jackos1998
d51f2d62b6
Add a top-level README mapping the boxes and a full docs/ tree: topic pages (architecture, networking, deployment), per-site box pages for colony and home with containers nested under their hosts, remote and mobile boxes, the installer, and the home switch fabric reference (folded in from home-switches.md, with AGENTS.md and code comments retargeted to its new home). Box pages carry marked assignment tables that CI regenerates from nixos.allAssignments. AGENTS.md points at the new docs and keeps its terse agent version of the mechanics, referring to the topic pages for depth.
2.7 KiB
2.7 KiB
object
Object storage and the Nix binary cache, plus a few small self-hosted web apps (Sharry, HedgeDoc, wastebin).
- Source:
shill/containers/object.nix - Host: NixOS container on
shill(bind-mounts/mnt/minioand/mnt/nix-cacheread-write)
Role
| Service | Port | Purpose |
|---|---|---|
| MinIO | 9000 (S3) / 9001 (console) |
S3-compatible object storage, s3.nul.ie + *.s3.nul.ie (virtual-host style via MINIO_DOMAIN), console at minio.nul.ie; region eu-central-1; data on the /mnt/minio XFS volume |
| Harmonia | 5000 |
Nix binary cache at nix-cache.nul.ie — harmonia-dev cache serves shill's /nix/store out of a dedicated store view rooted at /var/lib/harmonia (bind-mounted from /mnt/nix-cache), signed with the nix-cache.key secret; a harmonia user with authorized keys exists for cache pushes; priority 30 |
| Sharry | 9090 |
file sharing at share.nul.ie; Postgres on colony-psql, files stored in the share MinIO bucket; fixed dev account + invite signup; mail via mail.nul.ie; max share size 128G |
| HedgeDoc | 3000 |
collaborative markdown notes at md.nul.ie; Postgres on colony-psql; anonymous edits but no anonymous notes, email login, no open email registration |
| wastebin | 8088 |
pastebin at pb.nul.ie |
| atticd | 8069 |
currently disabled (services.atticd.enable = false) — an alternative Nix cache that would store locally and sit behind nix-cache.nul.ie; config (including the object/atticd.env secret) is kept around |
Everything public is fronted by middleman (see its vhost table). The
minio-client is installed and the user's ~/.mc/config.json points at an age-secret config.
minio-2025-10-15T17-29-55Z is allowlisted via permittedInsecurePackages (flagged as a TODO).
Network assignments
| Name | Assignment | IPv4 | IPv6 | Domain | Notes |
|---|---|---|---|---|---|
| object-ctr | internal | 10.100.2.7/24 gw 10.100.2.1 |
2a0e:97c0:4d2:12::7/64 |
ams1.int.nul.ie |
Backing services
- colony-psql — Sharry and HedgeDoc databases (atticd too, when enabled).
- MinIO buckets back other boxes' services: Gitea LFS/packages (with the
middlemanMIME hack for Docker manifests), Mastodon'smastodonbucket and the Bluesky PDSpdsbucket on toot, and Sharry'ssharebucket.
Notable config files
nixos/boxes/colony/vms/shill/containers/object.nix— container definition and all services