| Age | Commit message (Collapse) | Author |
|---|
|
Kusanagi already advertises its hostname via Avahi, but enzo had no
multicast DNS resolver configured so kusanagi.local never resolved from
the laptop. Add avahi with nssmdns4 so the NSS host lookup chain
delegates to mDNS before giving up.
Assisted-by: pi-coding-agent:gpt-5.2
(cherry picked from commit beb8eedfb712fd31c456096a2426d92cb3a7fcff)
|
|
Move the yokai agent-sandbox account (user, ikai group, /srv/git drop dir,
scoped sudo de-escalation, and the local-clones workflow docs) out of
machines/enzo into a shared profiles/sandbox.nix that both machines import.
The only per-machine value is the human owner allowed to drop into the
sandbox, exposed as a `sandbox.owner` string option so the profile stays
username-agnostic (enzo: hwebs, kusanagi: henz). kusanagi gains the sandbox
it didn't have before; enzo's inline block collapses to one setting.
Assisted-by: claude-code:claude-opus-4-8
|
|
Add a bare `yokai` user (primary group `ikai`) for running coding agents
under a separate UID, isolated from hwebs's files and secrets. yokai has
no privileged group memberships and its own $HOME.
- systemd.tmpfiles creates /srv/git (2770 root:ikai) as a drop dir for the
agent's local clones, outside ~ so /home/hwebs stays a sealed 700.
- security.sudo lets hwebs drop to yokai without a password (de-escalation
only, scoped to runAs=yokai; root stays gated).
- hwebs joins the ikai group.
Extensive comments document the local-clones model: yokai owns its clone,
hwebs never runs git inside it, and commits are exchanged by fetching (or
via bundles) and landed on main with squash/rebase/interactive + signing.
Assisted-by: claude-code:claude-opus-4-8
|
|
- replace x-clip with wl-clipboard for wayland machines
- add TODOs I noticed while editing
Assisted-by: Claude Code:claude-opus-4-8
|
|
Assisted-by: Claude:Opus-4.8
|
|
|
|
Bare niri has no power daemon watching for inactivity, so neither box
slept on its own. Add a user swayidle service bound to
graphical-session.target that fires after 15 min of no input:
- enzo: suspend-then-hibernate (matches the existing lid-switch policy)
- kusanagi: plain suspend-to-RAM, plus Wake-on-LAN on enp9s0 so it can
be woken remotely while the Kavita/Immich/Ollama/NFS servers sleep
Assisted-by: Claude:claude-opus-4-8
|
|
profiles/desktop.nix becomes a username-agnostic shared base (niri, dconf, the
dark-theme portal fix, greetd, pipewire base, gpg agent, graphics, Firefox with
blank-home/no-bookmarks prefs, common desktop tools, font base). Both hosts now
import it.
Per-host desktop config splits into machines/<host>/desktop.nix:
- enzo: Adwaita cursor + monospace, HiDPI console font, yambar, hwebs groups.
- kusanagi (new file): GNOME/X11, printing/avahi/udisks2, pro-audio
(rtkit/jack/32-bit), gpg ssh support, richer fonts, Bibata cursor, henz
desktop groups, waybar/nm-applet.
Shared profile is username-agnostic (enzo=hwebs, kusanagi=henz): shared desktop
tools moved to environment.systemPackages, per-user groups stay in machine
files. Firefox now owned by the shared profile, so its redundant enable is
dropped from profiles/apps.nix. Dark theme + Firefox tweaks now apply to both
hosts. Both configurations build.
Assisted-by: Claude:claude-opus-4-8
|
|
Load amdgpu in the initrd so the native mode is set before the console
font is applied. Previously amdgpu loaded late and reset the fbcon to the
kernel 8x16 font, leaving the greeter with the wrong tiny font while
Terminus only survived in the pre-driver LUKS prompt.
Assisted-by: Claude:claude-opus-4-8
|
|
|
|
|
|
The iwd backend renamed the interface (wlp8s0 -> wlan0), invalidated
saved NM connection profiles pinned to the old name, and hit NM<->iwd
secret hand-off failures. Drop back to the default wpa_supplicant so
existing profiles and the predictable interface name work again.
Assisted-by: Claude:claude-opus-4-8
|
|
|
|
|
|
Split the single-host config into a shared minimal base plus opt-in
profiles, and add a second machine (enzo laptop) alongside kusanagi.
- flake: add mkMachine helper; declare nixosConfigurations.kusanagi and
.enzo; add the disko input; move overlays per-machine.
- common/: minimal base only (boot, networking, tailscale, locale, nix
settings, neovim editor). Old configuration.nix/programs.nix removed.
- profiles/: coarse opt-in bundles (desktop, dev, apps). kusanagi imports
all three and stays byte-for-byte identical to the running system.
- machines/kusanagi/: all workstation-only config (ROCm, Scarlett audio,
optical-disc archiving, NAS mounts, kavita/immich/ollama); hardware
config moved here unchanged. User stays 'henz'.
- machines/enzo/: new laptop. Declarative LUKS+btrfs via disko
(LVM-on-LUKS, TPM2+PIN unlock, zram + encrypted swap for
suspend-then-hibernate); its own minimal niri desktop with
playback-only audio (no rtkit/jack); user 'hwebs'.
Assisted-by: Claude:claude-opus-4-8
|
