root
792217f640
feat: add Nebula mesh network overlay
...
buildbot/nix-eval Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-exodus Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-isaiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-genesis Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-linode Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-jeremiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-zeke Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-hosea Build done.
buildbot/nix-build Build done.
Introduces a greg.nebula NixOS module and enables it across all managed
hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16).
Architecture:
- linode: lighthouse + relay (public internet, UDP 4242)
- genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN)
- hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes
pointing to genesis to reach the home LAN
Changes:
- modules/nixos/nebula.nix: new greg.nebula module
- isLighthouse / isRelay options
- unsafeRoutes option (tun.unsafe_routes)
- routesSubnet option: enables IP forwarding + nftables masquerade NAT
on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16
- agenix secret reference per-host (secrets/nebula/<name>.key.age)
- opens UDP/4242 in the firewall
- modules/nixos/default.nix: import nebula.nix
- hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true
- hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16"
- hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix:
greg.nebula.enable = true with unsafeRoutes via genesis
- network.json: add nebulaIp field for each managed host
- secrets/secrets.nix: declare nebula/<host>.key.age entries
- secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)
2026-03-28 23:24:52 -05:00
Greg Hellings
e9a4662620
fix: open kubelet/cadvisor prometheus ports
buildbot/nix-eval Build done. (1 warning)
buildbot/nix-build Build done.
buildbot/nix-effects Build done.
2026-03-26 05:58:52 -05:00
Greg Hellings
ffff7e9683
Merge branch 'main' of srcpub:greg/nixos
buildbot/nix-eval Build done. (1 warning)
buildbot/nix-build Build done.
buildbot/nix-effects Build done.
2026-03-25 17:38:28 -05:00
root
a5719c4e02
fix: open ports 80/443 in proxy module when proxies are configured
...
buildbot/nix-eval Build done. (1 warning)
buildbot/nix-build Build done.
The greg.proxies module enables nginx but never opened the firewall,
so all proxied services (Jellyfin, Grafana, etc.) were unreachable
on the LAN. Add allowedTCPPorts [80 443] conditioned on the same
mkIf guard as the nginx virtualHosts config.
2026-03-25 17:35:52 -05:00
Greg Hellings
7579b2b7a1
fix: Grafana network port
2026-03-25 12:24:03 -05:00
root
4eebf07f6b
fix: scope prometheus exporter firewall rules to home hosts only
...
buildbot/nix-eval Build done.
Move allowedTCPPorts for node/ping/systemd/blackbox exporters from
hosts/baseline.nix (applies to ALL hosts including linode) into
modules/nixos/home.nix (applies only to greg.home = true hosts).
This prevents ports 9100/9115/9427/9558 from being opened on linode,
which is internet-facing. All LAN hosts set greg.home = true and will
still get the ports opened; linode sets greg.home = false and will not.
2026-03-25 09:46:26 -05:00
Greg Hellings
0f8d15a41c
feat: Enable prowlarr
buildbot/nix-eval Build done. (1 warning)
buildbot/nix-build Build done.
buildbot/nix-effects Build done.
2026-03-25 06:28:27 -05:00
Greg Hellings
8e12131608
feat: Add new bookmark
buildbot/nix-eval Build done. (1 warning)
buildbot/nix-build Build done.
buildbot/nix-effects Build done.
2026-03-12 13:38:41 -05:00
Greg Hellings
01ce9d74da
chore: update flake lock
buildbot/nix-eval Build done.
buildbot/nix-build Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux Build done.
buildbot/nix-build gitea:greg/nixos#checks.aarch64-darwin Build done.
buildbot/nix-build gitea:greg/nixos#checks.aarch64-linux Build done.
2026-03-10 08:46:10 -05:00
Greg Hellings
1bba9cee70
Fix hash values in kubernetes
2026-03-05 09:08:01 -06:00
Greg Hellings
d7c6f23280
chore: radarr installed
2026-03-04 10:53:12 -06:00
Greg Hellings
efc0bf09c2
chore: update helm chart setting
buildbot/nix-eval Build done. (1 warning)
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-zeke Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-upgrade-pg-cluster Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-linode Build done.
buildbot/nix-build Build done.
2026-02-19 23:48:31 -06:00
Greg Hellings
504bfcdd8f
feat: pull from nas1 directly if not connected
buildbot/nix-eval Build done.
2026-02-18 12:38:56 -06:00
Greg Hellings
e6623250e3
fix: zeditor setting deprecation
2026-02-18 11:17:46 -06:00
Greg Hellings
5cd5a3000f
fix: update nixfmt package
buildbot/nix-eval Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-linode Build done.
buildbot/nix-build Build done.
2026-02-11 10:12:11 -06:00
Greg Hellings
eadec24929
fix: remove deprecated package name
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-setup-ssh Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-isaiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-linode Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-jeremiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-genesis Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-hosea Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-vm-gitlab Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-zeke Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-exodus Build done.
buildbot/nix-build Build done.
buildbot/nix-eval Build done. (4 warnings)
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-linode Build done.
2026-02-11 09:50:29 -06:00
Greg Hellings
22beae0368
fix: remove deprecated refs
2026-02-11 09:18:22 -06:00
Greg Hellings
8c86257b4b
bug: stop trying to auto-set all tailscale things
2026-02-10 15:29:06 -06:00
Greg Hellings
b9eaea9aec
feat: add kopia-ui to gui hosts
2026-02-09 23:49:11 -06:00
Greg Hellings
e6e8f7074f
fix: disable chronicles substituter
2026-02-09 23:41:30 -06:00
Greg Hellings
b487c78ea7
Tell remote builders to use their own substituters
buildbot/nix-eval Build done.
buildbot/nix-build Build done.
buildbot/nix-effects Build done.
2026-02-04 22:30:35 -06:00
Greg Hellings
02bcb351f7
Add ssh key to remote-builder
buildbot/nix-eval Build done.
buildbot/nix-build Build done.
buildbot/nix-effects Build done.
2026-01-20 11:25:44 -06:00
Greg Hellings
e174495929
Tell attic to store ALL of the things
buildbot/nix-eval Build started.
2026-01-18 23:17:20 -06:00
Greg Hellings
51db6a4c18
Add bookmark for NixOS tests
buildbot/nix-eval Build done.
buildbot/nix-build Build done.
buildbot/nix-effects Build done.
2026-01-08 23:24:03 -06:00
Greg Hellings
d5a3723a6f
Simplify tailscale autoconnect
2025-12-28 21:18:34 -06:00
Greg Hellings
ac35cd8a5c
Avoid old, bad hostnames
2025-12-28 20:03:04 -06:00
Greg Hellings
f3436504df
Fix Exodus build machine connections
2025-12-25 22:53:55 -06:00
Greg Hellings
beb22dc1dc
Package updates and fixes
2025-12-25 17:16:16 -06:00
Greg Hellings
44ea82fe2c
Remove btc and use Albyhub
2025-12-23 18:13:25 -06:00
Greg Hellings
36526b4562
Simplify nixpkgs eval
2025-12-18 10:51:09 -06:00
Greg Hellings
7f82dbebb7
Add greg to remote buiders auth keys
2025-12-17 23:10:54 -06:00
Greg Hellings
c012384a89
Fix warnings for system
2025-12-16 19:47:40 -06:00
Greg Hellings
553957c35e
Move more data into metadata
2025-12-16 16:48:11 -06:00
Greg Hellings
1a528f10de
Simplify nixpkgs eval
2025-12-16 09:07:55 -06:00
Greg Hellings
854aed86e0
Updates to Flakes and Zeke
...
Add /dev/sda1 to Zeke
Update Flakes
Add initial colmena support
Add colmena to shells
Update kubernetes pins
2025-12-15 22:18:29 -06:00
Greg Hellings
8964529f1a
Reduce amount of inputs
2025-12-07 17:53:31 -06:00
Greg Hellings
01e6aa22d5
Simplify evaluations a bit
2025-12-07 17:50:55 -06:00
Greg Hellings
d9e4ba93ac
Fix formatting
2025-12-07 00:15:26 -06:00
Greg Hellings
337accaeeb
Enable buildbot-nix
2025-12-06 23:17:00 -06:00
Greg Hellings
5ad3fcf90d
Disable gitlab-runners
2025-12-04 09:24:08 -06:00
Greg Hellings
4f9a2732bc
Add Gitea to my infra
2025-12-04 00:45:46 -06:00
Greg Hellings
b2b4162715
zed-editor-fhs cannot open /etc/nixos
2025-12-03 08:15:50 -06:00
Greg Hellings
e0dec7de16
Update hash for tailscale-operator
2025-12-03 05:23:27 -06:00
Greg Hellings
98d188bf0b
Use DHCP across the board
2025-12-02 21:34:13 -06:00
Greg Hellings
d0163c4dd7
Add gnupg agent to baseline and Zed to FHS
2025-12-02 15:05:46 -06:00
Greg Hellings
4620265ead
Add Uptime Kuma to Kubernetes
2025-11-27 01:20:09 -06:00
Greg Hellings
5dc90c13d5
Add Smokeping to monitoring
2025-11-26 20:44:43 -06:00
Greg Hellings
893db983e0
Fix broken auto-deployments
2025-11-23 14:43:36 -06:00
Greg Hellings
572419b8d3
Enable node level monitoring
2025-11-23 01:12:20 -06:00
Greg Hellings
82acff5857
Add Prometheus scraping to Kubernetes
2025-11-22 20:15:40 -06:00
root