days ago

configs.services.paperless: init on neoprism Paperless-ngx at https://paperless.lassul.us, behind nginx with ACME (client_max_body_size 100M for phone photo uploads). OCR in German and English; the nixpkgs module builds tesseract with the languages from PAPERLESS_OCR_LANGUAGE. Data stays at the module's default /var/lib/paperless (static paperless user, no DynamicUser) with SQLite. Login via Zitadel (id.lassul.us): lass.zitadel project "paperless" with access = "declarative", so only users granted on the project (by verified email) can log in. allauth's openid_connect provider keys social accounts by uid_field, set explicitly to the token's sub. paperless' environmentFile is a single env file and the client secret has to sit inside the PAPERLESS_SOCIALACCOUNT_PROVIDERS JSON, so the paperless-oidc-env oneshot builds it from zitadel-reconcile's env file into /run/paperless-oidc, keeping the secret out of the store. The regular login form is disabled; DRF token and basic auth do not go through allauth's pre_authenticate, so API tokens keep working. The admin password comes from the paperless-admin vars generator via the module's passwordFile (LoadCredential). Backups: /var/lib/paperless plus a consistent .backup of its WAL-mode SQLite database (the live db files are excluded). Mailbox scan@lassul.us with a vars-generated password (mailserver-scan) for paperless' IMAP mail fetching, configured later in paperless' database. DNS: paperless CNAME neoprism like the other neoprism services; Gatus checks the login page.

2 days ago

modules.sync-containers3: move options to lass.sync-containers3

1 week ago

configs.snapserver, configs.snapclient: remove, replaced by the gg23 audio hub

2 days ago

configs.sigexec: remove

5 days ago

configs.gg23.audio: living room on styx, radio source, room volumes, declarative Audio dashboard

2 days ago

configs.spora: remove, with mycelium and the spora input

1 week ago

configs.spora: remove, with mycelium and the spora input

1 week ago