This repository has no description
machines.coaxmetal: add crit review daemons reachable over retiolum
author
lassulus
date
(Oct 9, 2026, 8:03 PM CEST)
commit
e8122494
e8122494128da8391063c655bbedfe4e3511f01b
parent
3624640d
3624640de3a3037cbd3c8d71cdd78313e23c8cf1
+59
+58
configs/crit.nix
+58
configs/crit.nix
···
1
+
# crit (https://crit.md): agents run `crit` to open their diff/plan for review
2
+
# in the browser and block until it is finished. Each review session is its
3
+
# own daemon on its own port, reachable over retiolum as
4
+
# http://<host>.r:<port>.
5
+
#
6
+
# SECURITY: crit has no authentication, and comments left in a review are fed
7
+
# to the agent as instructions. Whoever can reach a daemon can steer an agent
8
+
# running here, so the ports are only open on retiolum.
9
+
{
10
+
self,
11
+
config,
12
+
pkgs,
13
+
...
14
+
}:
15
+
let
16
+
firstPort = 7700;
17
+
lastPort = 7719;
18
+
crit-unwrapped = self.inputs.llm-agents.packages.${pkgs.system}.crit;
19
+
20
+
# crit binds 127.0.0.1 on a random port by default. Bind all interfaces on a
21
+
# free port from the firewalled range instead and advertise the retiolum URL.
22
+
# Only the invocation that starts a daemon binds the port; reconnecting to a
23
+
# running session uses the port and URL recorded in ~/.crit/sessions.
24
+
crit = pkgs.symlinkJoin {
25
+
name = "crit";
26
+
paths = [
27
+
(pkgs.writeShellScriptBin "crit" ''
28
+
if [ -z "''${CRIT_PORT:-}" ]; then
29
+
for p in $(${pkgs.coreutils}/bin/seq ${toString firstPort} ${toString lastPort}); do
30
+
if [ -z "$(${pkgs.iproute2}/bin/ss -Htln "sport = :$p")" ]; then
31
+
export CRIT_PORT=$p
32
+
break
33
+
fi
34
+
done
35
+
fi
36
+
if [ -n "''${CRIT_PORT:-}" ]; then
37
+
export CRIT_PUBLIC_URL="''${CRIT_PUBLIC_URL:-http://${config.networking.hostName}.r:$CRIT_PORT}"
38
+
else
39
+
echo "crit: ports ${toString firstPort}-${toString lastPort} all busy, using a random port (not reachable over retiolum)" >&2
40
+
fi
41
+
export CRIT_HOST="''${CRIT_HOST:-0.0.0.0}"
42
+
export CRIT_ALLOW_UNAUTHENTICATED_NETWORK=1
43
+
exec ${crit-unwrapped}/bin/crit "$@"
44
+
'')
45
+
crit-unwrapped
46
+
];
47
+
};
48
+
in
49
+
{
50
+
environment.systemPackages = [ crit ];
51
+
52
+
networking.firewall.interfaces.retiolum.allowedTCPPortRanges = [
53
+
{
54
+
from = firstPort;
55
+
to = lastPort;
56
+
}
57
+
];
58
+
}