superconfig/configs/ at 38937c4fef397a054b273515624e988dd7994138 · lass.pds.lassul.us/superconfig

boot

configs: rename from 2configs

2 weeks ago

desktops

configs: remove klem

2 weeks ago

dns

configs: rename from 2configs

2 weeks ago

hass

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

hw

configs: remove dead modules

2 weeks ago

iroh-relay

configs: rename from 2configs

2 weeks ago

monitoring

configs: remove dead modules

2 weeks ago

ppp

configs: rename from 2configs

2 weeks ago

printing

configs: rename from 2configs

2 weeks ago

services

configs: drop the stockholm krebs, sitemap, ssl and acl modules krebs.enable and krebs.sitemap were unused. krebs.ssl only trusted the krebs intermediate CA, which expired on 2026-06-29, so that trust validated nothing. radio's playlist ACLs move from krebs.acl (setfacl -R at boot) to systemd-tmpfiles: rwx on the playlist directory, default ACLs on its tree so new files get rw and new directories rwx, and traverse on the parents for lass. Existing content keeps the ACLs it already has; X is avoided because tmpfiles applies it to existing files with an r-- mask.

2 weeks ago

sigexec

configs: rename from 2configs

2 weeks ago

websites

configs.kartei: drop krebs.users The option only fed lassul.us/ssh.pub, lassul.us/gpg.pub and makefu's key for the download user. ssh.pub now lists every key lass logs in with on neoprism, gpg.pub serves keys/pgp/yubi_pgp.pgp, and makefu's key is read from kartei directly.

2 weeks ago

yellow-mounts

configs: rename from 2configs

2 weeks ago

ableton.nix

configs: rename from 2configs

2 weeks ago

alacritty.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

android-webcam.nix

configs: rename from 2configs

2 weeks ago

atuin-server.nix

configs: rename from 2configs

2 weeks ago

auto-timezone.nix

configs: rename from 2configs

2 weeks ago

autotether.nix

configs: rename from 2configs

2 weeks ago

autoupdate.nix

configs: rename from 2configs

2 weeks ago

bitlbee.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

book.nix

neoprism: host book on book.lassul.us

2 weeks ago

br.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

browsers.nix

configs: rename from 2configs

2 weeks ago

c-base-ai-tunnel.nix

configs: rename from 2configs

2 weeks ago

cast.nix

configs: rename from 2configs

2 weeks ago

consul.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

container-bridge.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

container-tests.nix

configs: rename from 2configs

2 weeks ago

covibe.nix

configs: rename from 2configs

2 weeks ago

default.nix

configs: drop the stockholm krebs, sitemap, ssl and acl modules krebs.enable and krebs.sitemap were unused. krebs.ssl only trusted the krebs intermediate CA, which expired on 2026-06-29, so that trust validated nothing. radio's playlist ACLs move from krebs.acl (setfacl -R at boot) to systemd-tmpfiles: rwx on the playlist directory, default ACLs on its tree so new files get rw and new directories rwx, and traverse on the parents for lass. Existing content keeps the ACLs it already has; X is avoided because tmpfiles applies it to existing files with an r-- mask.

2 weeks ago

docuseal.nix

configs: rename from 2configs

2 weeks ago

download-user.nix

configs.kartei: drop krebs.users The option only fed lassul.us/ssh.pub, lassul.us/gpg.pub and makefu's key for the download user. ssh.pub now lists every key lass logs in with on neoprism, gpg.pub serves keys/pgp/yubi_pgp.pgp, and makefu's key is read from kartei directly.

2 weeks ago

dunst.nix

configs: rename from 2configs

2 weeks ago

et-server.nix

configs: rename from 2configs

2 weeks ago

fetchWallpaper.nix

configs: rename from 2configs

2 weeks ago

fonts.nix

configs: rename from 2configs

2 weeks ago

games.nix

configs: rename from 2configs

2 weeks ago

gc.nix

configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover

2 weeks ago

gg23.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

green-host.nix

configs: rename from 2configs

2 weeks ago

gsm-wiki.nix

configs: rename from 2configs

2 weeks ago

herdr.nix

configs: rename from 2configs

2 weeks ago

hermes-proxy.nix

configs: rename from 2configs

2 weeks ago

hotdog-host.nix

configs: rename from 2configs

2 weeks ago

htop.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

ipfs.nix

configs: rename from 2configs

2 weeks ago

kannix.nix

configs: rename from 2configs

2 weeks ago

kartei.nix

configs.kartei: drop krebs.users The option only fed lassul.us/ssh.pub, lassul.us/gpg.pub and makefu's key for the download user. ssh.pub now lists every key lass logs in with on neoprism, gpg.pub serves keys/pgp/yubi_pgp.pgp, and makefu's key is read from kartei directly.

2 weeks ago

kitty.nix

configs: rename from 2configs

2 weeks ago

mail.nix

configs: rename from 2configs

2 weeks ago

mailserver.nix

configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover

2 weeks ago

mc.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

mouse.nix

configs: rename from 2configs

2 weeks ago

mumble-reminder.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

n2n-supernode.nix

configs: rename from 2configs

2 weeks ago

n8n.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

network-manager.nix

configs: rename from 2configs

2 weeks ago

networkd.nix

configs: rename from 2configs

2 weeks ago

nginx.nix

configs: rename from 2configs

2 weeks ago

nix.nix

configs: rename from 2configs

2 weeks ago

nixpkgs-triage.nix

configs: rename from 2configs

2 weeks ago

omnigent.nix

configs: rename from 2configs

2 weeks ago

opencrow.nix

configs: rename from 2configs

2 weeks ago

orange-host.nix

configs: rename from 2configs

2 weeks ago

pair-programming.nix

configs: rename from 2configs

2 weeks ago

parley.nix

configs: rename from 2configs

2 weeks ago

pass.nix

configs: rename from 2configs

2 weeks ago

paste.nix

configs: drop ACME certificates for retiolum names Let's Encrypt refuses .r names and the vhosts on ca.r keep failing to renew, so serve paste/cyberlocker (c.r, p.r), radio.r, radio-news.r and yellow's flix vhosts over plain http instead.

2 weeks ago

phonetpm.nix

configs: rename from 2configs

2 weeks ago

pinned-registry.nix

configs: rename from 2configs

2 weeks ago

pipewire.nix

configs: rename from 2configs

2 weeks ago

pocket-id.nix

configs: rename from 2configs

2 weeks ago

power-action.nix

configs: rename from 2configs

2 weeks ago

rad.nix

configs: rename from 2configs

2 weeks ago

radicale.nix

configs.radicale: add calino web client on calendar.lassul.us

2 weeks ago

radicle.lassul.us.nix

configs: rename from 2configs

2 weeks ago

realwallpaper.nix

modules.realwallpaper: vendor from stockholm Copied from stockholm krebs/3modules/realwallpaper.nix (cc283503); the wallpaper generator comes from stockholm's packages output instead of its overlay.

2 weeks ago

red-host.nix

configs.kartei: drop krebs.users The option only fed lassul.us/ssh.pub, lassul.us/gpg.pub and makefu's key for the download user. ssh.pub now lists every key lass logs in with on neoprism, gpg.pub serves keys/pgp/yubi_pgp.pgp, and makefu's key is read from kartei directly.

2 weeks ago

retiolum.nix

configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover

2 weeks ago

review.nix

configs: rename from 2configs

2 weeks ago

riot.nix

configs.riot: let networkd own the host route to the container

2 weeks ago

rogue-talk.nix

configs: rename from 2configs

2 weeks ago

rtl-sdr.nix

configs: rename from 2configs

2 weeks ago

security-workarounds.nix

configs: rename from 2configs

2 weeks ago

snapclient.nix

configs: rename from 2configs

2 weeks ago

snappymail.nix

configs: rename from 2configs

2 weeks ago

snapserver.nix

configs: rename from 2configs

2 weeks ago

spora.nix

configs: rename from 2configs

2 weeks ago

ssh-redirect.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

steam.nix

configs: rename from 2configs

2 weeks ago

syncthing.nix

configs: rename from 2configs

2 weeks ago

tablet-screen.nix

configs: rename from 2configs

2 weeks ago

themes.nix

configs: rename from 2configs

2 weeks ago

timeful.nix

configs: rename from 2configs

2 weeks ago

tor-ssh.nix

configs: rename from 2configs

2 weeks ago

tpm2.nix

configs: rename from 2configs

2 weeks ago

udisks.nix

configs: rename from 2configs

2 weeks ago

vaultwarden.nix

configs: rename from 2configs

2 weeks ago

weechat.nix

configs: drop stockholm and nix-writers overlays Reference the stockholm packages we still use through stockholm.packages.<system> instead of its overlay.

2 weeks ago

wine.nix

configs: rename from 2configs

2 weeks ago

xdg-open.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

yggdrasil.nix

configs: rename from 2configs

2 weeks ago

yubikey.nix

configs: rename from 2configs

2 weeks ago

zsh.nix

configs: rename from 2configs

2 weeks ago

Configure Feed

Configure Feed