jitsi-videobridge's REST API already listens on 127.0.0.1:8080 on
neoprism, so radicle-httpd failed with "Address already in use" on every
restart and nginx proxied radicle.lassul.us to Jetty's 404 page.

Local clan service exporting <name>.r as a direct peer with priority 3000,
above internet/yggdrasil (2000).

matrix-nio 0.26 dropped the withOlm/python-olm arguments, breaking the
override and every nixos-yellow CI check since the last flake.lock update.

Fork carried only fix/pmtu-blackhole-recovery on a base now 167 commits
behind upstream. Upstream has since landed the principled successors
(pmtu revalidate-idle-UDP, sub-MINMTU convergence, UDPDiscoveryTimeout
floor, gossip dedup purge). tinc-crypto now links openssl-sys, so add
pkg-config + openssl.

Measured with ipfs-check against a pinned CID: DHT record present,
bitswap answering, no IPNI record, and every public gateway 504ing on
anything bigger than one block -- a DAG walked block by block over
bitswap from a single peer does not fit their request budget. The old
node (2configs/services/flix/ipfs.nix) ran Routing.Type autoclient,
which announces to cid.contact as well as the DHT, plus Provide
strategy pinned; mirror that and its swarm sizing.

With proxy_request_buffering off, nginx sizes the HTTP/2 per-stream flow
control window to max(client_body_buffer_size, http2_body_preread_size).
The 64 KiB default capped uploads at 64 KiB / 55 ms RTT = 1.2 MB/s while the
backend read slower than the client sent. Set client_body_buffer_size 8m for
the upload location; streaming (no disk spool) and timeouts are unchanged.

Warez-style hand-drawn logo, IBM VGA webfont inlined for exact
full-width scaling without JS, light/dark schemes, clickable nix
attrset profile with project links, robots.txt and eval-able
/profile.nix.

openai-agents 0.18.1 gained a websockets runtime dep that nixpkgs does not
declare yet, and nixpkgs' openai 2.53.0 is past omnigent's <2.45 cap.

jellyfin only listens on IPv4, but yellow.r also resolves to its
retiolum AAAA. nginx round-robined both addresses, so requests
hitting the v6 upstream failed and poisoned the upstream group,
causing intermittent 502 'no live upstreams' on flix.lassul.us.

Also drop the stale duplicate flix vhost from container-host.nix.

kubo node (swarm :4001, gateway NoFetch) + anonymous tarball -> ipfs add
(blockstore, no --nocopy) -> pinned -> returns CID; refuses uploads with
<300GiB free; explicit ipfs-gc + ipfs-roots (pins are the stored GC roots).
dns: ipfs -> CNAME neoprism, starkstrom -> A 194.110.87.67.