superconfig/machines/ at c58195d00d2b167e41061982dcf78f74063dc85d · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines

18 folders

at c58195d00d2b167e41061982dcf78f74063dc85d

lassulus machines.xerxes: secureify electron_39 for bitwarden-desktop 4mo ago

remove exim from all machines and clean up references

7 months ago

machines.barnacle: add radicle-node

5 months ago

remove exim from all machines and clean up references

7 months ago

machines.daedalus.physical: add missing /boot fsType

6 months ago

green: remove mail services (migrated to neoprism)

7 months ago

refactor: move common configuration to 2configs/default.nix - Move clan and stockholm configuration from flake.nix to 2configs/default.nix - Simplify flake.nix machines definition to only import physical.nix - Add explicit import of ../../2configs to each machine's config.nix - This allows for more selective configuration imports per machine

1 year ago

remove exim from all machines and clean up references

7 months ago

ignavia: cap GRUB generations to fit the 1 GiB ESP /boot is only 1 GiB (disk.nix). Without configurationLimit, GRUB retains every generation's kernel+initrd until the ESP fills, at which point the bootloader install fails ("No space left on device") and deploys can't finish. Keep the 10 most recent; older kernels get pruned automatically. Assisted-by: Claude Code (claude-fable-5)

4 months ago

remove exim from all machines and clean up references

7 months ago

neoprism: drop ollama, stage riot VM on bridged dedicated IP ollama is no longer used here; removing it frees ~4G. Prepare a fresh libvirt guest for riot on a dedicated public IP (95.217.192.52, separate MAC) bridged directly onto ext-br. Because the bridge is unmanaged, libvirt installs no iptables rules for it, avoiding the nat-chain race that forced the old restart-iptables hack in hfos.nix. - physical.nix: enable the ext-br bridge, enslave enp35s0, host IP on bridge - config.nix: enable libvirtd, add riot login user, FORWARD accept for the VM IP Bridge cutover applies at the next reboot window; the VM is created imperatively afterwards. Assisted-by: Claude Code (claude-opus-4-8[1m])

4 months ago

orange: drop cgit/git service orange's autoswitch was failing activation: the git service's mkdir /var/lib/git hit a symlink loop (a stale dangling `state/git -> ../../var/state/git` link that loops because the container bind-mounts both /var/lib and /var/state to the same state dir). cgit is being retired, so remove the services/git import entirely. This also unblocks orange's autoswitch (it no longer touches /var/lib/git). Assisted-by: Claude Code (claude-opus-4-8[1m])

4 months ago

machines.{prism,neoprism}: migrate realwallpaper, lassul.us website, bgt-bot Move realwallpaper service and lassul.us website from prism to neoprism. DNS for lassul.us already points at neoprism. bgt-bot is commented out on neoprism for now; can be enabled later if it goes down on prism (which currently isn't deploying anyway). Drop the now-redundant lassul.us -> orange.r proxy in orange-host.nix and the lassul.us acme fallback on prism.

5 months ago

*: migrate facts to vars

10 months ago

machines.shodan: disable hdapsd for now

9 months ago

machines/styx: add n8n

6 months ago

fix extra-container eval: add dummy nixos-init option extra-container uses a minimal NixOS module set for fast evaluation. nixpkgs unstable added nixos-init.nix and systemd.nix now references config.system.nixos-init.package, but extra-container's module set doesn't include it. Add a dummy nixos-init.package option to the outer container config, matching extra-container's existing pattern for missing options. Also fixes services.mingetty -> services.getty rename in virtulus.

8 months ago

machines.xerxes: secureify electron_39 for bitwarden-desktop bitwarden-desktop pulls electron_39, which nixpkgs now marks insecure (EOL), failing `nix flake check` (eval-xerxes). secureify it via overlay rather than nixpkgs.config.permittedInsecurePackages, matching the existing olm fix in mautrix-telegram (lib/secureify.nix). Assisted-by: Claude Code (claude-opus-4-8[1m])

4 months ago

yellow: resolve AirVPN endpoint in main netns for transmission tunnel Recent wireguard-tools resolve the peer Endpoint in the namespace where `wg syncconf` runs. The transmission netns has no route until the tunnel is up, so resolving europe.vpn.airdns.org from inside it always fails; wg burns ~70s of DNS-retry backoff per attempt before erroring. During a nixos switch that restarts transmission-netns this stalled the whole deploy for >2min and left the service (and the download stack) failed. Resolve the endpoint in the main netns (which has connectivity, and is already gated on the `host` check above) and hand wg a numeric Endpoint, so the tunnel comes up instantly. Also fix the bare `sleep` in the DNS wait loop, which errored under `set -e` instead of retrying. Assisted-by: Claude Code (claude-opus-4-8)

4 months ago