285 Commits

Include renames

Author	SHA1	Message	Date
Greg Hellings	d2f7b85283	chore: bring hermes into nebula	2026-07-21 17:16:37 -05:00
Greg Hellings	0e972936d3	chore: update macOS settings	2026-07-07 14:15:17 -05:00
Greg Hellings	f5922887bf	chore: clean up IP name duplication	2026-07-07 14:08:48 -05:00
Greg Hellings	b324ee5352	chore: update bookmarks	2026-06-15 22:43:24 -05:00
Greg Hellings	db5ef17dba	chore: bump flake version	2026-06-08 11:28:56 -05:00
Greg Hellings	251f2804c6	chore: transmission to deluge	2026-06-08 11:18:12 -05:00
Greg Hellings	394c2c2aba	chore: arr to NAS	2026-06-04 13:31:26 -05:00
Greg Hellings	985dd927c4	chore: move from attic to niks3	2026-05-12 21:25:24 -05:00
Greg Hellings	10d6f85b5e	chore: update pre-commit	2026-05-10 01:48:45 -05:00
Greg Hellings	e62757cf1c	chore: add Ubuntu 26.04 to matrix	2026-05-10 01:42:28 -05:00
Greg Hellings	2932e9e335	chore: remove vm-gitlab which is no longer in use	2026-04-30 16:06:58 -05:00
Greg Hellings	2476be3799	chore: make builder hostname more accessible	2026-04-30 10:09:18 -05:00
Greg Hellings	08111e7a8a	chore: add ssh key to remote-builder config	2026-04-30 10:08:57 -05:00
Greg Hellings	c3e3ca84a2	chore: cleanup unused packages on Darwin	2026-04-29 13:02:12 -05:00
Greg Hellings	f8cc47614f	chore: remove unused genesis config bits	2026-04-24 18:56:10 -05:00
Greg Hellings	8ba503ca5d	chore: upgrade Immich db to PG 18	2026-04-21 16:22:21 -05:00
Greg Hellings	e84e03cd05	chore: move charts into manifests	2026-04-17 15:43:57 -05:00
Greg Hellings	14c7f34108	chore: lithic stuff	2026-04-08 08:00:35 -05:00
Greg Hellings	aee34e5b86	feat: more bookmarks	2026-04-05 20:03:51 -05:00
Greg Hellings	3847c7d92d	fix: streamline Gitea runners	2026-04-05 16:51:31 -05:00
klaatu	81936ac524	feat: Gitea Actions shell runners + flake-lock workflow ... - Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in shell mode, with options for enable, instanceURL, name, labels, and tokenFile (agenix secret path). - Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with appropriate labels. Agenix secret placeholders left with TODOs. - Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday midnight) that runs nix flake update and opens a PR if flake.lock changed, using GITEA_TOKEN secret for authentication. Closes part of #15 (NixOS shell runners + flake-lock workflow).	2026-04-05 04:58:27 -05:00
klaatu	b2728bf1de	feat: add gitea-runner NixOS module	2026-04-04 06:18:10 +00:00
Greg Hellings	88d9234332	fix: no default routes	2026-04-02 08:11:32 -05:00
root	f35e8c755c	fix: only set listen.port on lighthouse/relay nodes (regular nodes use OS-assigned port 0)	2026-04-01 17:14:12 -05:00
root	71ae25a58c	fix: move unsafe_routes to settings.tun.unsafe_routes (correct NixOS nebula option path)	2026-04-01 17:13:37 -05:00
root	0e61efe5b5	fix: rename tun.dev to tun.device (correct NixOS option name)	2026-04-01 17:07:47 -05:00
root	84e4c68f0e	fix: move unsafeRoutes to module default, genesis overrides to [] ... Per review feedback: - nebula module now defaults unsafeRoutes to [{route=10.42.0.0/16 via=10.157.0.2}] so all regular nodes get home LAN routing automatically - genesis overrides unsafeRoutes=[] since it IS the routing node (avoids loop) - exodus and all k3s nodes (hosea, isaiah, jeremiah, zeke) simplified to nebula.enable = true only, relying on the new default	2026-04-01 16:45:59 -05:00
root	792217f640	feat: add Nebula mesh network overlay ... Introduces a greg.nebula NixOS module and enables it across all managed hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16). Architecture: - linode: lighthouse + relay (public internet, UDP 4242) - genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN) - hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes pointing to genesis to reach the home LAN Changes: - modules/nixos/nebula.nix: new greg.nebula module - isLighthouse / isRelay options - unsafeRoutes option (tun.unsafe_routes) - routesSubnet option: enables IP forwarding + nftables masquerade NAT on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16 - agenix secret reference per-host (secrets/nebula/<name>.key.age) - opens UDP/4242 in the firewall - modules/nixos/default.nix: import nebula.nix - hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true - hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16" - hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix: greg.nebula.enable = true with unsafeRoutes via genesis - network.json: add nebulaIp field for each managed host - secrets/secrets.nix: declare nebula/<host>.key.age entries - secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)	2026-03-28 23:24:52 -05:00
Greg Hellings	e9a4662620	fix: open kubelet/cadvisor prometheus ports	2026-03-26 05:58:52 -05:00
Greg Hellings	ffff7e9683	Merge branch 'main' of srcpub:greg/nixos	2026-03-25 17:38:28 -05:00
root	a5719c4e02	fix: open ports 80/443 in proxy module when proxies are configured ... The greg.proxies module enables nginx but never opened the firewall, so all proxied services (Jellyfin, Grafana, etc.) were unreachable on the LAN. Add allowedTCPPorts [80 443] conditioned on the same mkIf guard as the nginx virtualHosts config.	2026-03-25 17:35:52 -05:00
Greg Hellings	7579b2b7a1	fix: Grafana network port	2026-03-25 12:24:03 -05:00
root	4eebf07f6b	fix: scope prometheus exporter firewall rules to home hosts only ... Move allowedTCPPorts for node/ping/systemd/blackbox exporters from hosts/baseline.nix (applies to ALL hosts including linode) into modules/nixos/home.nix (applies only to greg.home = true hosts). This prevents ports 9100/9115/9427/9558 from being opened on linode, which is internet-facing. All LAN hosts set greg.home = true and will still get the ports opened; linode sets greg.home = false and will not.	2026-03-25 09:46:26 -05:00
Greg Hellings	0f8d15a41c	feat: Enable prowlarr	2026-03-25 06:28:27 -05:00
Greg Hellings	8e12131608	feat: Add new bookmark	2026-03-12 13:38:41 -05:00
Greg Hellings	01ce9d74da	chore: update flake lock	2026-03-10 08:46:10 -05:00
Greg Hellings	1bba9cee70	Fix hash values in kubernetes	2026-03-05 09:08:01 -06:00
Greg Hellings	d7c6f23280	chore: radarr installed	2026-03-04 10:53:12 -06:00
Greg Hellings	efc0bf09c2	chore: update helm chart setting	2026-02-19 23:48:31 -06:00
Greg Hellings	504bfcdd8f	feat: pull from nas1 directly if not connected	2026-02-18 12:38:56 -06:00
Greg Hellings	e6623250e3	fix: zeditor setting deprecation	2026-02-18 11:17:46 -06:00
Greg Hellings	5cd5a3000f	fix: update nixfmt package	2026-02-11 10:12:11 -06:00
Greg Hellings	eadec24929	fix: remove deprecated package name	2026-02-11 09:50:29 -06:00
Greg Hellings	22beae0368	fix: remove deprecated refs	2026-02-11 09:18:22 -06:00
Greg Hellings	8c86257b4b	bug: stop trying to auto-set all tailscale things	2026-02-10 15:29:06 -06:00
Greg Hellings	b9eaea9aec	feat: add kopia-ui to gui hosts	2026-02-09 23:49:11 -06:00
Greg Hellings	e6e8f7074f	fix: disable chronicles substituter	2026-02-09 23:41:30 -06:00
Greg Hellings	b487c78ea7	Tell remote builders to use their own substituters	2026-02-04 22:30:35 -06:00
Greg Hellings	02bcb351f7	Add ssh key to remote-builder	2026-01-20 11:25:44 -06:00
Greg Hellings	e174495929	Tell attic to store ALL of the things	2026-01-18 23:17:20 -06:00