This repository has no description
neoprism: drop ollama, stage riot VM on bridged dedicated IP
ollama is no longer used here; removing it frees ~4G.
Prepare a fresh libvirt guest for riot on a dedicated public IP
(95.217.192.52, separate MAC) bridged directly onto ext-br. Because the
bridge is unmanaged, libvirt installs no iptables rules for it, avoiding
the nat-chain race that forced the old restart-iptables hack in hfos.nix.
- physical.nix: enable the ext-br bridge, enslave enp35s0, host IP on bridge
- config.nix: enable libvirtd, add riot login user, FORWARD accept for the VM IP
Bridge cutover applies at the next reboot window; the VM is created
imperatively afterwards.
Assisted-by: Claude Code (claude-opus-4-8[1m])
author
lassulus
date
(Jun 20, 2026, 7:10 PM CEST)
commit
8ec0532b
8ec0532b7e4e5643bbdfe84c940091160d75ec67
parent
82d916e0
82d916e051f550e62ae6b0a2948cf369fbfd42fe
+38
-20
+25
-1
machines/neoprism/config.nix
+25
-1
machines/neoprism/config.nix
···
116
116
};
117
117
};
118
118
119
-
services.ollama.enable = true;
119
+
# riot VM (HFOS): fresh libvirt guest on a dedicated bridged public IP.
120
+
# Bridged onto ext-br with its own Hetzner MAC, so libvirt manages no
121
+
# iptables for it -> no nat-chain race, no restart-iptables hack (cf. hfos.nix).
122
+
virtualisation.libvirtd.enable = true;
123
+
security.polkit.enable = true;
124
+
users.users.riot = {
125
+
isNormalUser = true;
126
+
extraGroups = [ "libvirtd" ];
127
+
openssh.authorizedKeys.keys = [
128
+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCwcI8EKqUwYVd4IlnTTaNY3qVMDe2M1sVPMdWaTJ8FnAXixBcZozFHyJ9bvGn6c/vFGBEACZk6QCxC2+sTxbaodCOUIyhAtxqAGO7jINmGrVWjg2NW8qBi+e+ekr2+jlhizxgMPgMcbawuazpMzrozi6sfJfRelJRqe6TxrK/SBO+V5pf8v2ubAfHHF6bJrqAykC247d2NmsHEyM/nGOOb2AlJx2vrK1FbFWr2fBAvnhJww9wqrfDYSM6+oRF/vrYKkT9cU8yjtCkyaJZTqRufF2pzc9a0X3Z4LHEIUykAl2aVmi5Wzh8CZj3qCeVb9Ju0ZGQIa5pvG5CbH5SUJOr9y6zhTx1xbqL+JYGkJqgHPMOCFiNIvWnFaNlnvFf4C9KcTf/VMOEvNdDklpjoWm+ptuQIciAhWKuUHd/6MqaRjmlvUqjl49EkRvYOGn9vasKt66MYrtfvbZ3tcqh5w9EEKhrcygiUXhIJzhu2s1BseAVRLjCsQ24BNbzrYiCO+vuk8/hdeHB1rP6Sas2v7jvYb3zQd647OTq+HrZWN8aCjCs5h8Y0QxrQzsLru0zKDRaNDlbSshNBAw7PzSXQAf9fISH7v6sC4nstf5jk+87ua/7xjWG4NYp5Y9FMFCsuE3XVmUCAbauq18RmN6V4s2TxCEs9bxONO0Vba4zwPnvMlw== cardno:000619250765"
129
+
];
130
+
};
131
+
# the only forwarding the VM needs: accept traffic to/from its public IP.
132
+
krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
133
+
{
134
+
v6 = false;
135
+
predicate = "--destination 95.217.192.52";
136
+
target = "ACCEPT";
137
+
}
138
+
{
139
+
v6 = false;
140
+
predicate = "--source 95.217.192.52";
141
+
target = "ACCEPT";
142
+
}
143
+
];
120
144
121
145
krebs.build.host = config.krebs.hosts.neoprism;
122
146
system.stateVersion = "24.05";
+13
-19
machines/neoprism/physical.nix
+13
-19
machines/neoprism/physical.nix
···
39
39
config = {
40
40
networkConfig.SpeedMeter = true;
41
41
};
42
-
# netdevs.ext-br.netdevConfig = {
43
-
# Kind = "bridge";
44
-
# Name = "ext-br";
45
-
# MACAddress = "a8:a1:59:0f:2d:69";
46
-
# };
47
-
# networks.ext-br = {
48
-
# name = "ext-br";
49
-
# address = [
50
-
# "95.217.192.59/26"
51
-
# "2a01:4f9:4a:4f1a::1/64"
52
-
# ];
53
-
# gateway = [
54
-
# "95.217.192.1"
55
-
# "fe80::1"
56
-
# ];
57
-
# };
58
-
networks."01-enp" = {
59
-
#bridge = [ "ext-br" ];
60
-
matchConfig.Name = "enp35s0";
42
+
netdevs.ext-br.netdevConfig = {
43
+
Kind = "bridge";
44
+
Name = "ext-br";
45
+
# keep the host's NIC MAC bound to the host IP on Hetzner's switch
46
+
MACAddress = "a8:a1:59:0f:2d:69";
47
+
};
48
+
networks.ext-br = {
49
+
matchConfig.Name = "ext-br";
61
50
address = [
62
51
"95.217.192.59/26"
63
52
"2a01:4f9:4a:4f1a::2/64"
···
66
55
"95.217.192.1"
67
56
"fe80::1"
68
57
];
58
+
};
59
+
networks."01-enp" = {
60
+
matchConfig.Name = "enp35s0";
61
+
# enslave the physical NIC to ext-br; the host IP lives on the bridge now
62
+
bridge = [ "ext-br" ];
69
63
};
70
64
};
71
65