superconfig/machines/ at 6f57aa83cceb347625a9773b14ab7b7c835a602d · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines

19 folders

at 6f57aa83cceb347625a9773b14ab7b7c835a602d

lassulus websites.where.is.lassul.us: init 5w ago

remove exim from all machines and clean up references

7 months ago

keys: add termux_massulus ssh key, use alongside yubi_pgp

1 month ago

2configs.rad: shared per-machine radicle identity and node One radicle-node serves one keypair, so each machine that does radicle work gets its own identity (vars generator `rad`) and a node running as the `rad` system user over /var/lib/rad. The profile is group-shared (setgid dirs, umask-002 wrappers for rad/git-remote-rad, pre-created group-writable sqlite files) so any account in group `rad` signs with the machine identity; mainUser is a member. RAD_HOME points there for login shells. Imported explicitly on coaxmetal, neoprism, ignavia, icarus and shodan. Rename the public seed module to 2configs/radicle.lassul.us.nix and switch its retired seed.radicle.garden entry to iris.radicle.network.

1 month ago

machines.daedalus: drop hexchat (removed from nixpkgs)

2 months ago

green: remove mail services (migrated to neoprism)

7 months ago

refactor: move common configuration to 2configs/default.nix - Move clan and stockholm configuration from flake.nix to 2configs/default.nix - Simplify flake.nix machines definition to only import physical.nix - Add explicit import of ../../2configs to each machine's config.nix - This allows for more selective configuration imports per machine

1 year ago

2configs.rad: shared per-machine radicle identity and node One radicle-node serves one keypair, so each machine that does radicle work gets its own identity (vars generator `rad`) and a node running as the `rad` system user over /var/lib/rad. The profile is group-shared (setgid dirs, umask-002 wrappers for rad/git-remote-rad, pre-created group-writable sqlite files) so any account in group `rad` signs with the machine identity; mainUser is a member. RAD_HOME points there for login shells. Imported explicitly on coaxmetal, neoprism, ignavia, icarus and shodan. Rename the public seed module to 2configs/radicle.lassul.us.nix and switch its retired seed.radicle.garden entry to iris.radicle.network.

1 month ago

2configs.rad: shared per-machine radicle identity and node One radicle-node serves one keypair, so each machine that does radicle work gets its own identity (vars generator `rad`) and a node running as the `rad` system user over /var/lib/rad. The profile is group-shared (setgid dirs, umask-002 wrappers for rad/git-remote-rad, pre-created group-writable sqlite files) so any account in group `rad` signs with the machine identity; mainUser is a member. RAD_HOME points there for login shells. Imported explicitly on coaxmetal, neoprism, ignavia, icarus and shodan. Rename the public seed module to 2configs/radicle.lassul.us.nix and switch its retired seed.radicle.garden entry to iris.radicle.network.

1 month ago

remove exim from all machines and clean up references

7 months ago

websites.where.is.lassul.us: init location of person.lass from home-assistant on an OSM map with a 24h trail; neoprism polls the hass history API every 2 min into a static json, token via clan vars (where-lassul-us/token)

1 month ago

orange: drop cgit/git service orange's autoswitch was failing activation: the git service's mkdir /var/lib/git hit a symlink loop (a stale dangling `state/git -> ../../var/state/git` link that loops because the container bind-mounts both /var/lib and /var/state to the same state dir). cgit is being retired, so remove the services/git import entirely. This also unblocks orange's autoswitch (it no longer touches /var/lib/git). Assisted-by: Claude Code (claude-opus-4-8[1m])

4 months ago

machines.{prism,neoprism}: migrate mastodon-proxy prism is decommissioned, so social.krebsco.de had no working entry point while the hotdog container itself kept serving fine on neoprism. DNS for social.krebsco.de still needs to be repointed to neoprism before ACME can issue a cert.

2 months ago

*: migrate facts to vars

10 months ago

2configs.rad: shared per-machine radicle identity and node One radicle-node serves one keypair, so each machine that does radicle work gets its own identity (vars generator `rad`) and a node running as the `rad` system user over /var/lib/rad. The profile is group-shared (setgid dirs, umask-002 wrappers for rad/git-remote-rad, pre-created group-writable sqlite files) so any account in group `rad` signs with the machine identity; mainUser is a member. RAD_HOME points there for login shells. Imported explicitly on coaxmetal, neoprism, ignavia, icarus and shodan. Rename the public seed module to 2configs/radicle.lassul.us.nix and switch its retired seed.radicle.garden entry to iris.radicle.network.

1 month ago

machines.starkstrom: announce pins to IPNI so public gateways can serve them Measured with ipfs-check against a pinned CID: DHT record present, bitswap answering, no IPNI record, and every public gateway 504ing on anything bigger than one block -- a DAG walked block by block over bitswap from a single peer does not fit their request budget. The old node (2configs/services/flix/ipfs.nix) ran Routing.Type autoclient, which announces to cid.contact as well as the DHT, plus Provide strategy pinned; mirror that and its swarm sizing.

1 month ago

2configs/services/invidious: remove (playback unreliable) Livestreams never played and VOD depends on companion keeping up with YouTube's po_token and SABR changes, which it does not reliably enough to be worth the moving parts. Takes the residential exits with it: tinyproxy on styx and coaxmetal existed only so neoprism could reach YouTube from a non-Hetzner address. Leaves the generated companion key in vars/pass, matching how the silverbullet and oauth2-proxy removals were handled.

2 months ago

fix extra-container eval: add dummy nixos-init option extra-container uses a minimal NixOS module set for fast evaluation. nixpkgs unstable added nixos-init.nix and systemd.nix now references config.system.nixos-init.package, but extra-container's module set doesn't include it. Add a dummy nixos-init.package option to the outer container config, matching extra-container's existing pattern for missing options. Also fixes services.mingetty -> services.getty rename in virtulus.

8 months ago

radicle: run a public allow-all seed on neoprism (radicle.lassul.us, 80G quota) Extend 2configs/radicle.nix into a public seed: allow-all seeding (scope=all), listen 0.0.0.0:8776 + externalAddresses radicle.lassul.us:8776, radicle-httpd behind an nginx vhost (radicle.lassul.us, ACME). Drop the tor proxy + onion preferred seeds. Move the config off xerxes onto neoprism, and put the node state on tank at /var/lib/radicle with an 80G ZFS quota (radicle has no built-in byte quota; the dataset bounds it).

2 months ago

yellow: resolve AirVPN endpoint in main netns for transmission tunnel Recent wireguard-tools resolve the peer Endpoint in the namespace where `wg syncconf` runs. The transmission netns has no route until the tunnel is up, so resolving europe.vpn.airdns.org from inside it always fails; wg burns ~70s of DNS-retry backoff per attempt before erroring. During a nixos switch that restarts transmission-netns this stalled the whole deploy for >2min and left the service (and the download stack) failed. Resolve the endpoint in the main netns (which has connectivity, and is already gated on the `host` check above) and hand wg a numeric Endpoint, so the tunnel comes up instantly. Also fix the bare `sleep` in the DNS wait loop, which errored under `set -e` instead of retrying. Assisted-by: Claude Code (claude-opus-4-8)

4 months ago