superconfig/machines/neoprism/ at 1d4be0946b5e72e895a8243b76c4cf4c7d09c00a · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines / neoprism

1 folder 5 files

at 1d4be0946b5e72e895a8243b76c4cf4c7d09c00a

lassulus neoprism: drop ollama, stage riot VM on bridged dedicated IP 4mo ago

Update facts/secrets for service mycelium in machine neoprism

2 years ago

machines.neoprism.backup: dump bridge databases, include heisenbridge Existing preHook only dumped matrix-synapse; the per-bridge postgres DBs (mautrix-{whatsapp,signal,telegram,discord}) and heisenbridge's sqlite state weren't covered. Losing them = relogin everywhere and orphaned portal rooms.

5 months ago

neoprism: drop ollama, stage riot VM on bridged dedicated IP ollama is no longer used here; removing it frees ~4G. Prepare a fresh libvirt guest for riot on a dedicated public IP (95.217.192.52, separate MAC) bridged directly onto ext-br. Because the bridge is unmanaged, libvirt installs no iptables rules for it, avoiding the nat-chain race that forced the old restart-iptables hack in hfos.nix. - physical.nix: enable the ext-br bridge, enslave enp35s0, host IP on bridge - config.nix: enable libvirtd, add riot login user, FORWARD accept for the VM IP Bridge cutover applies at the next reboot window; the VM is created imperatively afterwards. Assisted-by: Claude Code (claude-opus-4-8[1m])

4 months ago

mailserver: fix muchsync permissions with POSIX ACLs - Enable posixacl on zroot ZFS pool for /var/vmail - Set POSIX ACL default granting lass rwX on mail dir (new files inherit) - Fix /var/vmail permissions after dovecot pre-start resets to 0700 - Fix dovecot-acl-sync to skip cur/new/tmp/.notmuch subdirs - Change recursive tmpfiles rule to non-recursive to avoid setgid on files

7 months ago

machines.neoprism: add facter.json

2 years ago

neoprism: drop ollama, stage riot VM on bridged dedicated IP ollama is no longer used here; removing it frees ~4G. Prepare a fresh libvirt guest for riot on a dedicated public IP (95.217.192.52, separate MAC) bridged directly onto ext-br. Because the bridge is unmanaged, libvirt installs no iptables rules for it, avoiding the nat-chain race that forced the old restart-iptables hack in hfos.nix. - physical.nix: enable the ext-br bridge, enslave enp35s0, host IP on bridge - config.nix: enable libvirtd, add riot login user, FORWARD accept for the VM IP Bridge cutover applies at the next reboot window; the VM is created imperatively afterwards. Assisted-by: Claude Code (claude-opus-4-8[1m])

4 months ago