superconfig/machines/ at 5d83889b04e96dadb0de94a9a4abfa341b4f5be1 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines

18 folders

at 5d83889b04e96dadb0de94a9a4abfa341b4f5be1

lassulus machines.coaxmetal.hermes: hermes-notify through the gateway webhook, regenerate hermes-env on script changes 2d ago

retiolum: drop self.retiolum, acheron and starkstrom are in kartei now kartei carries both cards (krebs/kartei#92), so the superconfig-only host set is empty; read hosts, own addresses and tinc host files from kartei alone.

5 days ago

configs.yellow-mounts: remove

6 days ago

configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover

1 week ago

remove the CI farm ci.yml builds the machines with hestia now. Drops farm.yml, tools/ci-farm, neoprism's nix-grpc-daemon builder, barnacle's farm client, the nix-farm vars generators and the nix-grpc-store input. cache.lassul.us/niks3 moves to configs/nix-cache.nix.

3 days ago

machines.coaxmetal.hermes: hermes-notify through the gateway webhook, regenerate hermes-env on script changes

2 days ago

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

1 week ago

machines.green: disable eternal-terminal eternal-terminal 7.0.0 fails to build in the current nixpkgs (cmake_pch.hxx.gch), which failed green's toplevel in the CI farm.

1 week ago

configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover

1 week ago

configs.sigexec: remove

5 days ago

configs.yellow-mounts: remove

6 days ago

tools.realwallpaper: rewrite as a live lens-projection world map Replaces pkgs.realwallpaper (xplanet, dead NASA NEO sources) with a Python renderer: oblique cylindrical map centred on home with a zoom lens (or plain/mercator), multi-resolution WMS imagery (Sentinel-2 cloudless, Blue Marble, Black Marble lights), live EUMETSAT clouds with synthesised detail, VIIRS snow/fire/chlorophyll, sea ice and the sky. The krebs.realwallpaper module, its nginx config and the mors fetchWallpaper config are dropped; the tool runs standalone for now.

5 days ago

configs.byoidc: init on neoprism (byoidc.lassul.us) byoidc lets people sign in with their own OpenID provider; Zitadel will offer it as one generic OIDC IdP. The downstream client "zitadel" gets its secret from a prompt-less clan var, which root-owned is fine for both byoidc (LoadCredential) and zitadel-reconcile (root). Its state (cached upstream clients, signing key) is not backed up: subjects are derived from issuer and upstream sub, a new signing key is picked up through JWKS, and upstream clients are registered again on demand.

2 days ago

modules.sync-containers3: move options to lass.sync-containers3

1 week ago

configs.sigexec: remove

5 days ago

configs.sigexec: remove

5 days ago

configs.consul: remove

6 days ago

configs.spora: remove, with mycelium and the spora input

6 days ago

configs.spora: remove, with mycelium and the spora input

6 days ago