superconfig/machines/ at a047e739ba5a73412c70b4659da969aebfd15536 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines

18 folders

at a047e739ba5a73412c70b4659da969aebfd15536

Hermes machines.neoprism: replace pocket-id with zitadel on id.lassul.us 3d ago

retiolum: drop self.retiolum, acheron and starkstrom are in kartei now kartei carries both cards (krebs/kartei#92), so the superconfig-only host set is empty; read hosts, own addresses and tinc host files from kartei alone.

5 days ago

configs.yellow-mounts: remove

6 days ago

configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover

2 weeks ago

remove the CI farm ci.yml builds the machines with hestia now. Drops farm.yml, tools/ci-farm, neoprism's nix-grpc-daemon builder, barnacle's farm client, the nix-farm vars generators and the nix-grpc-store input. cache.lassul.us/niks3 moves to configs/nix-cache.nix.

3 days ago

machines.coaxmetal: Matrix for voice calls Load the hermes-voice plugin into the gateway (matrix_dm_send, end_call, /assist), and enable the gateway's webhook platform on 127.0.0.1:8644 with a deliver_only route to the Matrix home room, through which hermes-voice asks approvals that no call can hear. The route is signed with WEBHOOK_SECRET, which hermes-env fills with the API server key that hermes-voice already holds: no new secret.

3 days ago

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

1 week ago

machines.green: disable eternal-terminal eternal-terminal 7.0.0 fails to build in the current nixpkgs (cmake_pch.hxx.gch), which failed green's toplevel in the CI farm.

1 week ago

configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover

2 weeks ago

configs.sigexec: remove

5 days ago

configs.yellow-mounts: remove

6 days ago

tools.realwallpaper: rewrite as a live lens-projection world map Replaces pkgs.realwallpaper (xplanet, dead NASA NEO sources) with a Python renderer: oblique cylindrical map centred on home with a zoom lens (or plain/mercator), multi-resolution WMS imagery (Sentinel-2 cloudless, Blue Marble, Black Marble lights), live EUMETSAT clouds with synthesised detail, VIIRS snow/fire/chlorophyll, sea ice and the sky. The krebs.realwallpaper module, its nginx config and the mors fetchWallpaper config are dropped; the tool runs standalone for now.

5 days ago

machines.neoprism: replace pocket-id with zitadel on id.lassul.us Zitadel 2.71 from nixpkgs as a federated IdP with open self-registration: registration, external IdPs and passkeys allowed in the default login policy, first instance "lassul.us" with admin user lass (lass@lassul.us). The masterkey and the admin's initial password come from the zitadel clan vars generator, the password via an extra steps file so it never hits the store. Postgres via peer auth over the local socket. ensureDatabases/ensureUsers create the database and owner role, so the zitadel role gets no CREATEROLE/CREATEDB (on PG15 CREATEROLE is close to superuser). That needs `init zitadel` + start-from-setup instead of the module's start-from-init, whose init always tries CREATE USER/CREATE DATABASE and fails on the permission check before the "already exists" check. nginx terminates TLS and talks h2c to Zitadel via grpc_pass, as Zitadel's reverse-proxy docs require for its gRPC APIs. Machine identification by hostname, since the default private-IP/GCP-webhook probes don't fit neoprism. The database is pg_dumped by the borg preHook; gatus checks /debug/healthz. Zitadel 2.71 does not work with PostgreSQL 18 (migration 34_add_cache_schema creates unlogged partitioned tables), neoprism runs 15.

3 days ago

modules.sync-containers3: move options to lass.sync-containers3

1 week ago

configs.sigexec: remove

5 days ago

configs.sigexec: remove

5 days ago

configs.consul: remove

6 days ago

configs.spora: remove, with mycelium and the spora input

1 week ago

configs.spora: remove, with mycelium and the spora input

1 week ago