superconfig/machines/ at 176daabcaf528d05f52fa83d479e8bf71619ce94 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines

18 folders

at 176daabcaf528d05f52fa83d479e8bf71619ce94

lassulus machines.coaxmetal.strom: let lass sudo to strom without a password 2mo ago

remove exim from all machines and clean up references

7 months ago

machines.barnacle: add radicle-node

5 months ago

machines.coaxmetal.strom: let lass sudo to strom without a password The kiosk account owns everything needed to test a game the way a player meets it, and none of it is reachable from outside: sway holds seat0, XDG_RUNTIME_DIR is 0700, the Xbox pad's evdev nodes are ACL'd to strom (only the legacy js0 is world-readable, and SDL2 does not use it), and /home/strom carries both the game state and the /home/strom/strom checkout that strom-session resolves STROM_FLAKE from. Follows the existing 2configs/{wine,review,ableton}.nix pattern.

2 months ago

machines.daedalus: drop hexchat (removed from nixpkgs)

2 months ago

green: remove mail services (migrated to neoprism)

7 months ago

refactor: move common configuration to 2configs/default.nix - Move clan and stockholm configuration from flake.nix to 2configs/default.nix - Simplify flake.nix machines definition to only import physical.nix - Add explicit import of ../../2configs to each machine's config.nix - This allows for more selective configuration imports per machine

1 year ago

remove exim from all machines and clean up references

7 months ago

machines.ignavia: add libmtp

2 months ago

remove exim from all machines and clean up references

7 months ago

2configs/services/invidious: youtube frontend on neoprism (yt.lassul.us) invidious plus invidious-companion, with every request to YouTube going out through the residential exits on styx (primary) and coaxmetal (backup). An nginx stream block fans 127.0.0.1:8118 into the two tinyproxies; failover rather than round-robin, because YouTube binds po_tokens and videoplayback URLs to the requesting address. The companion key is generated once into a clan var and handed to invidious as a systemd credential (the config script runs as the DynamicUser, which cannot read /run/secrets) and to the container as an EnvironmentFile. default_user_preferences.local is forced on: upstream defaults it off, which makes invidious hand the browser raw googlevideo URLs that are minted for the exit's address, so they 403 for the client and leak the exit IP. Playback paths additionally require a real session via auth_request, since the bytes come off a residential line. invidious is pinned one release ahead of our nixpkgs for the comments parser fix; drop the override once the pin catches up. Livestreams do not play: YouTube serves them SABR-only or with HLS segments that 403 without a po_token, and invidious' HLS path bypasses companion. Upstream gap, tracked in iv-org/invidious#3811 and iv-org/invidious-companion#7.

2 months ago

orange: drop cgit/git service orange's autoswitch was failing activation: the git service's mkdir /var/lib/git hit a symlink loop (a stale dangling `state/git -> ../../var/state/git` link that loops because the container bind-mounts both /var/lib and /var/state to the same state dir). cgit is being retired, so remove the services/git import entirely. This also unblocks orange's autoswitch (it no longer touches /var/lib/git). Assisted-by: Claude Code (claude-opus-4-8[1m])

4 months ago

machines.{prism,neoprism}: migrate realwallpaper, lassul.us website, bgt-bot Move realwallpaper service and lassul.us website from prism to neoprism. DNS for lassul.us already points at neoprism. bgt-bot is commented out on neoprism for now; can be enabled later if it goes down on prism (which currently isn't deploying anyway). Drop the now-redundant lassul.us -> orange.r proxy in orange-host.nix and the lassul.us acme fallback on prism.

5 months ago

*: migrate facts to vars

10 months ago

machines.shodan: disable hdapsd for now

9 months ago

2configs/residential-exit: forward proxy for youtube traffic on styx + coaxmetal YouTube throttles and blocks Hetzner ranges, so neoprism cannot talk to it directly. tinyproxy listens on the retiolum address of each box and only accepts neoprism, giving invidious a residential exit.

2 months ago

fix extra-container eval: add dummy nixos-init option extra-container uses a minimal NixOS module set for fast evaluation. nixpkgs unstable added nixos-init.nix and systemd.nix now references config.system.nixos-init.package, but extra-container's module set doesn't include it. Add a dummy nixos-init.package option to the outer container config, matching extra-container's existing pattern for missing options. Also fixes services.mingetty -> services.getty rename in virtulus.

8 months ago

radicle: run a public allow-all seed on neoprism (radicle.lassul.us, 80G quota) Extend 2configs/radicle.nix into a public seed: allow-all seeding (scope=all), listen 0.0.0.0:8776 + externalAddresses radicle.lassul.us:8776, radicle-httpd behind an nginx vhost (radicle.lassul.us, ACME). Drop the tor proxy + onion preferred seeds. Move the config off xerxes onto neoprism, and put the node state on tank at /var/lib/radicle with an 80G ZFS quota (radicle has no built-in byte quota; the dataset bounds it).

2 months ago

yellow: resolve AirVPN endpoint in main netns for transmission tunnel Recent wireguard-tools resolve the peer Endpoint in the namespace where `wg syncconf` runs. The transmission netns has no route until the tunnel is up, so resolving europe.vpn.airdns.org from inside it always fails; wg burns ~70s of DNS-retry backoff per attempt before erroring. During a nixos switch that restarts transmission-netns this stalled the whole deploy for >2min and left the service (and the download stack) failed. Resolve the endpoint in the main netns (which has connectivity, and is already gated on the `host` check above) and hand wg a numeric Endpoint, so the tunnel comes up instantly. Also fix the bare `sleep` in the DNS wait loop, which errored under `set -e` instead of retrying. Assisted-by: Claude Code (claude-opus-4-8)

4 months ago