chris/sneeuwvlok
chris/sneeuwvlok
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix/orome-installable #2

Open
chris wants to merge 66 commits from fix/orome-installable into main
pull from: fix/orome-installable
merge into: chris:main
Conversation 0 Commits 66 Files changed 60 +2392 -338
chris commented 2026-10-18 17:42:11 +00:00
Owner
Copy link
No description provided. 
The second sonoff stick is flashed with OpenThread RCP 2.5.3, which runs at
460800 baud without flow control. The border router defaults to 115200, so the
matter module takes the baud rate too, defaulting to what the OpenThread RCP
builds for these sticks use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Coraza wraps the response and loses the 101 of a websocket upgrade, even when it
only detects. The client gets the first frame where it expects the handshake
and gives up, which broke home assistant's frontend and app behind caddy and
every other websocket since the waf came in. An upgrade is a GET without a
body and coraza doesn't read the frames after it, so upgrades skip the waf.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mandos and tulkas failed to evaluate, jovian's steam autostart and the
plasma module both set the default session.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Plasma as desktop, hardware from a nixos-facter report, disks by label
with root on luks, and the install steps in the readme. stateVersion
follows the release it will be installed with.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Himmelblau main builds with tpm support and has the hsm pin fixes for nixos.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Logging in stays local, himmelblau is kept out of pam and only provides
the broker that apps get their tokens from.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
It was sufficient in every pam service, including sddm and login where
the password has to be typed to unlock kwallet. The todo says what to
decide before turning it back on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The readme no longer partitions by hand: disko formats the disk from
disks.nix, nixos-anywhere runs it from another machine and writes the
facter report on the way. The installer then needs no flakes and only
ssh access.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
orome's ssh host key is generated ahead of the install and comes along
with nixos-anywhere, so sops can decrypt from the first boot. orome has
its own creation rule: only the admin keys and orome can read its
secrets, and it isn't a recipient of the other machines' secrets.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Machine keys are derived from their ssh host key. ulmo's file wasn't
encrypted to the admin key before, and ulmo_2 belonged to no machine
anymore, so it is no longer a recipient.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A networkmanager profile for the router's wireguard server, with the key
from sops. A dispatcher script brings it up on any network other than the
home wifi once there is full connectivity, and down again at home.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The keys are trusted for root and every user snowfall creates. ulmo keeps
its own authorized_keys next to it, sshd reads both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Connections to a host are shared, so a deploy needs a single touch of the
yubikey.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every machine pulls, with --max-jobs 0: what ulmo didn't build means no
update that day, nothing is ever built locally. manwe wakes itself for it,
switches and suspends again when it was the timer that woke it. orome and
tulkas install for the next boot and say so on the desktop.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Steam asks steamos-update whether an update waits for a reboot. Jovian's
stub only said so for a new kernel, this also does for a generation that
becomes active with the next boot. Compared against the running system,
so machines that switch don't keep asking for a reboot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every machine in the flake gets a host block, as root, and every host key
that is in the repo goes into known_hosts. ulmo's public key is the real
one, the .pub file on ulmo itself is out of date.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ulmo's host key was chris' personal ssh key, which stays his personal key.
The new host key is in ulmo's secrets, its readme says how to switch ulmo
over. Until then ulmo's secrets are encrypted to both keys, so the running
config keeps decrypting them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The key itself is configured, so the private key can come from bitwarden's
agent, which SSH_AUTH_SOCK now points at. git-lfs is installed instead of
only configured, and the GITHUB_TOKEN from agenix is gone, this repo has no
agenix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The servers come from nixpkgs, roslyn and bicep get an explicit path because
their extensions never look in PATH.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Element instead of signal, thunderbird with the work account, git with the
work address and my own on my own forges, podman, the azure, aws, bicep,
opentofu, dapr and github clis, go, openspec, dbeaver, bruno, studio, the
voyager, and printing and scanning without drivers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AWS's own .deb (6.2.0, electron with a rust daemon) left as it is, run in
an fhs env with the /opt, /sbin/ip and resolvectl it expects. Its daemon
runs as a system service like the unit in the .deb, dns goes through
systemd-resolved. NetworkManager's openvpn can't do these endpoints, the
saml response is far longer than openvpn allows as password.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The 11 servers, converted to dbeaver's data-sources.json and its
credentials file (usernames, no passwords), are in orome's secrets: they
name customer hosts. They are put in place once, when dbeaver has no
connections yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The extensions install themselves through policy, still removable. The
readme says how to bring their settings and the open tabs and tab groups
over in a bundle.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The cleaned up aws config (one sso session for menicon's accounts) is a
secret, linked to ~/.aws/config. The readme says what to bring over of the
ssh keys, claude code and copilot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
It is the only one of the extensions with managed storage, the others keep
their settings in the profile, which the readme brings over.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Encrypted for orome and the admin key like secrets.yml, sops-nix decrypts
it on orome. It holds bitwarden's vault key, so it can't sit in the cloud
in the clear. uBlock's storage stays out, it is mostly its cache, its own
backup file comes along instead. The secret only exists while the file
does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
One folder of skills, linked into both. Their settings are merged into the
files both write themselves, so the declared values win and their own
changes stay. llm-council was the same skill as council-of-five under
another name, and rubber-duck called copilot with -m, which doesn't exist.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Panels, editing, typescript-language-server before vtsls, omnisharp next to
roslyn, and the AGENTS.md with the commit message rules. The assistant is no
longer turned off. The keys were under bindings in the settings, which zed
doesn't read, they are a keymap now. The nu extension is gone, there is no
nushell. Theme and fonts stay with stylix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Europe/Amsterdam, english with dutch formats, plain us, compressed swap in
memory since there is no swap partition, and bolt to authorize docks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Schedules like the nightly build and the updates run in local time now. The
tpm unlock for orome is parked, with a todo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A secureBoot option in the boot module: lanzaboote (pinned to v1.2.0) boots
through systemd-boot in place of grub, makes its own keys on the first boot
and has systemd-boot enroll them, with microsoft's for option roms, once the
firmware is in setup mode. The initrd runs systemd, so orome's luks device
can be unlocked by the tpm, enrolled on pcr 7 after secure boot is on. The
readme has the steps in the firmware.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The backup asks a headless helium on the real profile for it, the same
request uBlock's own backup button makes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The whole system, nix store included, is in the initrd, so there is
nothing left to find after it starts, which is what tripped ventoy up with
the iso. Root trusts the personal key, nixos-anywhere connects to
root@installer.local without a password. No desktop, no nixpkgs source,
no zfs or nixos-rebuild (python), and only the newest firmware of the
common laptop wifi chips: 492 MB instead of 800. Boots in under a minute
under uefi in qemu. It replaces the install iso, which logged in with a
password.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Checks the installer's host key with the one on its screen, brings the
machine's host key from its secrets, asks for the disk passphrase, has
nixos-facter write and commits the hardware report, sets passwords and
reboots. nixos-anywhere and gum are in the devshell.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chris' password is a hash orome sets when it creates the user, the disk
passphrase is read by the install only. The recipe checks both before
it reaches the installer, it no longer asks for anything but the host key
fingerprint and whether to wipe. mkpasswd is in the devshell.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Three layers: general rules (who I am, how I work, an index of the
project knowledge with the always-on Menicon rules) and per-repo
conventions as rules that load every session, and project knowledge
(Menicon, Amarth, Streamarr) that the index points to and is read when
working on it. In secrets since they name clients and their accounts.
Claude's own auto memory stays writable next to them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- install: keep the host key's closing newline, and check it against the .pub before wiping
- himmelblau: also keep it out of sshd's pam, the module adds that on its own
- caddy: only real websocket upgrades skip the waf, not any request with an Upgrade header
- update: after a timer wake, wait up to two minutes for ulmo's cache before updating

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/orome-installable:fix/orome-installable
git switch fix/orome-installable

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff fix/orome-installable
git switch fix/orome-installable
git rebase main
git switch main
git merge --ff-only fix/orome-installable
git switch fix/orome-installable
git rebase main
git switch main
git merge --no-ff fix/orome-installable
git switch main
git merge --squash fix/orome-installable
git switch main
git merge --ff-only fix/orome-installable
git switch main
git merge fix/orome-installable
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
chris/sneeuwvlok!2
No description provided.