superconfig/configs/ at 60595d50ef0730dbe641715656ecc1e24c784211 · lass.pds.lassul.us/superconfig

boot

configs: rename from 2configs

2 weeks ago

desktops

machines.icarus: switch from xmonad to sway

2 weeks ago

dns

configs.services.paint: add WBO whiteboard at paint.lassul.us

6 days ago

gg23

retiolum: drop self.retiolum, acheron and starkstrom are in kartei now kartei carries both cards (krebs/kartei#92), so the superconfig-only host set is empty; read hosts, own addresses and tinc host files from kartei alone.

5 days ago

hass

configs.hass: remove ollama

1 week ago

hw

configs: remove dead modules

2 weeks ago

iroh-relay

configs: rename from 2configs

2 weeks ago

monitoring

configs.monitoring: export the superconfig revision each machine runs autoUpgrade pins the upgrade to the revision the forward-only guard resolved and writes it to /var/lib/superconfig-revision after a successful upgrade, like deploy does. Vector reads that file every 30s and exports nixos_system_info{host,revision,revision_short}; the node dashboard shows host -> revision_short.

5 days ago

nix-farm

configs.nix-farm: never mark B2 down in cache.lassul.us upstream

5 days ago

orca

machines.xerxes: remove

1 week ago

paste

configs.paste: serve paste, imgur and cyberlocker through fcgiwrap One python CGI (configs/paste/paste.py) replaces the htgen-paste, htgen-imgur and htgen-cyberlocker handlers and the paste-form script. Items keep their names and directories, so old links and the backups stay as they are; systemd hands the directories to the new paste user. The upload form now stores directly instead of posting back to p.krebsco.de.

1 week ago

ppp

configs: rename from 2configs

2 weeks ago

printing

configs: rename from 2configs

2 weeks ago

services

configs.services.paint: add WBO whiteboard at paint.lassul.us

6 days ago

sigexec

retiolum: drop self.retiolum, acheron and starkstrom are in kartei now kartei carries both cards (krebs/kartei#92), so the superconfig-only host set is empty; read hosts, own addresses and tinc host files from kartei alone.

5 days ago

websites

neoprism: serve wallpaper.lassul.us with realwallpaper-server

6 days ago

ableton.nix

configs: rename from 2configs

2 weeks ago

alacritty.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

android-webcam.nix

configs: rename from 2configs

2 weeks ago

atuin-server.nix

configs: rename from 2configs

2 weeks ago

auto-timezone.nix

configs: rename from 2configs

2 weeks ago

autotether.nix

configs: rename from 2configs

2 weeks ago

autoupdate.nix

configs.monitoring: export the superconfig revision each machine runs autoUpgrade pins the upgrade to the revision the forward-only guard resolved and writes it to /var/lib/superconfig-revision after a successful upgrade, like deploy does. Vector reads that file every 30s and exports nixos_system_info{host,revision,revision_short}; the node dashboard shows host -> revision_short.

5 days ago

book.nix

tools.book: apply calendar edits to bookings

1 week ago

br.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

browsers.nix

configs: rename from 2configs

2 weeks ago

c-base-ai-tunnel.nix

configs: rename from 2configs

2 weeks ago

cast.nix

configs: rename from 2configs

2 weeks ago

container-bridge.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

container-tests.nix

configs: rename from 2configs

2 weeks ago

crit-proxy.nix

configs.crit: public https://<id>.review.lassul.us per review The crit wrapper writes a fresh random 10-char id per daemon port into /var/lib/crit-routes; a path unit turns that into an nginx map on coaxmetal:7720 (retiolum only). neoprism proxies *.review.lassul.us there with a wildcard cert obtained via DNS-01 (RFC2136) against a delegated _acme-challenge.review.lassul.us zone on knot, so ids never hit CT logs.

1 week ago

crit.nix

configs.crit: register routes over a unix socket hermes-agent runs with ProtectSystem=strict and cannot write the group-writable routes dir. crit now asks crit-routes.socket (group crit) for a route; a root service picks the id, writes the route, regenerates the nginx map and reloads nginx.

1 week ago

default.nix

configs.monitoring: vector agents, victoria* + alertmanager stack on styx/coaxmetal Every NixOS machine runs Vector (host metrics, internal metrics, journal) and writes to VictoriaMetrics/VictoriaLogs on both styx and coaxmetal, each sink with a 512 MiB disk buffer. Both servers run vmalert (metrics and LogsQL instances), a two-node Alertmanager cluster posting to Matrix via matrix-alertmanager-receiver, Gatus (results scraped into VictoriaMetrics, alerted on by vmalert) and Grafana with provisioned datasources and dashboards. All ports are open on retiolum only. Replaces telegraf on neoprism, including the borgbackup status file.

6 days ago

docuseal.nix

configs: rename from 2configs

2 weeks ago

download-user.nix

machines.xerxes: remove

1 week ago

et-server.nix

configs: rename from 2configs

2 weeks ago

fonts.nix

configs: rename from 2configs

2 weeks ago

games.nix

configs: rename from 2configs

2 weeks ago

gc.nix

machines.xerxes: remove

1 week ago

gg23.nix

configs.spora: remove, with mycelium and the spora input

1 week ago

green-host.nix

modules.sync-containers3: move options to lass.sync-containers3

2 weeks ago

gsm-wiki.nix

configs: rename from 2configs

2 weeks ago

hermes-mail-vars.nix

configs.mailserver: add hermes@lassul.us mailbox for coaxmetal hermes

1 week ago

hermes-proxy.nix

configs: remove omnigent, covibe and herdr from all machines

1 week ago

hotdog-host.nix

modules.sync-containers3: move options to lass.sync-containers3

2 weeks ago

htop.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

ipfs.nix

configs: rename from 2configs

2 weeks ago

kartei.nix

retiolum: drop self.retiolum, acheron and starkstrom are in kartei now kartei carries both cards (krebs/kartei#92), so the superconfig-only host set is empty; read hosts, own addresses and tinc host files from kartei alone.

5 days ago

kitty.nix

configs: rename from 2configs

2 weeks ago

mail.nix

configs: rename from 2configs

2 weeks ago

mailserver.nix

configs.mailserver: add hermes@lassul.us mailbox for coaxmetal hermes

1 week ago

mc.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

mouse.nix

configs: rename from 2configs

2 weeks ago

mumble-reminder.nix

Merge pull request #14 from riotbib/fix-mumblereminder-goldwaldsaenger

1 week ago

n2n-supernode.nix

configs: rename from 2configs

2 weeks ago

n8n.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

network-manager.nix

configs: rename from 2configs

2 weeks ago

networkd.nix

configs: rename from 2configs

2 weeks ago

nginx.nix

configs: rename from 2configs

2 weeks ago

nix.nix

configs: rename from 2configs

2 weeks ago

nixpkgs-triage.nix

configs: rename from 2configs

2 weeks ago

orange-host.nix

modules.sync-containers3: move options to lass.sync-containers3

2 weeks ago

pair-programming.nix

configs: allocate uids dynamically, drop stockholm.lib pairprogramming, radio, realwallpaper and the htgen users no longer get their ids from stockholm's genid. NixOS keeps the ids existing users already have in /etc/passwd and /etc/group, so nothing changes on deployed machines; fresh installs allocate them. The copied htgen, reaktor2 and realwallpaper modules use nixpkgs option types instead of stockholm's, htgen's user is a small name/home submodule (home still defaults to /home/<name>), and reaktor2 carries its own stripAttr.

2 weeks ago

parley.nix

configs: rename from 2configs

2 weeks ago

pass.nix

configs: rename from 2configs

2 weeks ago

phonetpm-ssh.nix

configs.phonetpm-ssh: init, use on ignavia, icarus and shodan

1 week ago

phonetpm.nix

configs.phonetpm-ssh: init, use on ignavia, icarus and shodan

1 week ago

pinned-registry.nix

configs: rename from 2configs

2 weeks ago

pipewire.nix

configs: remove omnigent, covibe and herdr from all machines

1 week ago

pocket-id.nix

configs: rename from 2configs

2 weeks ago

power-action.nix

configs: rename from 2configs

2 weeks ago

rad.nix

configs: rename from 2configs

2 weeks ago

radicale-user-generator.nix

configs.radicale: one shared calendar for lass, book and hermes

1 week ago

radicale.nix

configs.radicale: one shared calendar for lass, book and hermes

1 week ago

radicle.lassul.us.nix

configs: rename from 2configs

2 weeks ago

retiolum.nix

configs.retiolum: drop ni from ConnectTo

5 days ago

review.nix

configs: rename from 2configs

2 weeks ago

riot.nix

configs.riot: let networkd own the host route to the container

2 weeks ago

rtl-sdr.nix

configs: rename from 2configs

2 weeks ago

security-workarounds.nix

configs: rename from 2configs

2 weeks ago

snapclient.nix

configs.snapserver: move from styx to acheron

1 week ago

snappymail.nix

configs: rename from 2configs

2 weeks ago

snapserver.nix

configs.snapserver: move from styx to acheron

1 week ago

ssh-redirect.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

steam.nix

configs: rename from 2configs

2 weeks ago

syncthing.nix

configs: remove weechat

2 weeks ago

tablet-screen.nix

configs: rename from 2configs

2 weeks ago

themes.nix

configs: rename from 2configs

2 weeks ago

timeful.nix

configs: rename from 2configs

2 weeks ago

tor-ssh.nix

configs: rename from 2configs

2 weeks ago

tpm2.nix

configs: rename from 2configs

2 weeks ago

udisks.nix

configs: rename from 2configs

2 weeks ago

vaultwarden.nix

configs: rename from 2configs

2 weeks ago

wine.nix

configs: rename from 2configs

2 weeks ago

xdg-open.nix

machines.mors: remove transgui

1 week ago

yggdrasil.nix

configs: rename from 2configs

2 weeks ago

yubikey.nix

configs: rename from 2configs

2 weeks ago

zsh.nix

configs: rename from 2configs

2 weeks ago

Configure Feed

Configure Feed