| Age | Commit message (Collapse) | Author |
|---|
|
Enable ICMP echo requests in the shared firewall so both kusanagi and enzo can be reached with ping without punching any additional service ports.
Assisted-by: OpenAI:gpt-5
|
|
Bind Ollama on all interfaces but open its API only on kusanagi's Wi-Fi interface, so LAN clients can reach it without relying on Tailscale exposure.
Remove the blanket tailscale0 trust from the shared firewall so tailnet traffic follows explicit host firewall rules instead of inheriting access to every listening service.
Assisted-by: OpenAI:gpt-5
|
|
Committing directly to main let it diverge from origin/main, so the next
pull became a rebase with a conflict on this very file. Recording the rule
where every harness will read it keeps main fast-forwardable.
Assisted-by: Claude:claude-opus-4-8
|
|
There is no cross-vendor standard for agent instruction files: claude-code
reads CLAUDE.md, opencode and pi read AGENTS.md, each with its own global
path. Keep one canonical file (common/AGENTS.md) in this repo, ship it to
/etc/AGENTS.md, and symlink every harness's global context path to it via
tmpfiles for all normal users:
~/.claude/CLAUDE.md (claude-code 2.1.187 — no AGENTS.md support)
~/.config/opencode/AGENTS.md (opencode 1.15.10)
~/.pi/agent/AGENTS.md (pi 0.75.4)
Paths verified against the packaged binaries; see the profile header for
details and for the per-repo convention (AGENTS.md + CLAUDE.md symlink).
Assisted-by: claude-code:Fable 5
|
|
Split the single-host config into a shared minimal base plus opt-in
profiles, and add a second machine (enzo laptop) alongside kusanagi.
- flake: add mkMachine helper; declare nixosConfigurations.kusanagi and
.enzo; add the disko input; move overlays per-machine.
- common/: minimal base only (boot, networking, tailscale, locale, nix
settings, neovim editor). Old configuration.nix/programs.nix removed.
- profiles/: coarse opt-in bundles (desktop, dev, apps). kusanagi imports
all three and stays byte-for-byte identical to the running system.
- machines/kusanagi/: all workstation-only config (ROCm, Scarlett audio,
optical-disc archiving, NAS mounts, kavita/immich/ollama); hardware
config moved here unchanged. User stays 'henz'.
- machines/enzo/: new laptop. Declarative LUKS+btrfs via disko
(LVM-on-LUKS, TPM2+PIN unlock, zram + encrypted swap for
suspend-then-hibernate); its own minimal niri desktop with
playback-only audio (no rtkit/jack); user 'hwebs'.
Assisted-by: Claude:claude-opus-4-8
|
