nixos-config/machines/enzo, branch kusanagi-ollama-lan-firewallmy nixos setuphttps://git.hwebs.info/nixos-config/atom?h=kusanagi-ollama-lan-firewall2026-08-04T22:05:42Zcommon: parameterize LAN discovery interface2026-08-04T22:05:42Zyokaiaccounts.8ef6c@simplelogin.com2026-08-04T22:05:42Zurn:sha1:a7adbd5063fe7ab428d8174cb9b31bec2c6133d6
Let the shared LAN discovery module use each host's Wi-Fi interface instead of assuming kusanagi's wlp8s0 everywhere. Set kusanagi to wlp8s0 and enzo to wlp1s0.
Reuse the same setting for kusanagi's Ollama LAN firewall rule so the service opening stays tied to the declared LAN interface.
Assisted-by: OpenAI:gpt-5
common: share LAN discovery settings2026-08-04T21:58:39Zyokaiaccounts.8ef6c@simplelogin.com2026-08-04T21:58:39Zurn:sha1:b47ca1475decf1a98f10231f0cbeebfb75e7f6ea
Move ping and Avahi/mDNS configuration into a shared LAN discovery module so kusanagi and enzo both publish their .local names, resolve each other on the LAN, and answer ping.
Keep mDNS scoped to the shared Wi-Fi interface instead of using Avahi's global firewall helper.
Assisted-by: OpenAI:gpt-5
enzo: enable mDNS resolution for *.local LAN names2026-08-04T21:49:01ZHenry J. Websterhwebs@hwebs.info2026-08-04T21:38:36Zurn:sha1:b9fd1ff561be58fa9d0fa03180a1a239e47550b5
Kusanagi already advertises its hostname via Avahi, but enzo had no
multicast DNS resolver configured so kusanagi.local never resolved from
the laptop. Add avahi with nssmdns4 so the NSS host lookup chain
delegates to mDNS before giving up.
Assisted-by: pi-coding-agent:gpt-5.2
(cherry picked from commit beb8eedfb712fd31c456096a2426d92cb3a7fcff)
profiles: extract shared sandbox profile for enzo + kusanagi2026-08-04T03:12:32ZHenry J. Websterhwebs@hwebs.info2026-08-04T03:00:49Zurn:sha1:3df910d75fa98a7d0291e6b8c6889905c6088f64
Move the yokai agent-sandbox account (user, ikai group, /srv/git drop dir,
scoped sudo de-escalation, and the local-clones workflow docs) out of
machines/enzo into a shared profiles/sandbox.nix that both machines import.
The only per-machine value is the human owner allowed to drop into the
sandbox, exposed as a `sandbox.owner` string option so the profile stays
username-agnostic (enzo: hwebs, kusanagi: henz). kusanagi gains the sandbox
it didn't have before; enzo's inline block collapses to one setting.
Assisted-by: claude-code:claude-opus-4-8
enzo: add yokai sandbox user for coding agents2026-08-04T00:44:07ZHenry J. Websterhwebs@hwebs.info2026-08-04T00:44:07Zurn:sha1:e9b9671d238bb3de779c0dbf4a518b41280be778
Add a bare `yokai` user (primary group `ikai`) for running coding agents
under a separate UID, isolated from hwebs's files and secrets. yokai has
no privileged group memberships and its own $HOME.
- systemd.tmpfiles creates /srv/git (2770 root:ikai) as a drop dir for the
agent's local clones, outside ~ so /home/hwebs stays a sealed 700.
- security.sudo lets hwebs drop to yokai without a password (de-escalation
only, scoped to runAs=yokai; root stays gated).
- hwebs joins the ikai group.
Extensive comments document the local-clones model: yokai owns its clone,
hwebs never runs git inside it, and commits are exchanged by fetching (or
via bundles) and landed on main with squash/rebase/interactive + signing.
Assisted-by: claude-code:claude-opus-4-8
enzo/yambar: add niri + jq to service PATH2026-08-03T22:32:56ZHenry J. Websterhwebs@hwebs.info2026-08-03T22:32:56Zurn:sha1:66be8debbf34b82a735b17c09ff400d30d8a48f1
The new yambar niri-workspaces.sh script runs `niri msg --json` piped to
jq, and the workspace on-clicks run `niri msg action focus-workspace`.
yambar spawns these via execvp with no shell, so both binaries must be on
the service PATH alongside the existing libnotify/wireplumber.
Assisted-by: Claude Code:claude-opus-4-8
migration away from x-clip2026-08-03T18:01:21ZHenry J. Websterhwebs@hwebs.info2026-08-03T17:59:24Zurn:sha1:9ca21e94b8ade285e749d54441c7d9115da5b522
- replace x-clip with wl-clipboard for wayland machines
- add TODOs I noticed while editing
Assisted-by: Claude Code:claude-opus-4-8
enzo: add dev profile2026-08-03T18:01:21ZHenry J. Websterhwebs@hwebs.info2026-08-01T15:27:09Zurn:sha1:cf5470e00e559b91c9905eff22c4def6ba52baa0
Assisted-by: Claude:Opus-4.8
yambar: add notify-send/wpctl to service PATH2026-08-03T18:01:21ZHenry J. Websterhwebs@hwebs.info2026-07-31T21:31:18Zurn:sha1:720e66715a22cf5c278dfaf03da0cb927c8a2c7a
yambar runs on-click commands via execvp with no shell, so the binaries
must be on the systemd service PATH. Since the bar moved from a niri spawn
(full login PATH) to a user service (minimal PATH), every on-click failed
with ENOENT. Add libnotify (notify-send) and wireplumber (wpctl).
Assisted-by: Claude Code:claude-opus-4-8
desktop: centralize Adwaita cursor theme, fix pointer cursor on kusanagi2026-08-01T14:57:40ZHenry J. Websterhwebs@hwebs.info2026-08-01T14:57:40Zurn:sha1:726ef32d2631f15f991591ef6879925e08f442f6
kusanagi set XCURSOR_THEME=Bibata-Modern-Classic but never declared the
theme in Nix — it only resolved while bibata-cursors lingered in an old
nix-env profile. Once that was gone the theme fell off the icon path and
the pointer/hand cursor disappeared.
Standardize both hosts on Adwaita (matching the shared niri config.kdl):
move XCURSOR_THEME/XCURSOR_SIZE and the adwaita-icon-theme package into
the shared profiles/desktop.nix so the theme is always on the icon path.
Drop the inert HYPRCURSOR_* vars (hyprcursor is unused under niri).
Assisted-by: Claude:claude-opus-4-8