superconfig/configs/ at c69c5246acdb42e0493d023f8572511444ca75b2 · hermes.pds.lassul.us/superconfig

2 weeks ago

machines.icarus: switch from xmonad to sway

2 weeks ago

configs.crit: public https://<id>.review.lassul.us per review The crit wrapper writes a fresh random 10-char id per daemon port into /var/lib/crit-routes; a path unit turns that into an nginx map on coaxmetal:7720 (retiolum only). neoprism proxies *.review.lassul.us there with a wildcard cert obtained via DNS-01 (RFC2136) against a delegated _acme-challenge.review.lassul.us zone on knot, so ids never hit CT logs.

1 week ago

gg23

configs.gg23.audio: low-latency ROC/AirPlay hub on acheron with room selection acheron gets a minimal system-wide pipewire with a virtual "hub" sink. Any LAN machine sends into it via ROC while `gg23-audio` from tools/gg23-audio runs (ROC sink loaded into pipewire-pulse, removed again on Ctrl-C), barnacle via AirPlay 1 (shairport-sync, "gg23", pipewire backend, mDNS on int0 only). The hub monitor is linked to ROC sinks for shodan and icarus (room.nix), chosen with `audio-room shodan|icarus|both|off` or from Home Assistant via MQTT discovery (select + buttons). Retained MQTT commands restore the choice after pipewire restarts. The rooms have no stable LAN address, so the hub sends to their retiolum IPs and they accept the ROC ports only from acheron on retiolum.

1 week ago

hass

configs.hass: remove ollama

1 week ago

hw

configs: remove dead modules

2 weeks ago

iroh-relay

configs: rename from 2configs

2 weeks ago

monitoring

configs.monitoring: use native VictoriaMetrics grafana datasource plugin Grafana 13 no longer ships the prometheus datasource as a core plugin, so the provisioned VictoriaMetrics datasource was unusable. Switch it and the dashboards to victoriametrics-metrics-datasource.

1 week ago

nix-farm

configs.nix-farm: keep connections to B2 alive

1 week ago

orca

machines.xerxes: remove

1 week ago

paste

configs.paste: serve paste, imgur and cyberlocker through fcgiwrap One python CGI (configs/paste/paste.py) replaces the htgen-paste, htgen-imgur and htgen-cyberlocker handlers and the paste-form script. Items keep their names and directories, so old links and the backups stay as they are; systemd hands the directories to the new paste user. The upload form now stores directly instead of posting back to p.krebsco.de.

2 weeks ago

ppp

configs: rename from 2configs

2 weeks ago

printing

configs: rename from 2configs

2 weeks ago

services

configs.services.pad: upload any file to p.krebsco.de, drop external link warning

1 week ago

sigexec

configs: rename from 2configs

2 weeks ago

websites

configs.hass: move home-assistant, mosquitto and zigbee2mqtt from styx to acheron

1 week ago

ableton.nix

configs: rename from 2configs

2 weeks ago

alacritty.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

android-webcam.nix

configs: rename from 2configs

2 weeks ago

atuin-server.nix

configs: rename from 2configs

2 weeks ago

auto-timezone.nix

configs: rename from 2configs

2 weeks ago

autotether.nix

configs: rename from 2configs

2 weeks ago

autoupdate.nix

configs: rename from 2configs

2 weeks ago

book.nix

tools.book: apply calendar edits to bookings

1 week ago

br.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

browsers.nix

configs: rename from 2configs

2 weeks ago

c-base-ai-tunnel.nix

configs: rename from 2configs

2 weeks ago

cast.nix

configs: rename from 2configs

2 weeks ago

container-bridge.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

container-tests.nix

configs: rename from 2configs

2 weeks ago

crit-proxy.nix

configs.crit: public https://<id>.review.lassul.us per review The crit wrapper writes a fresh random 10-char id per daemon port into /var/lib/crit-routes; a path unit turns that into an nginx map on coaxmetal:7720 (retiolum only). neoprism proxies *.review.lassul.us there with a wildcard cert obtained via DNS-01 (RFC2136) against a delegated _acme-challenge.review.lassul.us zone on knot, so ids never hit CT logs.

1 week ago

crit.nix

configs.crit: register routes over a unix socket hermes-agent runs with ProtectSystem=strict and cannot write the group-writable routes dir. crit now asks crit-routes.socket (group crit) for a route; a root service picks the id, writes the route, regenerates the nginx map and reloads nginx.

1 week ago

default.nix

configs.monitoring: vector agents, victoria* + alertmanager stack on styx/coaxmetal Every NixOS machine runs Vector (host metrics, internal metrics, journal) and writes to VictoriaMetrics/VictoriaLogs on both styx and coaxmetal, each sink with a 512 MiB disk buffer. Both servers run vmalert (metrics and LogsQL instances), a two-node Alertmanager cluster posting to Matrix via matrix-alertmanager-receiver, Gatus (results scraped into VictoriaMetrics, alerted on by vmalert) and Grafana with provisioned datasources and dashboards. All ports are open on retiolum only. Replaces telegraf on neoprism, including the borgbackup status file.

1 week ago

docuseal.nix

configs: rename from 2configs

2 weeks ago

download-user.nix

machines.xerxes: remove

1 week ago

et-server.nix

configs: rename from 2configs

2 weeks ago

fetchWallpaper.nix

configs: rename from 2configs

2 weeks ago

fonts.nix

configs: rename from 2configs

2 weeks ago

games.nix

configs: rename from 2configs

2 weeks ago

gc.nix

machines.xerxes: remove

1 week ago

gg23.nix

configs.spora: remove, with mycelium and the spora input

1 week ago

green-host.nix

modules.sync-containers3: move options to lass.sync-containers3

2 weeks ago

gsm-wiki.nix

configs: rename from 2configs

2 weeks ago

hermes-mail-vars.nix

configs.mailserver: add hermes@lassul.us mailbox for coaxmetal hermes

1 week ago

hermes-proxy.nix

configs: remove omnigent, covibe and herdr from all machines

1 week ago

hotdog-host.nix

modules.sync-containers3: move options to lass.sync-containers3

2 weeks ago

htop.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

ipfs.nix

configs: rename from 2configs

2 weeks ago

kartei.nix

configs.kartei: drop krebs.users The option only fed lassul.us/ssh.pub, lassul.us/gpg.pub and makefu's key for the download user. ssh.pub now lists every key lass logs in with on neoprism, gpg.pub serves keys/pgp/yubi_pgp.pgp, and makefu's key is read from kartei directly.

2 weeks ago

kitty.nix

configs: rename from 2configs

2 weeks ago

mail.nix

configs: rename from 2configs

2 weeks ago

mailserver.nix

configs.mailserver: add hermes@lassul.us mailbox for coaxmetal hermes

1 week ago

mc.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

mouse.nix

configs: rename from 2configs

2 weeks ago

mumble-reminder.nix

Merge pull request #14 from riotbib/fix-mumblereminder-goldwaldsaenger

1 week ago

n2n-supernode.nix

configs: rename from 2configs

2 weeks ago

n8n.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

network-manager.nix

configs: rename from 2configs

2 weeks ago

networkd.nix

configs: rename from 2configs

2 weeks ago

nginx.nix

configs: rename from 2configs

2 weeks ago

nix.nix

configs: rename from 2configs

2 weeks ago

nixpkgs-triage.nix

configs: rename from 2configs

2 weeks ago

orange-host.nix

modules.sync-containers3: move options to lass.sync-containers3

2 weeks ago

pair-programming.nix

configs: allocate uids dynamically, drop stockholm.lib pairprogramming, radio, realwallpaper and the htgen users no longer get their ids from stockholm's genid. NixOS keeps the ids existing users already have in /etc/passwd and /etc/group, so nothing changes on deployed machines; fresh installs allocate them. The copied htgen, reaktor2 and realwallpaper modules use nixpkgs option types instead of stockholm's, htgen's user is a small name/home submodule (home still defaults to /home/<name>), and reaktor2 carries its own stripAttr.

2 weeks ago

parley.nix

configs: rename from 2configs

2 weeks ago

pass.nix

configs: rename from 2configs

2 weeks ago

phonetpm-ssh.nix

configs.phonetpm-ssh: init, use on ignavia, icarus and shodan

1 week ago

phonetpm.nix

configs.phonetpm-ssh: init, use on ignavia, icarus and shodan

1 week ago

pinned-registry.nix

configs: rename from 2configs

2 weeks ago

pipewire.nix

configs: remove omnigent, covibe and herdr from all machines

1 week ago

pocket-id.nix

configs: rename from 2configs

2 weeks ago

power-action.nix

configs: rename from 2configs

2 weeks ago

rad.nix

configs: rename from 2configs

2 weeks ago

radicale-user-generator.nix

configs.radicale: one shared calendar for lass, book and hermes

1 week ago

radicale.nix

configs.radicale: one shared calendar for lass, book and hermes

1 week ago

radicle.lassul.us.nix

configs: rename from 2configs

2 weeks ago

realwallpaper.nix

modules.realwallpaper: vendor from stockholm Copied from stockholm krebs/3modules/realwallpaper.nix (cc283503); the wallpaper generator comes from stockholm's packages output instead of its overlay.

2 weeks ago

retiolum.nix

configs.retiolum: restart tinc on switch instead of stopping it up front

1 week ago

review.nix

configs: rename from 2configs

2 weeks ago

riot.nix

configs.riot: let networkd own the host route to the container

2 weeks ago

rtl-sdr.nix

configs: rename from 2configs

2 weeks ago

security-workarounds.nix

configs: rename from 2configs

2 weeks ago

snapclient.nix

configs.snapserver: move from styx to acheron

1 week ago

snappymail.nix

configs: rename from 2configs

2 weeks ago

snapserver.nix

configs.snapserver: move from styx to acheron

1 week ago

ssh-redirect.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

steam.nix

configs: rename from 2configs

2 weeks ago

syncthing.nix

configs: remove weechat

2 weeks ago

tablet-screen.nix

configs: rename from 2configs

2 weeks ago

themes.nix

configs: rename from 2configs

2 weeks ago

timeful.nix

configs: rename from 2configs

2 weeks ago

tor-ssh.nix

configs: rename from 2configs

2 weeks ago

tpm2.nix

configs: rename from 2configs

2 weeks ago

udisks.nix

configs: rename from 2configs

2 weeks ago

vaultwarden.nix

configs: rename from 2configs

2 weeks ago

wine.nix

configs: rename from 2configs

2 weeks ago

xdg-open.nix

machines.mors: remove transgui

1 week ago

yggdrasil.nix

configs: rename from 2configs

2 weeks ago

yubikey.nix

configs: rename from 2configs

2 weeks ago

zsh.nix

configs: rename from 2configs

2 weeks ago

Configure Feed

Configure Feed