superconfig/machines/ at a0b044e4fcd30fbd0b00aae05bcd896e3577d45b · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines

20 folders

at a0b044e4fcd30fbd0b00aae05bcd896e3577d45b

lassulus neoprism: host nixpkgs-triage dashboard on review.lassul.us 18d ago

machines/acheron: add gg23 router replacing styx Intel N355 mini PC, 2x I226-V, UEFI/NVMe disko, systemd-boot. Only 2configs + retiolum + gg23 for now; NIC naming matches styx (et0 uplink, int0 LAN). Retiolum card in retiolum/ (10.243.11.2), server tag.

1 month ago

remove exim from all machines and clean up references

7 months ago

machines.atlas: fetch nix store over http in netboot stage 1

1 month ago

radicle: secureify radicle-node, marked insecure in nixpkgs

3 weeks ago

machines/coaxmetal: hermes voice loop, herdr bridge, api server Voice both ways over Matrix: local faster-whisper (the "voice" dep group) transcribes Element voice notes, and replies are spoken by a piper command provider against a pinned en_US-lessac-medium voice. The built-in piper and edge backends cannot work here, they lazily pip-install into a read-only sealed venv. stt.prompt biases the jargon: without it "herdr" transcribes as "Herter". herdr runs as lass and keeps its socket under lass's HOME, so the agent reaches the herd through a sudo wrapper plus a SKILL.md that documents it. That needs NoNewPrivileges off, sudo is setuid. The OpenAI-compatible API server is the assistant-button lane for the WakeHermesClaw app, bound to the retiolum address resolved at start.

1 month ago

machines.daedalus: drop hexchat (removed from nixpkgs)

2 months ago

green: remove mail services (migrated to neoprism)

7 months ago

refactor: move common configuration to 2configs/default.nix - Move clan and stockholm configuration from flake.nix to 2configs/default.nix - Simplify flake.nix machines definition to only import physical.nix - Add explicit import of ../../2configs to each machine's config.nix - This allows for more selective configuration imports per machine

1 year ago

2configs.rad: shared per-machine radicle identity and node One radicle-node serves one keypair, so each machine that does radicle work gets its own identity (vars generator `rad`) and a node running as the `rad` system user over /var/lib/rad. The profile is group-shared (setgid dirs, umask-002 wrappers for rad/git-remote-rad, pre-created group-writable sqlite files) so any account in group `rad` signs with the machine identity; mainUser is a member. RAD_HOME points there for login shells. Imported explicitly on coaxmetal, neoprism, ignavia, icarus and shodan. Rename the public seed module to 2configs/radicle.lassul.us.nix and switch its retired seed.radicle.garden entry to iris.radicle.network.

1 month ago

machines.ignavia: remove tmate

3 weeks ago

machines.mors: drop adb-sync Removed from nixpkgs in favour of better-adb-sync, which broke evaluation of this host. Dropped rather than swapped -- nothing here used it.

1 month ago

neoprism: host nixpkgs-triage dashboard on review.lassul.us

2 weeks ago

orange: drop cgit/git service orange's autoswitch was failing activation: the git service's mkdir /var/lib/git hit a symlink loop (a stale dangling `state/git -> ../../var/state/git` link that loops because the container bind-mounts both /var/lib and /var/state to the same state dir). cgit is being retired, so remove the services/git import entirely. This also unblocks orange's autoswitch (it no longer touches /var/lib/git). Assisted-by: Claude Code (claude-opus-4-8[1m])

4 months ago

*: migrate facts to vars

10 months ago

2configs.rad: shared per-machine radicle identity and node One radicle-node serves one keypair, so each machine that does radicle work gets its own identity (vars generator `rad`) and a node running as the `rad` system user over /var/lib/rad. The profile is group-shared (setgid dirs, umask-002 wrappers for rad/git-remote-rad, pre-created group-writable sqlite files) so any account in group `rad` signs with the machine identity; mainUser is a member. RAD_HOME points there for login shells. Imported explicitly on coaxmetal, neoprism, ignavia, icarus and shodan. Rename the public seed module to 2configs/radicle.lassul.us.nix and switch its retired seed.radicle.garden entry to iris.radicle.network.

1 month ago

retiolum: keep non-kartei peers in self.retiolum starkstrom stays out of the shared kartei registry but should still be reachable inside the fleet. Its card now lives in retiolum/ in the same nets.<net> layout kartei and krebs.hosts use, rendered by a copy of kartei modules/retiolum/hosts.nix, so the entry can move to kartei/lass unchanged if the rest of krebs should reach it too. Every superconfig machine injects that set into its tinc hosts: the NixOS nodes through nixpkgs services.tinc, barnacle through kartei tincr module (hosts is attrsOf lines, so the entries merge). Previously only starkstrom itself knew its card, so the fleet had no route to it; now all 16 machines do, and peers dial its static address directly instead of relaying. self.retiolum exposes hosts/tincHosts/own, the same interface as kartei, so both sources merge symmetrically. starkstrom krebs.hosts card is composed from it -- addresses, aliases and the ed25519 key have one source now; only the legacy RSA pubkey stockholm insists on stays local.

1 month ago

machines/styx: hand gg23 routing over to acheron styx keeps hass/snapserver/mycelium as a plain LAN client on et0 with a static lease (10.42.0.3) from acheron; 10.42.0.1 now means the router. Repoint snapclient, mycelium peers, zigbee2mqtt broker, ignavia's tinc Address and the gg23 extraHosts accordingly.

1 month ago

fix extra-container eval: add dummy nixos-init option extra-container uses a minimal NixOS module set for fast evaluation. nixpkgs unstable added nixos-init.nix and systemd.nix now references config.system.nixos-init.package, but extra-container's module set doesn't include it. Add a dummy nixos-init.package option to the outer container config, matching extra-container's existing pattern for missing options. Also fixes services.mingetty -> services.getty rename in virtulus.

8 months ago

radicle: secureify radicle-node, marked insecure in nixpkgs

3 weeks ago

yellow: resolve AirVPN endpoint in main netns for transmission tunnel Recent wireguard-tools resolve the peer Endpoint in the namespace where `wg syncconf` runs. The transmission netns has no route until the tunnel is up, so resolving europe.vpn.airdns.org from inside it always fails; wg burns ~70s of DNS-retry backoff per attempt before erroring. During a nixos switch that restarts transmission-netns this stalled the whole deploy for >2min and left the service (and the download stack) failed. Resolve the endpoint in the main netns (which has connectivity, and is already gated on the `host` check above) and hand wg a numeric Endpoint, so the tunnel comes up instantly. Also fix the bare `sleep` in the DNS wait loop, which errored under `set -e` instead of retrying. Assisted-by: Claude Code (claude-opus-4-8)

4 months ago