superconfig/machines/ at e334411d50b23a3d18d2841a1b3cf99056f77dbf · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines

20 folders

at e334411d50b23a3d18d2841a1b3cf99056f77dbf

lassulus machines.atlas: fetch nix store over http in netboot stage 1 5w ago

remove exim from all machines and clean up references

7 months ago

machines.atlas: fetch nix store over http in netboot stage 1

1 month ago

machines.barnacle: dial neoprism and starkstrom kartei darwin module only dials eve/eva/ni/prism, krebs hubs that learn about barnacle when their own registry pins move. A laptop behind NAT needs relays we control: the same neoprism the NixOS nodes use (dialable once krebs/kartei#64 lands) plus starkstrom.

1 month ago

2configs.herdr: install herdr on ignavia, coaxmetal, neoprism

1 month ago

machines.daedalus: drop hexchat (removed from nixpkgs)

2 months ago

green: remove mail services (migrated to neoprism)

7 months ago

refactor: move common configuration to 2configs/default.nix - Move clan and stockholm configuration from flake.nix to 2configs/default.nix - Simplify flake.nix machines definition to only import physical.nix - Add explicit import of ../../2configs to each machine's config.nix - This allows for more selective configuration imports per machine

1 year ago

2configs.rad: shared per-machine radicle identity and node One radicle-node serves one keypair, so each machine that does radicle work gets its own identity (vars generator `rad`) and a node running as the `rad` system user over /var/lib/rad. The profile is group-shared (setgid dirs, umask-002 wrappers for rad/git-remote-rad, pre-created group-writable sqlite files) so any account in group `rad` signs with the machine identity; mainUser is a member. RAD_HOME points there for login shells. Imported explicitly on coaxmetal, neoprism, ignavia, icarus and shodan. Rename the public seed module to 2configs/radicle.lassul.us.nix and switch its retired seed.radicle.garden entry to iris.radicle.network.

1 month ago

2configs.herdr: install herdr on ignavia, coaxmetal, neoprism

1 month ago

machines.mors: drop adb-sync Removed from nixpkgs in favour of better-adb-sync, which broke evaluation of this host. Dropped rather than swapped -- nothing here used it.

1 month ago

2configs.herdr: install herdr on ignavia, coaxmetal, neoprism

1 month ago

orange: drop cgit/git service orange's autoswitch was failing activation: the git service's mkdir /var/lib/git hit a symlink loop (a stale dangling `state/git -> ../../var/state/git` link that loops because the container bind-mounts both /var/lib and /var/state to the same state dir). cgit is being retired, so remove the services/git import entirely. This also unblocks orange's autoswitch (it no longer touches /var/lib/git). Assisted-by: Claude Code (claude-opus-4-8[1m])

4 months ago

machines.{prism,neoprism}: migrate mastodon-proxy prism is decommissioned, so social.krebsco.de had no working entry point while the hotdog container itself kept serving fine on neoprism. DNS for social.krebsco.de still needs to be repointed to neoprism before ACME can issue a cert.

2 months ago

*: migrate facts to vars

10 months ago

2configs.rad: shared per-machine radicle identity and node One radicle-node serves one keypair, so each machine that does radicle work gets its own identity (vars generator `rad`) and a node running as the `rad` system user over /var/lib/rad. The profile is group-shared (setgid dirs, umask-002 wrappers for rad/git-remote-rad, pre-created group-writable sqlite files) so any account in group `rad` signs with the machine identity; mainUser is a member. RAD_HOME points there for login shells. Imported explicitly on coaxmetal, neoprism, ignavia, icarus and shodan. Rename the public seed module to 2configs/radicle.lassul.us.nix and switch its retired seed.radicle.garden entry to iris.radicle.network.

1 month ago

retiolum: keep non-kartei peers in self.retiolum starkstrom stays out of the shared kartei registry but should still be reachable inside the fleet. Its card now lives in retiolum/ in the same nets.<net> layout kartei and krebs.hosts use, rendered by a copy of kartei modules/retiolum/hosts.nix, so the entry can move to kartei/lass unchanged if the rest of krebs should reach it too. Every superconfig machine injects that set into its tinc hosts: the NixOS nodes through nixpkgs services.tinc, barnacle through kartei tincr module (hosts is attrsOf lines, so the entries merge). Previously only starkstrom itself knew its card, so the fleet had no route to it; now all 16 machines do, and peers dial its static address directly instead of relaying. self.retiolum exposes hosts/tincHosts/own, the same interface as kartei, so both sources merge symmetrically. starkstrom krebs.hosts card is composed from it -- addresses, aliases and the ed25519 key have one source now; only the legacy RSA pubkey stockholm insists on stays local.

1 month ago

2configs/services/invidious: remove (playback unreliable) Livestreams never played and VOD depends on companion keeping up with YouTube's po_token and SABR changes, which it does not reliably enough to be worth the moving parts. Takes the residential exits with it: tinyproxy on styx and coaxmetal existed only so neoprism could reach YouTube from a non-Hetzner address. Leaves the generated companion key in vars/pass, matching how the silverbullet and oauth2-proxy removals were handled.

2 months ago

fix extra-container eval: add dummy nixos-init option extra-container uses a minimal NixOS module set for fast evaluation. nixpkgs unstable added nixos-init.nix and systemd.nix now references config.system.nixos-init.package, but extra-container's module set doesn't include it. Add a dummy nixos-init.package option to the outer container config, matching extra-container's existing pattern for missing options. Also fixes services.mingetty -> services.getty rename in virtulus.

8 months ago

radicle: run a public allow-all seed on neoprism (radicle.lassul.us, 80G quota) Extend 2configs/radicle.nix into a public seed: allow-all seeding (scope=all), listen 0.0.0.0:8776 + externalAddresses radicle.lassul.us:8776, radicle-httpd behind an nginx vhost (radicle.lassul.us, ACME). Drop the tor proxy + onion preferred seeds. Move the config off xerxes onto neoprism, and put the node state on tank at /var/lib/radicle with an 80G ZFS quota (radicle has no built-in byte quota; the dataset bounds it).

2 months ago

yellow: resolve AirVPN endpoint in main netns for transmission tunnel Recent wireguard-tools resolve the peer Endpoint in the namespace where `wg syncconf` runs. The transmission netns has no route until the tunnel is up, so resolving europe.vpn.airdns.org from inside it always fails; wg burns ~70s of DNS-retry backoff per attempt before erroring. During a nixos switch that restarts transmission-netns this stalled the whole deploy for >2min and left the service (and the download stack) failed. Resolve the endpoint in the main netns (which has connectivity, and is already gated on the `host` check above) and hand wg a numeric Endpoint, so the tunnel comes up instantly. Also fix the bare `sleep` in the DNS wait loop, which errored under `set -e` instead of retrying. Assisted-by: Claude Code (claude-opus-4-8)

4 months ago