New bare-metal box headed for Nikhef, intended to take over most of
estuary's colony edge routing. This is the bootstrap config only: the
hardware, the single-NVMe ESP + LVM layout, and enough networking to
boot and be reachable.
It is being staged at home before it is racked, so it has no colony
assignments yet. Every 2.5G port takes DHCP and whichever one is
patched in brings the box up; kea registers the DHCP hostname, so the
deploy node points at portcullis.dyn.h.nul.ie until there is a real
colony FQDN for it.
The host key was adopted from the installer session and seeded onto
the persist volume before first boot, so my.secrets.key could be set
up front -- which makes portcullis a recipient of the user-passwd
secret that my.user declares for every box.
Documented with a box page, a row in the colony site index, and a note
in the colony section of networking.md that the topology is expected
to change once portcullis takes over from estuary.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
CI builds Determinate Nix from source, running its unit-test suite. The
`nix-util` `readLinkAt.works` test creates symlinks with PATH_MAX-length
targets, but our CI runner's build filesystem is XFS, which hard-caps
symlink targets at 1024 bytes (XFS_SYMLINK_MAXLEN). Creation fails with
ENAMETOOLONG, so the test — and the whole determinate-nix build — fails
on the runner while passing on non-XFS filesystems.
Filter out just that test via gtest's GTEST_FILTER on the
`nix-util-tests-run` check input, leaving the rest of the unit and
functional tests gating the build (they still matter, since we build
against several nixpkgs channels).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Use Determinate Nix as `nix.package` for systems, homes and the
devshell, for its parallel evaluation and lazy trees. We only take the
package, not `determinate-nixd`: the daemon and `nix.conf` model are
unchanged and the Determinate NixOS module is not imported.
- Add the `determinate-nix` (`nix-src`) input, following our
`nixpkgs-unstable`. FlakeHub's cache needs auth, so we build it
ourselves and let it flow through Harmonia like everything else.
- `determinateOverlay` exposes it as `pkgs'.mine.determinate-nix`;
`lib.my.c.nix.determinateSettings` (`lazy-trees`, `eval-cores = 0`)
is merged into `nix.settings` and the devshell `nix.conf`.
- Switch CI to `DeterminateSystems/determinate-nix-action` so the
runner itself evaluates with Determinate.
- Advertise the Harmonia cache via the flake's `nixConfig`, trusted
without a prompt via `accept-flake-config` in the devshell, `.envrc`
and CI only (boxes already trust it through `nix.settings`).
- Re-attach `pkgs`/`lib` to container and installer
`nixosConfigurations` so Determinate's flake schemas can evaluate
them (`nix flake check` otherwise fails with `attribute 'pkgs'
missing`).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
`pi-coding-agent-bun` breaks `nix flake check` in CI: its bun2nix
`fetchBunDeps` calls `builtins.filterSource` on subpaths of the pi.nix
flake source, which requires that source derivation to be realised in the
local store. A fresh CI runner doesn't have it, so eval aborts with
`path '...-source.drv' is not valid`. It only works locally because the
source is already realised there.
Not using pi right now, so comment out the input, overlays, home module
import and the package (leaving a root-cause note in `flake.nix`) rather
than working around the upstream issue.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jackos1998