docs/boxes: Document deployed boxes

Add per-site and per-box inventories, consolidate shared network design, and relocate the switch and access-point references under the home site.
2026-08-01 23:52:57 +01:00
parent 43cf35d54e
commit a2f3410e42
40 changed files with 2285 additions and 66 deletions
@@ -0,0 +1,50 @@
+# tower
+
+Portable workstation — a Framework Laptop 13 (Intel), running the full GUI environment.
+
+- **Source:** [`nixos/boxes/tower/default.nix`](../../nixos/boxes/tower/default.nix)
+- **Host:** physical (laptop)
+- **nixpkgs:** `mine`
+
+## Role
+
+- Personal portable workstation: `my.gui.enable`, with Sway managed by home-manager.
+- Joins the tailnet through the headscale on [`britway`](../remote/britway.md) (fish abbr
+  `tsup` = `doas tailscale up --login-server=https://hs.nul.ie --accept-routes`).
+
+## Network assignments
+
+`tower` has no static assignment; it uses DHCP through NetworkManager and reaches the other boxes
+over Tailscale.
+
+## Hardware / platform
+
+| Component | Inventory |
+|---|---|
+| Platform | Framework Laptop 13 (12th Gen Intel Core) |
+| CPU | Intel Core i5-1240P (12 cores / 16 threads) |
+| Memory | 32 GiB |
+| Storage | 2 TB WD Black SN850 NVMe SSD |
+| Graphics | Integrated Intel Iris Xe |
+| Connectivity | Intel AX210 Wi-Fi 6E, Bluetooth and Thunderbolt 4 |
+
+The configuration enables Intel microcode updates, `kvm-intel`, `intel_iommu=on`,
+`intel-media-driver` and the latest kernel (`lib.my.c.kernel.latest`). Thunderbolt security
+(`bolt`), the fingerprint reader (`fprintd`) and `tlp` power management are also enabled.
+
+## Storage
+
+- Two LUKS-encrypted partitions, `persist` and `home` (both `allowDiscards`); `/nix` is a
+  separate ext4 filesystem, `/boot` is vfat.
+- Persistent `/home` (`my.user.tmphome = false`) with a size-limited tmpfs root (`my.tmproot.size`).
+
+## Networking / services
+
+- NetworkManager (`wpa_supplicant` backend) with `systemd-resolved`; networkd `wait-online`
+  is disabled. The Wi-Fi interface is renamed to `wifi` by MAC.
+- Steam and Wireshark enabled; `fstrim`, LVM thin provisioning.
+- `nix.gc.automatic = false` — GC is run manually on the laptop.
+
+## Notable config files
+
+- [`nixos/boxes/tower/default.nix`](../../nixos/boxes/tower/default.nix) — the whole box (single file).