barnacle is the first node on kartei darwinModules.retiolum: 2configs/retiolum.nix
is built on nixpkgs services.tinc, systemd-networkd and networking.firewall,
none of which exist on nix-darwin.

Host data (addresses, aliases, peer host files) comes from lass/hosts/barnacle
in kartei; the NixOS machines still read their host data through stockholm and
will not route to barnacle until that kartei pin is bumped.

The Ed25519 keypair is a clan var like on the NixOS nodes, but deployed with
neededFor = "activation": clans /run/secrets installer is Linux-only (tmpfs +
move-mount). No RSA half, tincr is SPTPS/Ed25519-only.

The source has a full macOS backend (utun via SYSPROTO_CONTROL, recvmsg_x
batching), and 5pkgs/flake-module.nix filters on meta.availableOn, so the
linux-only platforms list kept packages.<darwin>.tincr from existing.
barnacle needs it for retiolum key generation.

location of person.lass from home-assistant on an OSM map with a 24h trail;
neoprism polls the hass history API every 2 min into a static json,
token via clan vars (where-lassul-us/token)

One radicle-node serves one keypair, so each machine that does radicle
work gets its own identity (vars generator `rad`) and a node running
as the `rad` system user over /var/lib/rad. The profile is group-shared
(setgid dirs, umask-002 wrappers for rad/git-remote-rad, pre-created
group-writable sqlite files) so any account in group `rad` signs with
the machine identity; mainUser is a member. RAD_HOME points there for
login shells. Imported explicitly on coaxmetal, neoprism, ignavia,
icarus and shodan.

Rename the public seed module to 2configs/radicle.lassul.us.nix and
switch its retired seed.radicle.garden entry to iris.radicle.network.

jitsi-videobridge's REST API already listens on 127.0.0.1:8080 on
neoprism, so radicle-httpd failed with "Address already in use" on every
restart and nginx proxied radicle.lassul.us to Jetty's 404 page.

Local clan service exporting <name>.r as a direct peer with priority 3000,
above internet/yggdrasil (2000).

matrix-nio 0.26 dropped the withOlm/python-olm arguments, breaking the
override and every nixos-yellow CI check since the last flake.lock update.

Fork carried only fix/pmtu-blackhole-recovery on a base now 167 commits
behind upstream. Upstream has since landed the principled successors
(pmtu revalidate-idle-UDP, sub-MINMTU convergence, UDPDiscoveryTimeout
floor, gossip dedup purge). tinc-crypto now links openssl-sys, so add
pkg-config + openssl.

Measured with ipfs-check against a pinned CID: DHT record present,
bitswap answering, no IPNI record, and every public gateway 504ing on
anything bigger than one block -- a DAG walked block by block over
bitswap from a single peer does not fit their request budget. The old
node (2configs/services/flix/ipfs.nix) ran Routing.Type autoclient,
which announces to cid.contact as well as the DHT, plus Provide
strategy pinned; mirror that and its swarm sizing.

With proxy_request_buffering off, nginx sizes the HTTP/2 per-stream flow
control window to max(client_body_buffer_size, http2_body_preread_size).
The 64 KiB default capped uploads at 64 KiB / 55 ms RTT = 1.2 MB/s while the
backend read slower than the client sent. Set client_body_buffer_size 8m for
the upload location; streaming (no disk spool) and timeouts are unchanged.

Warez-style hand-drawn logo, IBM VGA webfont inlined for exact
full-width scaling without JS, light/dark schemes, clickable nix
attrset profile with project links, robots.txt and eval-able
/profile.nix.

openai-agents 0.18.1 gained a websockets runtime dep that nixpkgs does not
declare yet, and nixpkgs' openai 2.53.0 is past omnigent's <2.45 cap.