Commits
pkgs.phonetpm: 0.4.1 -> 0.4.2
Branches, PRs and auto-merge now use the UPDATE_PKGS_TOKEN repo secret
instead of GITHUB_TOKEN, so the normal pull_request ci.yml run (with the
farm build) shows up on each PR and GitHub merges it with a merge commit
once the ruleset is met. The serial verify job (rebase, dispatch ci.yml,
wait, merge) and the final ci dispatch on master are gone: the auto-merge
counts as the token's, so the push to master triggers ci.yml itself.
UPDATE_PKGS_TOKEN: fine-grained PAT (or GitHub App token) for this repo
with Contents: read/write, Pull requests: read/write and Workflows:
read/write (force-pushing an update branch rebased over master commits that
touched .github/workflows is refused without it). The repo needs "Allow
auto-merge" enabled. The workflow fails early if the secret is missing.
Grafana 13 no longer ships the prometheus datasource as a core plugin, so the provisioned VictoriaMetrics datasource was unusable. Switch it and the dashboards to victoriametrics-metrics-datasource.
Every NixOS machine runs Vector (host metrics, internal metrics, journal)
and writes to VictoriaMetrics/VictoriaLogs on both styx and coaxmetal,
each sink with a 512 MiB disk buffer. Both servers run vmalert (metrics and
LogsQL instances), a two-node Alertmanager cluster posting to Matrix via
matrix-alertmanager-receiver, Gatus (results scraped into VictoriaMetrics,
alerted on by vmalert) and Grafana with provisioned datasources and
dashboards. All ports are open on retiolum only.
Replaces telegraf on neoprism, including the borgbackup status file.
The client gives up after connect-timeout on a store it has never reached.
At farm start envoy has no builder yet (none joined, or not yet dialed and
health checked through its tunnel), answers with grpc-status 14, and a few
machine jobs failed on their first QueryMissing. Probe a health check through
the balancer until a builder answers it.
hermes-agent runs with ProtectSystem=strict and cannot write the
group-writable routes dir. crit now asks crit-routes.socket (group crit)
for a route; a root service picks the id, writes the route, regenerates
the nginx map and reloads nginx.
Encrypting to an age1gpg recipient asked gpg-agent (READKEY) for the
public key, which fails on hosts that only have the public key imported
and no secret key or smartcard stub. Export the key by keygrip with gpg
instead in that case and build the same key as the agent path, so
stanzas are unchanged. Decryption still goes through gpg-agent.
ci.yml calls farm.yml (now reusable) instead of the eval-only nixos-*
checks, which are gone from flake.nix. The farm job is only the
coordinator (scheduler + envoy, which now requires the farm client
cert, reachable over iroh). Each machine job joins as a builder,
evaluates its machine, builds the toplevel through the farm and leaves
when done; its outputs are in niks3 by then.
ci runs for master pushes, PRs and dispatches; a newer run for the same
ref cancels the older one, farms of different refs queue FIFO
(queue: max). update-pkgs verifies PRs with ci.yml alone.
The crit wrapper writes a fresh random 10-char id per daemon port into
/var/lib/crit-routes; a path unit turns that into an nginx map on
coaxmetal:7720 (retiolum only). neoprism proxies *.review.lassul.us there
with a wildcard cert obtained via DNS-01 (RFC2136) against a delegated
_acme-challenge.review.lassul.us zone on knot, so ids never hit CT logs.
acheron gets a minimal system-wide pipewire with a virtual "hub" sink.
Any LAN machine sends into it via ROC while `gg23-audio` from
tools/gg23-audio runs (ROC sink loaded into pipewire-pulse, removed again
on Ctrl-C), barnacle via AirPlay 1 (shairport-sync, "gg23", pipewire
backend, mDNS on int0 only).
The hub monitor is linked to ROC sinks for shodan and icarus (room.nix),
chosen with `audio-room shodan|icarus|both|off` or from Home Assistant via
MQTT discovery (select + buttons). Retained MQTT commands restore the choice
after pipewire restarts.
The rooms have no stable LAN address, so the hub sends to their retiolum IPs
and they accept the ROC ports only from acheron on retiolum.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Branches, PRs and auto-merge now use the UPDATE_PKGS_TOKEN repo secret
instead of GITHUB_TOKEN, so the normal pull_request ci.yml run (with the
farm build) shows up on each PR and GitHub merges it with a merge commit
once the ruleset is met. The serial verify job (rebase, dispatch ci.yml,
wait, merge) and the final ci dispatch on master are gone: the auto-merge
counts as the token's, so the push to master triggers ci.yml itself.
UPDATE_PKGS_TOKEN: fine-grained PAT (or GitHub App token) for this repo
with Contents: read/write, Pull requests: read/write and Workflows:
read/write (force-pushing an update branch rebased over master commits that
touched .github/workflows is refused without it). The repo needs "Allow
auto-merge" enabled. The workflow fails early if the secret is missing.
Every NixOS machine runs Vector (host metrics, internal metrics, journal)
and writes to VictoriaMetrics/VictoriaLogs on both styx and coaxmetal,
each sink with a 512 MiB disk buffer. Both servers run vmalert (metrics and
LogsQL instances), a two-node Alertmanager cluster posting to Matrix via
matrix-alertmanager-receiver, Gatus (results scraped into VictoriaMetrics,
alerted on by vmalert) and Grafana with provisioned datasources and
dashboards. All ports are open on retiolum only.
Replaces telegraf on neoprism, including the borgbackup status file.
The client gives up after connect-timeout on a store it has never reached.
At farm start envoy has no builder yet (none joined, or not yet dialed and
health checked through its tunnel), answers with grpc-status 14, and a few
machine jobs failed on their first QueryMissing. Probe a health check through
the balancer until a builder answers it.
Encrypting to an age1gpg recipient asked gpg-agent (READKEY) for the
public key, which fails on hosts that only have the public key imported
and no secret key or smartcard stub. Export the key by keygrip with gpg
instead in that case and build the same key as the agent path, so
stanzas are unchanged. Decryption still goes through gpg-agent.
ci.yml calls farm.yml (now reusable) instead of the eval-only nixos-*
checks, which are gone from flake.nix. The farm job is only the
coordinator (scheduler + envoy, which now requires the farm client
cert, reachable over iroh). Each machine job joins as a builder,
evaluates its machine, builds the toplevel through the farm and leaves
when done; its outputs are in niks3 by then.
ci runs for master pushes, PRs and dispatches; a newer run for the same
ref cancels the older one, farms of different refs queue FIFO
(queue: max). update-pkgs verifies PRs with ci.yml alone.
The crit wrapper writes a fresh random 10-char id per daemon port into
/var/lib/crit-routes; a path unit turns that into an nginx map on
coaxmetal:7720 (retiolum only). neoprism proxies *.review.lassul.us there
with a wildcard cert obtained via DNS-01 (RFC2136) against a delegated
_acme-challenge.review.lassul.us zone on knot, so ids never hit CT logs.
acheron gets a minimal system-wide pipewire with a virtual "hub" sink.
Any LAN machine sends into it via ROC while `gg23-audio` from
tools/gg23-audio runs (ROC sink loaded into pipewire-pulse, removed again
on Ctrl-C), barnacle via AirPlay 1 (shairport-sync, "gg23", pipewire
backend, mDNS on int0 only).
The hub monitor is linked to ROC sinks for shodan and icarus (room.nix),
chosen with `audio-room shodan|icarus|both|off` or from Home Assistant via
MQTT discovery (select + buttons). Retained MQTT commands restore the choice
after pipewire restarts.
The rooms have no stable LAN address, so the hub sends to their retiolum IPs
and they accept the ROC ports only from acheron on retiolum.