esp4_offload/esp6_offload provide GSO/GRO batching for ESP and are not
autoloaded when an SA is created, costing around a third of the mesh's
encrypted throughput. Load the one matching each secured mesh's
underlay family.
Also document the per-SA single-core limit and pcrypt as an option.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`netboot-update` failed with an opaque curl usage error whenever the
`installer` tag advanced past a build that had not published assets:
the `jq` select found no matching asset, and the empty result was
passed straight to `curl` as the URL. Report the missing asset (and
an unresolvable tag) instead.
The unit also had its network dependency inverted, being `wantedBy`
network-online.target rather than wanting and ordering after it. Fix
the idiom and keep it in the boot transaction via multi-user.target.
On river that is not enough on its own, because the WAN is a pppd
interface that networkd's wait-online knows nothing about, so
network-online.target is reached well before there is a route
off-site. Gate the service on wan-online.target there, following the
same wantedBy + partOf idiom as ipsec, which also re-runs the fetch
whenever the link returns.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`boot.initrd.systemd.extraConfig` was removed upstream and now fails
an assertion, which broke the `netbootArchive` target and with it the
second build step of the installer release workflow. Move the two
timeout settings to `settings.Manager`.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The ISO target had drifted from nixpkgs and no longer evaluated:
`iso-image.nix` now defines `image.baseName` itself, which conflicts
with ours, so force it.
Drop the `boot.initrd.systemd.enable = false` override from the
`asISO` build target. The missing `/dev/root` it worked around is no
longer an issue, and scripted initrd is deprecated for removal in
26.11.
Replace the wpa_supplicant stanza, which upstream's
`installation-device.nix` no longer carries, with NetworkManager.
Keep it out of `multi-user.target` so nothing network-related starts
until asked; NetworkManager enables wpa_supplicant as its backend,
which is D-Bus activated on demand.
Pick up three more bits from that profile: the installer
`variant_id`, the pstore drop-in that stops an install evacuating the
target's persistent entries, and the mdadm `PROGRAM` stub that
silences the unset-mail warning.
Built and booted as an ISO to confirm.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Use Determinate Nix as `nix.package` for systems, homes and the
devshell, for its parallel evaluation and lazy trees. We only take the
package, not `determinate-nixd`: the daemon and `nix.conf` model are
unchanged and the Determinate NixOS module is not imported.
- Add the `determinate-nix` (`nix-src`) input, following our
`nixpkgs-unstable`. FlakeHub's cache needs auth, so we build it
ourselves and let it flow through Harmonia like everything else.
- `determinateOverlay` exposes it as `pkgs'.mine.determinate-nix`;
`lib.my.c.nix.determinateSettings` (`lazy-trees`, `eval-cores = 0`)
is merged into `nix.settings` and the devshell `nix.conf`.
- Switch CI to `DeterminateSystems/determinate-nix-action` so the
runner itself evaluates with Determinate.
- Advertise the Harmonia cache via the flake's `nixConfig`, trusted
without a prompt via `accept-flake-config` in the devshell, `.envrc`
and CI only (boxes already trust it through `nix.settings`).
- Re-attach `pkgs`/`lib` to container and installer
`nixosConfigurations` so Determinate's flake schemas can evaluate
them (`nix flake check` otherwise fails with `attribute 'pkgs'
missing`).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Evaluate custom module options through a synthetic system, stabilize
configuration-dependent defaults for rendering, and commit the generated
reference beside its updater.
`pi-coding-agent-bun` breaks `nix flake check` in CI: its bun2nix
`fetchBunDeps` calls `builtins.filterSource` on subpaths of the pi.nix
flake source, which requires that source derivation to be realised in the
local store. A fresh CI runner doesn't have it, so eval aborts with
`path '...-source.drv' is not valid`. It only works locally because the
source is already realised there.
Not using pi right now, so comment out the input, overlays, home module
import and the package (leaving a root-cause note in `flake.nix`) rather
than working around the upstream issue.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jackos1998