superconfig/configs/ at b7c8938ef619412d61fd5348b406d4e7980538be · lass.pds.lassul.us/superconfig

boot

configs: rename from 2configs

2 weeks ago

desktops

machines.icarus: switch from xmonad to sway

2 weeks ago

dns

configs.hermes-proxy: serve hermes-voice on voice.lassul.us

1 week ago

hass

configs.hass: remove ollama

1 week ago

hw

configs: remove dead modules

2 weeks ago

iroh-relay

configs: rename from 2configs

2 weeks ago

monitoring

configs: remove dead modules

2 weeks ago

nix-farm

configs.nix-farm: don't push paths cache.nixos.org serves Builders pushed every path of a closure, including everything they had substituted from cache.nixos.org: 9.9 of 10.3 GiB for ignavia. niks3 now comes from a fork (lassulus/niks3) with `push --ignore-upstream-key`, and neoprism's daemon and the CI farm pass cache.nixos.org-1 to it. cache.lassul.us no longer holds complete closures on its own: clients need cache.nixos.org next to it, which every machine has.

1 week ago

orca

keys.ssh: init phonetpm_massulus, authorize alongside ignavia

1 week ago

paste

configs.paste: serve paste, imgur and cyberlocker through fcgiwrap One python CGI (configs/paste/paste.py) replaces the htgen-paste, htgen-imgur and htgen-cyberlocker handlers and the paste-form script. Items keep their names and directories, so old links and the backups stay as they are; systemd hands the directories to the new paste user. The upload form now stores directly instead of posting back to p.krebsco.de.

2 weeks ago

ppp

configs: rename from 2configs

2 weeks ago

printing

configs: rename from 2configs

2 weeks ago

services

configs.services.pad: upload any file to p.krebsco.de, drop external link warning

1 week ago

sigexec

configs: rename from 2configs

2 weeks ago

websites

configs.hass: move home-assistant, mosquitto and zigbee2mqtt from styx to acheron

1 week ago

yellow-mounts

configs: rename from 2configs

2 weeks ago

ableton.nix

configs: rename from 2configs

2 weeks ago

alacritty.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

android-webcam.nix

configs: rename from 2configs

2 weeks ago

atuin-server.nix

configs: rename from 2configs

2 weeks ago

auto-timezone.nix

configs: rename from 2configs

2 weeks ago

autotether.nix

configs: rename from 2configs

2 weeks ago

autoupdate.nix

configs: rename from 2configs

2 weeks ago

book.nix

tools.book: apply calendar edits to bookings

1 week ago

br.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

browsers.nix

configs: rename from 2configs

2 weeks ago

c-base-ai-tunnel.nix

configs: rename from 2configs

2 weeks ago

cast.nix

configs: rename from 2configs

2 weeks ago

consul.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

container-bridge.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

container-tests.nix

configs: rename from 2configs

2 weeks ago

covibe.nix

configs: rename from 2configs

2 weeks ago

crit.nix

machines.coaxmetal: add crit review daemons reachable over retiolum

1 week ago

default.nix

configs.nix-farm: add nix-grpc-store farm and niks3 cache on neoprism Single node: nix-grpc-daemon (builder+scheduler, mTLS, retiolum only) publishing to niks3 (local postgres, Backblaze B2), cache.lassul.us proxying the public bucket. barnacle gets the grpc:// plugin and the shared client cert; all NixOS machines substitute from the cache once the signing key exists. The shared nix-farm-ca generator deploys nothing: clan requires a shared generator to be defined identically on every machine, so per-machine generators copy out what each needs with their own owner/mode (nix-farm-server: server cert + ca.crt; nix-farm-client: ca.crt + client cert/key). The daemon reads its TLS files via LoadCredential: gRPC's cert file watcher treats mtime 0 as a stat failure, and clan unpacks /run/secrets with mtime 0, so pointing it at /run/secrets resets every handshake. MemoryMax is raised from upstream's 2G to 8G: `niks3 push` runs in the daemon's cgroup and got OOM-killed on large NARs (kernel modules), taking the daemon down with it.

1 week ago

docuseal.nix

configs: rename from 2configs

2 weeks ago

download-user.nix

keys.ssh: init phonetpm_massulus, authorize alongside ignavia

1 week ago

et-server.nix

configs: rename from 2configs

2 weeks ago

fetchWallpaper.nix

configs: rename from 2configs

2 weeks ago

fonts.nix

configs: rename from 2configs

2 weeks ago

games.nix

configs: rename from 2configs

2 weeks ago

gc.nix

configs.kartei: replace krebs.hosts with kartei directly Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts, and drop krebs.build.host everywhere: readers now use kartei.hosts or networking.hostName, which comes from the clan machine name. - remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users locally - drop the acheron/starkstrom krebs.hosts cards; both now appear in every machine's /etc/hosts - neoprism: stop serving /hosts and /retiolum.hosts - ignavia: move the styx tinc Address override onto the kartei-built host file; the krebs.hosts one had no effect since the kartei cutover

2 weeks ago

gg23.nix

configs.snapserver: move from styx to acheron

1 week ago

green-host.nix

modules.sync-containers3: move options to lass.sync-containers3

2 weeks ago

gsm-wiki.nix

configs: rename from 2configs

2 weeks ago

herdr.nix

configs: rename from 2configs

2 weeks ago

hermes-mail-vars.nix

configs.mailserver: add hermes@lassul.us mailbox for coaxmetal hermes

1 week ago

hermes-proxy.nix

configs.hermes-proxy: serve hermes-voice on voice.lassul.us

1 week ago

hotdog-host.nix

modules.sync-containers3: move options to lass.sync-containers3

2 weeks ago

htop.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

ipfs.nix

configs: rename from 2configs

2 weeks ago

kartei.nix

configs.kartei: drop krebs.users The option only fed lassul.us/ssh.pub, lassul.us/gpg.pub and makefu's key for the download user. ssh.pub now lists every key lass logs in with on neoprism, gpg.pub serves keys/pgp/yubi_pgp.pgp, and makefu's key is read from kartei directly.

2 weeks ago

kitty.nix

configs: rename from 2configs

2 weeks ago

mail.nix

configs: rename from 2configs

2 weeks ago

mailserver.nix

configs.mailserver: add hermes@lassul.us mailbox for coaxmetal hermes

1 week ago

mc.nix

configs: use pkgs.writers instead of nix-writers nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash, writeDashBin, writeBashBin and write (now linkFarm).

2 weeks ago

mouse.nix

configs: rename from 2configs

2 weeks ago

mumble-reminder.nix

Merge pull request #14 from riotbib/fix-mumblereminder-goldwaldsaenger

2 weeks ago

n2n-supernode.nix

configs: rename from 2configs

2 weeks ago

n8n.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

network-manager.nix

configs: rename from 2configs

2 weeks ago

networkd.nix

configs: rename from 2configs

2 weeks ago

nginx.nix

configs: rename from 2configs

2 weeks ago

nix.nix

configs: rename from 2configs

2 weeks ago

nixpkgs-triage.nix

configs: rename from 2configs

2 weeks ago

omnigent.nix

configs: rename from 2configs

2 weeks ago

opencrow.nix

keys.ssh: init phonetpm_massulus, authorize alongside ignavia

1 week ago

orange-host.nix

modules.sync-containers3: move options to lass.sync-containers3

2 weeks ago

pair-programming.nix

configs: allocate uids dynamically, drop stockholm.lib pairprogramming, radio, realwallpaper and the htgen users no longer get their ids from stockholm's genid. NixOS keeps the ids existing users already have in /etc/passwd and /etc/group, so nothing changes on deployed machines; fresh installs allocate them. The copied htgen, reaktor2 and realwallpaper modules use nixpkgs option types instead of stockholm's, htgen's user is a small name/home submodule (home still defaults to /home/<name>), and reaktor2 carries its own stripAttr.

2 weeks ago

parley.nix

configs: rename from 2configs

2 weeks ago

pass.nix

configs: rename from 2configs

2 weeks ago

phonetpm-ssh.nix

configs.phonetpm-ssh: init, use on ignavia, icarus and shodan

1 week ago

phonetpm.nix

configs.phonetpm-ssh: init, use on ignavia, icarus and shodan

1 week ago

pinned-registry.nix

configs: rename from 2configs

2 weeks ago

pipewire.nix

configs: rename from 2configs

2 weeks ago

pocket-id.nix

configs: rename from 2configs

2 weeks ago

power-action.nix

configs: rename from 2configs

2 weeks ago

rad.nix

configs: rename from 2configs

2 weeks ago

radicale-user-generator.nix

configs.radicale: one shared calendar for lass, book and hermes

1 week ago

radicale.nix

configs.radicale: one shared calendar for lass, book and hermes

1 week ago

radicle.lassul.us.nix

configs: rename from 2configs

2 weeks ago

realwallpaper.nix

modules.realwallpaper: vendor from stockholm Copied from stockholm krebs/3modules/realwallpaper.nix (cc283503); the wallpaper generator comes from stockholm's packages output instead of its overlay.

2 weeks ago

retiolum.nix

configs.retiolum: restart tinc on switch instead of stopping it up front

1 week ago

review.nix

configs: rename from 2configs

2 weeks ago

riot.nix

configs.riot: let networkd own the host route to the container

2 weeks ago

rogue-talk.nix

configs: rename from 2configs

2 weeks ago

rtl-sdr.nix

configs: rename from 2configs

2 weeks ago

security-workarounds.nix

configs: rename from 2configs

2 weeks ago

snapclient.nix

configs.snapserver: move from styx to acheron

1 week ago

snappymail.nix

configs: rename from 2configs

2 weeks ago

snapserver.nix

configs.snapserver: move from styx to acheron

1 week ago

spora.nix

configs: rename from 2configs

2 weeks ago

ssh-redirect.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

steam.nix

configs: rename from 2configs

2 weeks ago

syncthing.nix

configs: remove weechat

2 weeks ago

tablet-screen.nix

configs: rename from 2configs

2 weeks ago

themes.nix

configs: rename from 2configs

2 weeks ago

timeful.nix

configs: rename from 2configs

2 weeks ago

tor-ssh.nix

configs: rename from 2configs

2 weeks ago

tpm2.nix

configs: rename from 2configs

2 weeks ago

udisks.nix

configs: rename from 2configs

2 weeks ago

vaultwarden.nix

configs: rename from 2configs

2 weeks ago

wine.nix

configs: rename from 2configs

2 weeks ago

xdg-open.nix

machines.mors: remove transgui

1 week ago

yggdrasil.nix

configs: rename from 2configs

2 weeks ago

yubikey.nix

configs: rename from 2configs

2 weeks ago

zsh.nix

configs: rename from 2configs

2 weeks ago

Configure Feed

Configure Feed