Commits
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
.git/config does not exist in git worktrees, where .git is a file.
git.clan.lol is unreachable. clan-core and nix-select come from the
GitHub mirrors at the same revs; data-mesher has no mirror, so it
follows this flake, which exports an empty nixosModules.data-mesher.
The port 8000 redirect is an nginx return, /skip, /good and radio-news.r
run as CGI through fcgiwrap. Port 8001 and the dash 0.5.12 pin go away.
One python CGI (configs/paste/paste.py) replaces the htgen-paste,
htgen-imgur and htgen-cyberlocker handlers and the paste-form script.
Items keep their names and directories, so old links and the backups stay
as they are; systemd hands the directories to the new paste user. The
upload form now stores directly instead of posting back to p.krebsco.de.
nomads-cloud and grib2json are only realwallpaper dependencies; they are
pulled in by path since pkgs/ is not an overlay.
pairprogramming, radio, realwallpaper and the htgen users no longer get
their ids from stockholm's genid. NixOS keeps the ids existing users
already have in /etc/passwd and /etc/group, so nothing changes on
deployed machines; fresh installs allocate them.
The copied htgen, reaktor2 and realwallpaper modules use nixpkgs option
types instead of stockholm's, htgen's user is a small name/home
submodule (home still defaults to /home/<name>), and reaktor2 carries
its own stripAttr.
The option only fed lassul.us/ssh.pub, lassul.us/gpg.pub and makefu's
key for the download user. ssh.pub now lists every key lass logs in
with on neoprism, gpg.pub serves keys/pgp/yubi_pgp.pgp, and makefu's
key is read from kartei directly.
krebs.enable and krebs.sitemap were unused. krebs.ssl only trusted the
krebs intermediate CA, which expired on 2026-06-29, so that trust
validated nothing.
radio's playlist ACLs move from krebs.acl (setfacl -R at boot) to
systemd-tmpfiles: rwx on the playlist directory, default ACLs on its
tree so new files get rw and new directories rwx, and traverse on the
parents for lass. Existing content keeps the ACLs it already has; X is
avoided because tmpfiles applies it to existing files with an r-- mask.
One python CGI (configs/paste/paste.py) replaces the htgen-paste,
htgen-imgur and htgen-cyberlocker handlers and the paste-form script.
Items keep their names and directories, so old links and the backups stay
as they are; systemd hands the directories to the new paste user. The
upload form now stores directly instead of posting back to p.krebsco.de.
pairprogramming, radio, realwallpaper and the htgen users no longer get
their ids from stockholm's genid. NixOS keeps the ids existing users
already have in /etc/passwd and /etc/group, so nothing changes on
deployed machines; fresh installs allocate them.
The copied htgen, reaktor2 and realwallpaper modules use nixpkgs option
types instead of stockholm's, htgen's user is a small name/home
submodule (home still defaults to /home/<name>), and reaktor2 carries
its own stripAttr.
krebs.enable and krebs.sitemap were unused. krebs.ssl only trusted the
krebs intermediate CA, which expired on 2026-06-29, so that trust
validated nothing.
radio's playlist ACLs move from krebs.acl (setfacl -R at boot) to
systemd-tmpfiles: rwx on the playlist directory, default ACLs on its
tree so new files get rw and new directories rwx, and traverse on the
parents for lass. Existing content keeps the ACLs it already has; X is
avoided because tmpfiles applies it to existing files with an r-- mask.