| Age | Commit message (Collapse) | Author |
|---|
|
Also remove claude-code from human user packages to fully remove
agent harnesses from the human account's path.
Assisted-by: pi:laguna-xs-2.1
|
|
Serve Ollama on kusanagi's Wi-Fi LAN while removing the blanket tailscale0 firewall trust so tailnet traffic follows explicit host firewall rules instead of inheriting every listening service.
Add shared LAN networking for both hosts: allow ping, publish and resolve .local names with Avahi, and scope mDNS to each machine's declared Wi-Fi interface.
Assisted-by: OpenAI:gpt-5
|
|
Move the yokai agent-sandbox account (user, ikai group, /srv/git drop dir,
scoped sudo de-escalation, and the local-clones workflow docs) out of
machines/enzo into a shared profiles/sandbox.nix that both machines import.
The only per-machine value is the human owner allowed to drop into the
sandbox, exposed as a `sandbox.owner` string option so the profile stays
username-agnostic (enzo: hwebs, kusanagi: henz). kusanagi gains the sandbox
it didn't have before; enzo's inline block collapses to one setting.
Assisted-by: claude-code:claude-opus-4-8
|
|
Add a bare `yokai` user (primary group `ikai`) for running coding agents
under a separate UID, isolated from hwebs's files and secrets. yokai has
no privileged group memberships and its own $HOME.
- systemd.tmpfiles creates /srv/git (2770 root:ikai) as a drop dir for the
agent's local clones, outside ~ so /home/hwebs stays a sealed 700.
- security.sudo lets hwebs drop to yokai without a password (de-escalation
only, scoped to runAs=yokai; root stays gated).
- hwebs joins the ikai group.
Extensive comments document the local-clones model: yokai owns its clone,
hwebs never runs git inside it, and commits are exchanged by fetching (or
via bundles) and landed on main with squash/rebase/interactive + signing.
Assisted-by: claude-code:claude-opus-4-8
|
|
- replace x-clip with wl-clipboard for wayland machines
- add TODOs I noticed while editing
Assisted-by: Claude Code:claude-opus-4-8
|
|
Assisted-by: Claude:Opus-4.8
|
|
|
|
Bare niri has no power daemon watching for inactivity, so neither box
slept on its own. Add a user swayidle service bound to
graphical-session.target that fires after 15 min of no input:
- enzo: suspend-then-hibernate (matches the existing lid-switch policy)
- kusanagi: plain suspend-to-RAM, plus Wake-on-LAN on enp9s0 so it can
be woken remotely while the Kavita/Immich/Ollama/NFS servers sleep
Assisted-by: Claude:claude-opus-4-8
|
|
profiles/desktop.nix becomes a username-agnostic shared base (niri, dconf, the
dark-theme portal fix, greetd, pipewire base, gpg agent, graphics, Firefox with
blank-home/no-bookmarks prefs, common desktop tools, font base). Both hosts now
import it.
Per-host desktop config splits into machines/<host>/desktop.nix:
- enzo: Adwaita cursor + monospace, HiDPI console font, yambar, hwebs groups.
- kusanagi (new file): GNOME/X11, printing/avahi/udisks2, pro-audio
(rtkit/jack/32-bit), gpg ssh support, richer fonts, Bibata cursor, henz
desktop groups, waybar/nm-applet.
Shared profile is username-agnostic (enzo=hwebs, kusanagi=henz): shared desktop
tools moved to environment.systemPackages, per-user groups stay in machine
files. Firefox now owned by the shared profile, so its redundant enable is
dropped from profiles/apps.nix. Dark theme + Firefox tweaks now apply to both
hosts. Both configurations build.
Assisted-by: Claude:claude-opus-4-8
|
|
Load amdgpu in the initrd so the native mode is set before the console
font is applied. Previously amdgpu loaded late and reset the fbcon to the
kernel 8x16 font, leaving the greeter with the wrong tiny font while
Terminus only survived in the pre-driver LUKS prompt.
Assisted-by: Claude:claude-opus-4-8
|
|
|
|
|
|
The iwd backend renamed the interface (wlp8s0 -> wlan0), invalidated
saved NM connection profiles pinned to the old name, and hit NM<->iwd
secret hand-off failures. Drop back to the default wpa_supplicant so
existing profiles and the predictable interface name work again.
Assisted-by: Claude:claude-opus-4-8
|
|
|
|
|
|
Split the single-host config into a shared minimal base plus opt-in
profiles, and add a second machine (enzo laptop) alongside kusanagi.
- flake: add mkMachine helper; declare nixosConfigurations.kusanagi and
.enzo; add the disko input; move overlays per-machine.
- common/: minimal base only (boot, networking, tailscale, locale, nix
settings, neovim editor). Old configuration.nix/programs.nix removed.
- profiles/: coarse opt-in bundles (desktop, dev, apps). kusanagi imports
all three and stays byte-for-byte identical to the running system.
- machines/kusanagi/: all workstation-only config (ROCm, Scarlett audio,
optical-disc archiving, NAS mounts, kavita/immich/ollama); hardware
config moved here unchanged. User stays 'henz'.
- machines/enzo/: new laptop. Declarative LUKS+btrfs via disko
(LVM-on-LUKS, TPM2+PIN unlock, zram + encrypted swap for
suspend-then-hibernate); its own minimal niri desktop with
playback-only audio (no rtkit/jack); user 'hwebs'.
Assisted-by: Claude:claude-opus-4-8
|
