jitsi-videobridge's REST API already listens on 127.0.0.1:8080 on
neoprism, so radicle-httpd failed with "Address already in use" on every
restart and nginx proxied radicle.lassul.us to Jetty's 404 page.

Local clan service exporting <name>.r as a direct peer with priority 3000,
above internet/yggdrasil (2000).

matrix-nio 0.26 dropped the withOlm/python-olm arguments, breaking the
override and every nixos-yellow CI check since the last flake.lock update.

Fork carried only fix/pmtu-blackhole-recovery on a base now 167 commits
behind upstream. Upstream has since landed the principled successors
(pmtu revalidate-idle-UDP, sub-MINMTU convergence, UDPDiscoveryTimeout
floor, gossip dedup purge). tinc-crypto now links openssl-sys, so add
pkg-config + openssl.

Measured with ipfs-check against a pinned CID: DHT record present,
bitswap answering, no IPNI record, and every public gateway 504ing on
anything bigger than one block -- a DAG walked block by block over
bitswap from a single peer does not fit their request budget. The old
node (2configs/services/flix/ipfs.nix) ran Routing.Type autoclient,
which announces to cid.contact as well as the DHT, plus Provide
strategy pinned; mirror that and its swarm sizing.

With proxy_request_buffering off, nginx sizes the HTTP/2 per-stream flow
control window to max(client_body_buffer_size, http2_body_preread_size).
The 64 KiB default capped uploads at 64 KiB / 55 ms RTT = 1.2 MB/s while the
backend read slower than the client sent. Set client_body_buffer_size 8m for
the upload location; streaming (no disk spool) and timeouts are unchanged.

Warez-style hand-drawn logo, IBM VGA webfont inlined for exact
full-width scaling without JS, light/dark schemes, clickable nix
attrset profile with project links, robots.txt and eval-able
/profile.nix.

openai-agents 0.18.1 gained a websockets runtime dep that nixpkgs does not
declare yet, and nixpkgs' openai 2.53.0 is past omnigent's <2.45 cap.

jellyfin only listens on IPv4, but yellow.r also resolves to its
retiolum AAAA. nginx round-robined both addresses, so requests
hitting the v6 upstream failed and poisoned the upstream group,
causing intermittent 502 'no live upstreams' on flix.lassul.us.

Also drop the stale duplicate flix vhost from container-host.nix.

kubo node (swarm :4001, gateway NoFetch) + anonymous tarball -> ipfs add
(blockstore, no --nocopy) -> pinned -> returns CID; refuses uploads with
<300GiB free; explicit ipfs-gc + ipfs-roots (pins are the stored GC roots).
dns: ipfs -> CNAME neoprism, starkstrom -> A 194.110.87.67.

BIOS/GPT disko on /dev/vda, static networkd, retiolum (inline
krebs.hosts.starkstrom); clan vars + nixos-facter; server tag,
internet host, deploy.forwardAgent.

The upstream QuickShell i3 plugin never removes a workspace model
object on rename: the rename event is looked up by the NEW name,
misses the cached object under the old name, and only logs a warning.
A renamed workspace therefore lingers as a stale pill until a full
refresh or shell restart; clicking that ghost re-creates the old name
as a real workspace (the pill click script runs
"workspace <name>, move workspace to output <out>").

Force I3.refreshWorkspaces() every 30s while the shell is running so
stale entries are pruned on their next model rebuild.

prism is decommissioned, so social.krebsco.de had no working entry
point while the hotdog container itself kept serving fine on neoprism.

DNS for social.krebsco.de still needs to be repointed to neoprism
before ACME can issue a cert.

Livestreams never played and VOD depends on companion keeping up with
YouTube's po_token and SABR changes, which it does not reliably enough to
be worth the moving parts.

Takes the residential exits with it: tinyproxy on styx and coaxmetal
existed only so neoprism could reach YouTube from a non-Hetzner address.

Leaves the generated companion key in vars/pass, matching how the
silverbullet and oauth2-proxy removals were handled.

Point at Lassulus/tincr fix/pmtu-blackhole-recovery (upstream main plus
the fix) until it lands in Mic92/tincr.

ignavia and coaxmetal sit behind the same NAT, which does not hairpin.
Once a relay hands each the other's reflexive address, every UDP probe
is answered with ICMP port unreachable, and tincr never recovers:
udp_timed_out measured from the probe send rather than the reply, so
the 10s keepalive kept pushing a 30s deadline out of reach and
udp_confirmed stayed pinned; with it pinned, discovery collapsed maxmtu
to 0 and nothing re-armed it, so every cycle re-converged to MTU 0.
Logged as "Fixing MTU of coaxmetal to 0" 201 times in 30 minutes with
the peer unusable, versus once for every healthy peer.

Also carries upstream PRs #13-#20 (riscv64, tincd-compat, default
package, systemd credential loading, multi-user.target).

Colours stay inside the terminal's ANSI palette (NNN_FCOLORS, NNN_COLORS,
bat's ansi theme, mdcat), including nnn's nerd icon table which hardcodes
xterm-256 codes, so retheming the terminal also retints a session running
on the far side of ssh.

The image previewer asks the terminal which graphics protocol it speaks
instead of letting chafa guess from inherited KITTY_* variables, which
claim kitty even where the data cannot reach a terminal and leave blank
placeholder cells behind. Frames are rendered into memory and written
with signals blocked, so preview-tui killing the previewer on a selection
change cannot truncate an escape sequence.

The kiosk account owns everything needed to test a game the way a player
meets it, and none of it is reachable from outside: sway holds seat0,
XDG_RUNTIME_DIR is 0700, the Xbox pad's evdev nodes are ACL'd to strom
(only the legacy js0 is world-readable, and SDL2 does not use it), and
/home/strom carries both the game state and the /home/strom/strom
checkout that strom-session resolves STROM_FLAKE from.

Follows the existing 2configs/{wine,review,ableton}.nix pattern.