superconfig/machines/ at a92df57f5972748a7ede216ae88ba8f2083d6f74 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines

19 folders

at a92df57f5972748a7ede216ae88ba8f2083d6f74

lassulus machines/starkstrom: IPFS pinning endpoint (starkstrom.lassul.us) 7w ago

remove exim from all machines and clean up references

7 months ago

machines.ignavia: add TPM-backed SSH key

1 month ago

2configs/services/invidious: remove (playback unreliable) Livestreams never played and VOD depends on companion keeping up with YouTube's po_token and SABR changes, which it does not reliably enough to be worth the moving parts. Takes the residential exits with it: tinyproxy on styx and coaxmetal existed only so neoprism could reach YouTube from a non-Hetzner address. Leaves the generated companion key in vars/pass, matching how the silverbullet and oauth2-proxy removals were handled.

2 months ago

machines.daedalus: drop hexchat (removed from nixpkgs)

2 months ago

green: remove mail services (migrated to neoprism)

7 months ago

refactor: move common configuration to 2configs/default.nix - Move clan and stockholm configuration from flake.nix to 2configs/default.nix - Simplify flake.nix machines definition to only import physical.nix - Add explicit import of ../../2configs to each machine's config.nix - This allows for more selective configuration imports per machine

1 year ago

remove exim from all machines and clean up references

7 months ago

machines.ignavia: add TPM-backed SSH key

1 month ago

remove exim from all machines and clean up references

7 months ago

2configs/omnigent: serve omni.lassul.us with pocket-id login

2 months ago

orange: drop cgit/git service orange's autoswitch was failing activation: the git service's mkdir /var/lib/git hit a symlink loop (a stale dangling `state/git -> ../../var/state/git` link that loops because the container bind-mounts both /var/lib and /var/state to the same state dir). cgit is being retired, so remove the services/git import entirely. This also unblocks orange's autoswitch (it no longer touches /var/lib/git). Assisted-by: Claude Code (claude-opus-4-8[1m])

4 months ago

machines.{prism,neoprism}: migrate mastodon-proxy prism is decommissioned, so social.krebsco.de had no working entry point while the hotdog container itself kept serving fine on neoprism. DNS for social.krebsco.de still needs to be repointed to neoprism before ACME can issue a cert.

2 months ago

*: migrate facts to vars

10 months ago

machines.shodan: disable hdapsd for now

9 months ago

machines/starkstrom: IPFS pinning endpoint (starkstrom.lassul.us) kubo node (swarm :4001, gateway NoFetch) + anonymous tarball -> ipfs add (blockstore, no --nocopy) -> pinned -> returns CID; refuses uploads with <300GiB free; explicit ipfs-gc + ipfs-roots (pins are the stored GC roots). dns: ipfs -> CNAME neoprism, starkstrom -> A 194.110.87.67.

1 month ago

2configs/services/invidious: remove (playback unreliable) Livestreams never played and VOD depends on companion keeping up with YouTube's po_token and SABR changes, which it does not reliably enough to be worth the moving parts. Takes the residential exits with it: tinyproxy on styx and coaxmetal existed only so neoprism could reach YouTube from a non-Hetzner address. Leaves the generated companion key in vars/pass, matching how the silverbullet and oauth2-proxy removals were handled.

2 months ago

fix extra-container eval: add dummy nixos-init option extra-container uses a minimal NixOS module set for fast evaluation. nixpkgs unstable added nixos-init.nix and systemd.nix now references config.system.nixos-init.package, but extra-container's module set doesn't include it. Add a dummy nixos-init.package option to the outer container config, matching extra-container's existing pattern for missing options. Also fixes services.mingetty -> services.getty rename in virtulus.

8 months ago

radicle: run a public allow-all seed on neoprism (radicle.lassul.us, 80G quota) Extend 2configs/radicle.nix into a public seed: allow-all seeding (scope=all), listen 0.0.0.0:8776 + externalAddresses radicle.lassul.us:8776, radicle-httpd behind an nginx vhost (radicle.lassul.us, ACME). Drop the tor proxy + onion preferred seeds. Move the config off xerxes onto neoprism, and put the node state on tank at /var/lib/radicle with an 80G ZFS quota (radicle has no built-in byte quota; the dataset bounds it).

2 months ago

yellow: resolve AirVPN endpoint in main netns for transmission tunnel Recent wireguard-tools resolve the peer Endpoint in the namespace where `wg syncconf` runs. The transmission netns has no route until the tunnel is up, so resolving europe.vpn.airdns.org from inside it always fails; wg burns ~70s of DNS-retry backoff per attempt before erroring. During a nixos switch that restarts transmission-netns this stalled the whole deploy for >2min and left the service (and the download stack) failed. Resolve the endpoint in the main netns (which has connectivity, and is already gated on the `host` check above) and hand wg a numeric Endpoint, so the tunnel comes up instantly. Also fix the bare `sleep` in the DNS wait loop, which errored under `set -e` instead of retrying. Assisted-by: Claude Code (claude-opus-4-8)

4 months ago