nixos-config/machines/enzo/default.nix, branch kusanagi-ollama-lan-firewall

common: parameterize LAN discovery interface

2026-08-04T22:05:42Z

Let the shared LAN discovery module use each host's Wi-Fi interface instead of assuming kusanagi's wlp8s0 everywhere. Set kusanagi to wlp8s0 and enzo to wlp1s0. Reuse the same setting for kusanagi's Ollama LAN firewall rule so the service opening stays tied to the declared LAN interface. Assisted-by: OpenAI:gpt-5

common: share LAN discovery settings

2026-08-04T21:58:39Z

Move ping and Avahi/mDNS configuration into a shared LAN discovery module so kusanagi and enzo both publish their .local names, resolve each other on the LAN, and answer ping. Keep mDNS scoped to the shared Wi-Fi interface instead of using Avahi's global firewall helper. Assisted-by: OpenAI:gpt-5

enzo: enable mDNS resolution for *.local LAN names

2026-08-04T21:49:01Z

Kusanagi already advertises its hostname via Avahi, but enzo had no multicast DNS resolver configured so kusanagi.local never resolved from the laptop. Add avahi with nssmdns4 so the NSS host lookup chain delegates to mDNS before giving up. Assisted-by: pi-coding-agent:gpt-5.2 (cherry picked from commit beb8eedfb712fd31c456096a2426d92cb3a7fcff)

profiles: extract shared sandbox profile for enzo + kusanagi

2026-08-04T03:12:32Z

Move the yokai agent-sandbox account (user, ikai group, /srv/git drop dir, scoped sudo de-escalation, and the local-clones workflow docs) out of machines/enzo into a shared profiles/sandbox.nix that both machines import. The only per-machine value is the human owner allowed to drop into the sandbox, exposed as a `sandbox.owner` string option so the profile stays username-agnostic (enzo: hwebs, kusanagi: henz). kusanagi gains the sandbox it didn't have before; enzo's inline block collapses to one setting. Assisted-by: claude-code:claude-opus-4-8

enzo: add yokai sandbox user for coding agents

2026-08-04T00:44:07Z

Add a bare `yokai` user (primary group `ikai`) for running coding agents under a separate UID, isolated from hwebs's files and secrets. yokai has no privileged group memberships and its own $HOME. - systemd.tmpfiles creates /srv/git (2770 root:ikai) as a drop dir for the agent's local clones, outside ~ so /home/hwebs stays a sealed 700. - security.sudo lets hwebs drop to yokai without a password (de-escalation only, scoped to runAs=yokai; root stays gated). - hwebs joins the ikai group. Extensive comments document the local-clones model: yokai owns its clone, hwebs never runs git inside it, and commits are exchanged by fetching (or via bundles) and landed on main with squash/rebase/interactive + signing. Assisted-by: claude-code:claude-opus-4-8

migration away from x-clip

2026-08-03T18:01:21Z

- replace x-clip with wl-clipboard for wayland machines - add TODOs I noticed while editing Assisted-by: Claude Code:claude-opus-4-8

enzo: add dev profile

2026-08-03T18:01:21Z

Assisted-by: Claude:Opus-4.8

(enzo) set up password system

2026-07-31T12:35:44Z

enzo/kusanagi: idle suspend via swayidle

2026-07-31T03:47:58Z

Bare niri has no power daemon watching for inactivity, so neither box slept on its own. Add a user swayidle service bound to graphical-session.target that fires after 15 min of no input: - enzo: suspend-then-hibernate (matches the existing lid-switch policy) - kusanagi: plain suspend-to-RAM, plus Wake-on-LAN on enp9s0 so it can be woken remotely while the Kavita/Immich/Ollama/NFS servers sleep Assisted-by: Claude:claude-opus-4-8

refactor: shared desktop profile for enzo + kusanagi

2026-07-31T00:14:09Z

profiles/desktop.nix becomes a username-agnostic shared base (niri, dconf, the dark-theme portal fix, greetd, pipewire base, gpg agent, graphics, Firefox with blank-home/no-bookmarks prefs, common desktop tools, font base). Both hosts now import it. Per-host desktop config splits into machines//desktop.nix: - enzo: Adwaita cursor + monospace, HiDPI console font, yambar, hwebs groups. - kusanagi (new file): GNOME/X11, printing/avahi/udisks2, pro-audio (rtkit/jack/32-bit), gpg ssh support, richer fonts, Bibata cursor, henz desktop groups, waybar/nm-applet. Shared profile is username-agnostic (enzo=hwebs, kusanagi=henz): shared desktop tools moved to environment.systemPackages, per-user groups stay in machine files. Firefox now owned by the shared profile, so its redundant enable is dropped from profiles/apps.nix. Dark theme + Firefox tweaks now apply to both hosts. Both configurations build. Assisted-by: Claude:claude-opus-4-8