dev/nixfiles

Fork 0

Files

T

jackos1998 5171a10079

CI / Check, build and cache nixfiles (push) Failing after 59m32s

Details

Update docs / update (push) Failing after 1m12s

Details

nixpkgs: Refresh channels and inputs

Rebase the fork branches and refresh nixpkgs, home-manager, and the
approved ancillary inputs. Update kernel and release metadata, adapt
removed package and Home Assistant options, and keep Determinate Nix
on its tested nixpkgs revision to avoid duplicate Boost patches.

Retire Sharry and its public endpoint because copyparty replaces it.
Document the GitHub mirror gate and require real devshell and system
builds in the upgrade validation workflow.

2026-08-24 00:10:18 +01:00

3.8 KiB

Raw Blame History

shill

The colony NixOS container host — most colony applications run as systemd-nspawn containers on this VM.

Source: nixos/boxes/colony/vms/shill/ (default.nix, containers-ext.nix, containers/)
Host: VM on colony
nixpkgs: mine

Role

Container hosting

my.containers.instances runs the colony containers on the ctrs bridge. Each is a full NixOS system rendered through my.asContainer and deployed as a profile on shill; containers are not standalone deploy targets. The shared container module supplies the nspawn units, /persist and store binds.

Shared storage

LVM-backed host volumes are bind-mounted into the consumers: /mnt/media is read-only in middleman and read-write in jackflix; /mnt/minio and /mnt/nix-cache are read-write in object.

Routing

shill routes between vms and ctrs, advertises estuary as DNS on ctrs, and routes Tailscale through waffletail and the qclk prefix through qclk. It applies the shared firewallForwards DNAT for estuary's public IP; a connection-mark-based SNAT rule keeps replies symmetric.

Host tuning

The box has a larger conntrack table and ephemeral-port range for high connection counts. Netdata listens on port 19999.

Network assignments

See the consolidated network assignments table (this box: shill).

Containers

Defined under shill/containers/ and wired up in shill's my.containers.instances. The generated network assignments table is the source of truth for their current addresses. Each container has its own page:

Container	Role
`middleman`	Reverse proxy, ACME, nginx-sso, librespeed
`vaultwarden`	Password manager
`colony-psql`	Shared PostgreSQL (14)
`chatterbox`	Matrix Synapse + bridges
`jackflix`	Media stack
`object`	MinIO, Harmonia Nix cache, HedgeDoc, wastebin
`toot`	Bluesky PDS (Mastodon disabled)
`waffletail`	Tailscale subnet router / exit node
`qclk`	WireGuard management appliance
`gam`	Terraria server

`jam`

A one-off: containers-ext.nix runs a raw systemd-nspawn container (not a my.containers instance, not NixOS) with its root on the jam LV, private user namespaces and a ve-jam veth. It gets the jam customer prefix (prefixes.jam, jam-cust in DNS) and SSH is forwarded to it from shill's public IP port 60022.

Notes

nix.settings.substituters is forced to just https://cache.nixos.org — shill sits next to the S3 cache on object, so it doesn't use it.
hercules.nix (Hercules CI agent + the nix-cache-gc timer for the S3 binary cache) exists but is currently disabled: the file is not imported by shill/default.nix.

Notable config files

nixos/boxes/colony/vms/shill/default.nix — VM config, networkd, firewall, my.containers.instances.
nixos/boxes/colony/vms/shill/containers/default.nix — container imports.
nixos/boxes/colony/vms/shill/containers-ext.nix — the jam nspawn container.
nixos/modules/containers.nix — the my.containers module.

3.8 KiB Raw Blame History