This repository has no description
configs: drop the stockholm krebs, sitemap, ssl and acl modules
krebs.enable and krebs.sitemap were unused. krebs.ssl only trusted the
krebs intermediate CA, which expired on 2026-06-29, so that trust
validated nothing.
radio's playlist ACLs move from krebs.acl (setfacl -R at boot) to
systemd-tmpfiles: rwx on the playlist directory, default ACLs on its
tree so new files get rw and new directories rwx, and traverse on the
parents for lass. Existing content keeps the ACLs it already has; X is
avoided because tmpfiles applies it to existing files with an r-- mask.
author
lassulus
date
(Oct 7, 2026, 1:35 AM CEST)
commit
037fe687
037fe68771a38cb6efed1335be3bb16a57292764
parent
d9ed1677
d9ed1677f840abf52cd1816b534ddd0f87e76264
+14
-15
-11
configs/default.nix
-11
configs/default.nix
···
14
14
# Import modules
15
15
../modules
16
16
17
-
# Import stockholm krebs module
18
-
self.inputs.stockholm.nixosModules.krebs
19
-
20
17
# Import individual configurations
21
18
./security-workarounds.nix
22
19
./gc.nix
···
28
25
./pinned-registry.nix
29
26
./nix.nix
30
27
31
-
# Import stockholm modules
32
28
./kartei.nix
33
-
self.inputs.stockholm.nixosModules.sitemap
34
-
self.inputs.stockholm.nixosModules.ssl
35
29
{
36
30
# nix-index
37
31
imports = [
···
149
143
];
150
144
151
145
networking.hostName = config.clan.core.settings.machine.name;
152
-
153
-
krebs = {
154
-
enable = true;
155
-
ssl.trustIntermediate = true;
156
-
};
157
146
158
147
users.mutableUsers = false;
159
148
+14
-4
configs/services/radio/default.nix
+14
-4
configs/services/radio/default.nix
···
80
80
imports = [
81
81
./news.nix
82
82
./weather.nix
83
-
self.inputs.stockholm.nixosModules.acl
84
83
];
85
84
86
85
users.users = {
···
304
303
"radio"
305
304
];
306
305
};
307
-
krebs.acl."/var/music/the_playlist"."u:lass:X".parents = true;
308
-
krebs.acl."/var/music/the_playlist"."u:lass:rwX" = { };
309
-
krebs.acl."/var/music/the_playlist"."u:radio:rwX" = { };
306
+
# lass and radio manage the playlist. The default ACL hands rw on new
307
+
# files and rwx on new directories to both (files are created without x,
308
+
# so the mask drops it); existing content keeps the ACLs it already has.
309
+
# No X: tmpfiles applies it to existing files with an r-- mask.
310
+
systemd.tmpfiles.settings."10-the-playlist" = {
311
+
"/var/music/the_playlist" = {
312
+
d = { };
313
+
"a+".argument = "u:lass:rwx,u:radio:rwx";
314
+
"A+".argument = "d:u:lass:rwx,d:u:radio:rwx";
315
+
};
316
+
# traverse down to the playlist
317
+
"/var/music"."a+".argument = "u:lass:x";
318
+
"/var"."a+".argument = "u:lass:x";
319
+
};
310
320
}