Co-Authored-By is the only trailer wanted here; session links are not.
Also spell out that bodies should stay concise.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
fergal is an 8-port SFP+ switch on a Realtek RTL9303, running OpenWrt
rather than RouterOS or UniFi. It is not part of the fabric yet, but
its firmware is now built here via astro's nix-openwrt-imagebuilder.
Packages are baked into the image: OpenWrt's package server keeps only
the current build of each feed, so installing at runtime stops working
as soon as the feed moves past the running firmware.
Those feed indexes rotate constantly, and upstream pins only the
indexes -- a mismatch drops evaluation into import-from-derivation,
putting this flake's eval on the network. The openwrt-feeds input pins
expanded per-package hashes instead, in a repository of its own
because they run to hundreds of thousands of generated lines.
Flashing gets a procedure doc and a thin skill pointing at it, the
same split as the box installation and nixpkgs upgrade procedures.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Canonical, agent-agnostic procedure for bringing a new box into the
flake, from a booted installer through to a deployable system, plus a
thin Claude Code skill pointing at it -- same split as the nixpkgs
upgrade procedure.
Records the conventions that were not written down anywhere: sgdisk
plus an LVM PV for the nix and persist volumes, adopting the
installer's SSH host keys so secrets can be encrypted before first
boot, and taking whatever show-hw-config emits that the flake's own
modules do not already set.
Also notes in AGENTS.md that a changed recipient list should be
re-encrypted per file with ragenix --rekey-one; --rekey rewrites every
secret in secrets/ and buries the actual change.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
New bare-metal box headed for Nikhef, intended to take over most of
estuary's colony edge routing. This is the bootstrap config only: the
hardware, the single-NVMe ESP + LVM layout, and enough networking to
boot and be reachable.
It is being staged at home before it is racked, so it has no colony
assignments yet. Every 2.5G port takes DHCP and whichever one is
patched in brings the box up; kea registers the DHCP hostname, so the
deploy node points at portcullis.dyn.h.nul.ie until there is a real
colony FQDN for it.
The host key was adopted from the installer session and seeded onto
the persist volume before first boot, so my.secrets.key could be set
up front -- which makes portcullis a recipient of the user-passwd
secret that my.user declares for every box.
Documented with a box page, a row in the colony site index, and a note
in the colony section of networking.md that the topology is expected
to change once portcullis takes over from estuary.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`netboot-update` failed with an opaque curl usage error whenever the
`installer` tag advanced past a build that had not published assets:
the `jq` select found no matching asset, and the empty result was
passed straight to `curl` as the URL. Report the missing asset (and
an unresolvable tag) instead.
The unit also had its network dependency inverted, being `wantedBy`
network-online.target rather than wanting and ordering after it. Fix
the idiom and keep it in the boot transaction via multi-user.target.
On river that is not enough on its own, because the WAN is a pppd
interface that networkd's wait-online knows nothing about, so
network-online.target is reached well before there is a route
off-site. Gate the service on wan-online.target there, following the
same wantedBy + partOf idiom as ipsec, which also re-runs the fetch
whenever the link returns.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`release-action` is archived; its repository points at
`gitea-release-action` as the replacement. The inputs were renamed
(`api_key` -> `token`, `title` -> `name`).
The new action is a Node one rather than Go, so the Go setup step
kept in the previous commit is no longer needed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Gitea writes uploaded release assets to a temp file before storing
them. That landed in `/tmp`, which is on the 2G tmpfs root, so
uploading the installer ISO failed with:
ParseMultipartForm [E] ... write /tmp/multipart-...: no space
left on device
Point the service's `TMPDIR` at the state volume, which has room.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The installer workflow had not been touched since 2024 and missed
both the Ubuntu 26.04 runner bump and the move to Determinate Nix as
the common Nix. Bring it in line with `ci.yaml`.
The Go setup step stays: it supports the Gitea release action rather
than the Nix build.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`boot.initrd.systemd.extraConfig` was removed upstream and now fails
an assertion, which broke the `netbootArchive` target and with it the
second build step of the installer release workflow. Move the two
timeout settings to `settings.Manager`.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The ISO target had drifted from nixpkgs and no longer evaluated:
`iso-image.nix` now defines `image.baseName` itself, which conflicts
with ours, so force it.
Drop the `boot.initrd.systemd.enable = false` override from the
`asISO` build target. The missing `/dev/root` it worked around is no
longer an issue, and scripted initrd is deprecated for removal in
26.11.
Replace the wpa_supplicant stanza, which upstream's
`installation-device.nix` no longer carries, with NetworkManager.
Keep it out of `multi-user.target` so nothing network-related starts
until asked; NetworkManager enables wpa_supplicant as its backend,
which is D-Bus activated on demand.
Pick up three more bits from that profile: the installer
`variant_id`, the pstore drop-in that stops an install evacuating the
target's persistent entries, and the mdadm `PROGRAM` stub that
silences the unset-mail warning.
Built and booted as an ISO to confirm.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Some headsets alternate play and pause events independently of the
actual player state. Treat either event as a toggle so an out-of-sync
event is not a no-op.
Wrap Firefox with a privileged AutoConfig controller that unloads tabs under configurable MemAvailable hysteresis and exposes an on-demand reclaim command. Enable it by default for Linux GUI homes.
Notes from bench-testing the Quectel RM500U-EA on tower, bought to
eventually replace stream's Virgin Media WAN. Like the switches and
APs, the module is configured out-of-band and is not referenced by
the flake.
Records what it takes to connect at all: the module must be switched
from its stock NCM composition to MBIM, since under NCM the PDP
context activates but the cdc_ncm link never raises carrier; and the
connect only succeeds with the network-expanded APN read off the
default-attach bearer, as IPv4.
Also flags the two consequences for stream: the SIM is CGNAT so it
cannot carry the public lease stream's WAN currently publishes, and
the bearer reports a /8 that would cover Tailscale's 100.64.0.0/10
if configured literally.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
CI builds Determinate Nix from source, running its unit-test suite. The
`nix-util` `readLinkAt.works` test creates symlinks with PATH_MAX-length
targets, but our CI runner's build filesystem is XFS, which hard-caps
symlink targets at 1024 bytes (XFS_SYMLINK_MAXLEN). Creation fails with
ENAMETOOLONG, so the test — and the whole determinate-nix build — fails
on the runner while passing on non-XFS filesystems.
Filter out just that test via gtest's GTEST_FILTER on the
`nix-util-tests-run` check input, leaving the rest of the unit and
functional tests gating the build (they still matter, since we build
against several nixpkgs channels).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Capture the periodic upgrade of the four nixpkgs channels and
home-manager as a repo doc: check for a NixOS stable bump first, rebase
the devplayer0 fork against upstream (re-verifying the patch stack
against freshly fetched refs), run the update commands, sweep
version-gated TODOs, and review the remaining flake inputs.
Keep the canonical, agent-agnostic procedure in docs/ and point both
AGENTS.md and a thin Claude Code skill at it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Job containers using actions/cache hung and timed out reaching the
runner's built-in artifact cache server. With cache.host unset,
act_runner announced the box's autodetected outbound address, which
containers on podman0 can't route back to; even to the right address
the host input chain (policy drop) dropped the connection, as only the
forward chain was opened for the podman subnet.
Pin cache.host to the podman bridge gateway and cache.port to a fixed
value, and open that one port on podman0 in the input chain. Declare
the podman subnet once in the box file and derive the gateway, the
default_subnet and both firewall rules from it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Use Determinate Nix as `nix.package` for systems, homes and the
devshell, for its parallel evaluation and lazy trees. We only take the
package, not `determinate-nixd`: the daemon and `nix.conf` model are
unchanged and the Determinate NixOS module is not imported.
- Add the `determinate-nix` (`nix-src`) input, following our
`nixpkgs-unstable`. FlakeHub's cache needs auth, so we build it
ourselves and let it flow through Harmonia like everything else.
- `determinateOverlay` exposes it as `pkgs'.mine.determinate-nix`;
`lib.my.c.nix.determinateSettings` (`lazy-trees`, `eval-cores = 0`)
is merged into `nix.settings` and the devshell `nix.conf`.
- Switch CI to `DeterminateSystems/determinate-nix-action` so the
runner itself evaluates with Determinate.
- Advertise the Harmonia cache via the flake's `nixConfig`, trusted
without a prompt via `accept-flake-config` in the devshell, `.envrc`
and CI only (boxes already trust it through `nix.settings`).
- Re-attach `pkgs`/`lib` to container and installer
`nixosConfigurations` so Determinate's flake schemas can evaluate
them (`nix flake check` otherwise fails with `attribute 'pkgs'
missing`).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Every managed home already had its stateVersion force-set per
home-manager branch (22.11 for stable/mine-stable, 23.05 otherwise);
pin them all to 23.05.
With the floor at 23.05 the `versionAtLeast config.home.stateVersion`
guards on `nix.package` are always taken, so drop them.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Statically-addressed home servers on hi run no DHCP, so they learned a
resolver only from the v6 RA RDNSS and lost DNS whenever v6 (and thus
the RA) was absent. Factor the fix castle/palace applied inline into a
shared lib.my.c.home.vlanDns helper that points resolved at the VLAN's
VRRP VIPs (always-present static v4, plus v6 when up) and sets the
advertised search domains, then apply it to every statically-addressed
hi client: castle, palace, cellar, sfh and the sfh hass/unifi
containers. Document it under the router client DNS section.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jim, dave and the vibe AP are pure L2, but RouterOS ships ip-forward and
IPv6 forward on, and with IPv6 forwarding enabled it also advertises
itself as a default router. After the 7.18 -> 7.23 upgrade clients began
picking up the switches as IPv6 default routers alongside river.
Replace the earlier advertise-dns framing (which only strips RA options,
not the router lifetime) with the actual requirement: ip-forward=no,
IPv6 forward=no, accept-router-advertisements=no, ra-lifetime=0, and a
re-check after every RouterOS upgrade.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
castle took its resolver solely from the IPv6 RA (radvd RDNSS) on
lan-hi, so DNS broke whenever RA was absent. Since castle's own v6 is
RA/SLAAC-derived it has no usable v6 address in that case, so anchor
DNS on the always-present static v4 via the VRRP VIP, with the v6 VIP
as a bonus when v6 is up. Search domains reuse the centralised
lib.my.c.home.searchDomains list.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
radvd's DNSSL and kea's domain-search hardcoded the same list of
search domains in two places. Hoist it to lib.my.c.home.searchDomains
so there is a single source of truth (and so other consumers, such as
statically-configured boxes, can reuse it). No change to what is
advertised.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The DNS reference generator transfers each zone from the nameservers
public NS discovery returns. The home IPv6 reverse zone
(0.d.4.0.0.c.7.9.e.0.a.2.ip6.arpa) is delegated only to Hurricane
Electric, which refuses AXFR, so generation aborted before committing
any zone. Our own authoritative servers (ns1/ns2.h.nul.ie) serve that
zone and permit transfers but aren't in its public delegation, as their
addresses are dynamic.
When a zone's delegated servers all refuse, retry against the union of
nameservers discovered for every other zone. That pool includes
ns1/ns2.h.nul.ie via the h.nul.ie NS records, resolved to their current
addresses at query time, so the reverse zone transfers from the same
reachable servers h.nul.ie already uses. Zones whose own servers work
are unaffected; the fallback only runs after their transfers fail.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
IPv6 temporary (privacy) addresses rotate an interface's stable source
address out from under long-lived connected sockets. nginx's resolver
on middleman binds a UDP socket to the preferred temporary address at
worker start; once that address expires and is removed, the socket can
no longer send, so every upstream lookup fails with "could not be
resolved (timed out)" until nginx is restarted (which then binds the
next temporary address, so it recurs).
These are servers with no need for privacy addresses, so disable them
in networkdAssignment for every RA-accepting interface.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Generate forward and reverse record tables from authoritative AXFRs
while preserving handwritten Markdown outside per-zone markers. Run the
generator in CI and link the reference from the relevant docs.
Place physical hardware inventories and VPS resource allocations near
the top of each box page, while leaving broader platform details in
their topical sections.
Evaluate custom module options through a synthetic system, stabilize
configuration-dependent defaults for rendering, and commit the generated
reference beside its updater.
Render site tables from the aggregated assignments, group rows by
assignment name, preserve handwritten notes, and expose the updater as a
flake package.
`pi-coding-agent-bun` breaks `nix flake check` in CI: its bun2nix
`fetchBunDeps` calls `builtins.filterSource` on subpaths of the pi.nix
flake source, which requires that source derivation to be realised in the
local store. A fresh CI runner doesn't have it, so eval aborts with
`path '...-source.drv' is not valid`. It only works locally because the
source is already realised there.
Not using pi right now, so comment out the input, overlays, home module
import and the package (leaving a root-cause note in `flake.nix`) rather
than working around the upstream issue.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adding volume-group support changed the LVM disk helper's argument
meaning, so standard VM disks and the legacy darts calls resolved disk
names as volume groups.
Restore the main volume group for standard disks and map the differently
named darts volumes explicitly.
Document the home network's out-of-band devices that aren't managed by
this flake:
- `home-aps.md` — the two dumb APs (`vibe` MikroTik cAP ax, `wave` Cudy
AX3000 on OpenWrt): shared VLAN-trunk design (`hi`/`lo` are both
trusted client VLANs differing only by MTU), SSIDs, per-AP management
addressing, roaming (802.11k/v), and the OpenWrt flash + on-device
config for `wave` (incl. the `mtk_eth_soc` eth0 2026-byte MTU cap that
keeps it off the jumbo `hi` VLAN, wpad-mbedtls swap, HE160).
- `home-switches.md` — the hand-configured switches (`jim`/`dave`
MikroTik, `brian` UniFi) topology, VLAN map, and ONT/WAN path.
Add the `home-aps.md` pointer to AGENTS.md alongside the existing
switches reference.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New Cudy AX3000 AP `wave` takes host `.14` on core (backup) and lo
(primary); replaces the decommissioned AP of the same name. It's managed
on `lo`, not `hi`, because its 2.5GbE (`mtk_eth_soc` eth0) caps at MTU
2026 and so can't join `hi`'s jumbo (9000) fabric — and `hi`/`lo` are
both trusted client VLANs differing only by MTU.
Renumber the MikroTik AP `vibe` from `.13` to `.15` and give it the same
core/hi/lo records as `jim`/`dave` (was `hi`-only), matching its
on-device reconfiguration. `vibe` stays on `hi` since it can do jumbo.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Note `CLAUDE.md` is a symlink to `AGENTS.md` (edit the real file).
- Policy: prefer recording durable guidance here over agent memory.
- Add the "Home switches" section (`jim`/`dave`/`brian`, access,
confirm-before-apply) pointing at `home-switches.md`.
- Document `deploy --boot` for staging a config without live-switching.
- Note the `ssh-agent` hang workaround for outbound SSH (`ssh-machine`/`deploy`).
- Add a comment convention: comment where useful, not for trivial code, and
describe general purpose rather than the one-off reason for a change.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
With a single ONT the ISP's VLAN 10 is unique on the fabric, so there's no
need to swap it to a private fabric VLAN. Carry pon-isp (10) trunked straight
through the switches to river and run PPPoE directly on it, dropping the old
wan-pon-isp (141) translation. The ONT's untagged management is PVID'd onto
wan-pon-ont (140) at its edge switch (brian).
wan-pon-isp (141) is kept as a constant, reserved for the future multi-ONT
case where per-port VLAN translation disambiguates two VLAN-10 ONTs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The modem management subnet is stream-specific (it shares stream's `wan`
interface), so it no longer belongs in the shared routing-common. Drop the
`modem` network assignment and configure the address directly on stream's
`wan` (modemV4). The firewall reject and DNS wan-A-record skipBroadcasts that
existed only because of the modem move to per-box options
`my.homeRouter.{firewall.untrustedRejectV4,dns.wanSkipBroadcasts}`, set solely
by stream. river needs neither: its ONT sits on a separate interface already
blocked by the interface-based forward rules.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Digiweb's ONT delivers its untagged management traffic (192.168.100.0/24)
alongside the tagged ISP VLAN 10. The switch feeding river now tags the ONT's
untagged port as wan-pon-ont (140) and swaps the ISP VLAN 10 to wan-pon-isp
(141) on ingress, so both reach river single-tagged: river takes an address in
the ONT's /24 on 140 to reach its web UI, and PPPoE runs directly on 141.
Replaces the old QinQ-into-131 (wanStacked) transport; the wan-pon (131) VLAN
constant is dropped and prefixes.ont added.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
dev
jackos1998