| Age | Commit message (Collapse) | Author |
|---|
|
laguna-xs-2.1 is large enough to nearly fill the workstation's display GPU at the previous 64k context and 1h keep-alive. That let Ollama keep a very large resident set around after requests and could destabilize the no-swap desktop session.
Unload models quicker, limit parallelism/queueing, reserve VRAM for the compositor, and cap the service cgroup so runaway requests fail before the desktop does.
Assisted-by: pi:gpt-5.5
|
|
Serve Ollama on kusanagi's Wi-Fi LAN while removing the blanket tailscale0 firewall trust so tailnet traffic follows explicit host firewall rules instead of inheriting every listening service.
Add shared LAN networking for both hosts: allow ping, publish and resolve .local names with Avahi, and scope mDNS to each machine's declared Wi-Fi interface.
Assisted-by: OpenAI:gpt-5
|
|
The 12B model at 32k context uses only 7.7 GB of the 7900 XT's 20 GB, so
there is ample VRAM headroom for 64k with the q8_0 KV cache — agentic
coding tools are context-hungry and 32k is the practical bottleneck.
The keep-alive stops the default 5-minute idle unload from adding a
reload stall to every resumed session on a single-user workstation.
Update flake to get newer packages.
Assisted-by: Claude Code:claude-fable-5
|
|
The recurring "ollama runs 100% on CPU" regressions were a boot-order
race, not a gfx-target mismatch: ollama.service only ordered after
network.target, and at boot it started between /dev/kfd and the 7900
XT's render node appearing. ollama probes GPUs once at startup, found
none, and silently fell back to CPU until the next manual restart —
which is why the previous HSA_OVERRIDE_GFX_VERSION commit "worked": the
deploy restarted the service on a long-running system, and the restart
was the actual cure.
The card is a 7900 XT (Navi 31), natively gfx1100 — verified that
discovery with no overrides finds it fine and drops only the
unsupported Raphael iGPU (gfx1036). Remove HSA_OVERRIDE_GFX_VERSION and
HIP_VISIBLE_DEVICES (ollama itself warns overriding visible devices can
break discovery).
Real fix: systemd-tag the kfd/renderD* char devices via udev (they get
no device units otherwise) and order ollama after them, so discovery
only runs once the GPU exists.
Assisted-by: claude-code:claude-fable-5
|
|
Move the yokai agent-sandbox account (user, ikai group, /srv/git drop dir,
scoped sudo de-escalation, and the local-clones workflow docs) out of
machines/enzo into a shared profiles/sandbox.nix that both machines import.
The only per-machine value is the human owner allowed to drop into the
sandbox, exposed as a `sandbox.owner` string option so the profile stays
username-agnostic (enzo: hwebs, kusanagi: henz). kusanagi gains the sandbox
it didn't have before; enzo's inline block collapses to one setting.
Assisted-by: claude-code:claude-opus-4-8
|
|
The RDNA3 card reports as gfx1101/gfx1102/gfx11-generic, which the ROCm
build bundled with ollama-rocm has no kernels for, so ollama found no
usable device and ran 100% on CPU after the nixpkgs bump. Force it to
present as gfx1100 via HSA_OVERRIDE_GFX_VERSION.
Also set OLLAMA_FLASH_ATTENTION=1 so the existing q8_0 KV cache actually
engages instead of silently falling back to f16 and inflating VRAM use.
Assisted-by: Claude-code:Opus-4.8
|
|
Add a bare `yokai` user (primary group `ikai`) for running coding agents
under a separate UID, isolated from hwebs's files and secrets. yokai has
no privileged group memberships and its own $HOME.
- systemd.tmpfiles creates /srv/git (2770 root:ikai) as a drop dir for the
agent's local clones, outside ~ so /home/hwebs stays a sealed 700.
- security.sudo lets hwebs drop to yokai without a password (de-escalation
only, scoped to runAs=yokai; root stays gated).
- hwebs joins the ikai group.
Extensive comments document the local-clones model: yokai owns its clone,
hwebs never runs git inside it, and commits are exchanged by fetching (or
via bundles) and landed on main with squash/rebase/interactive + signing.
Assisted-by: claude-code:claude-opus-4-8
|
|
The new yambar niri-workspaces.sh script runs `niri msg --json` piped to
jq, and the workspace on-clicks run `niri msg action focus-workspace`.
yambar spawns these via execvp with no shell, so both binaries must be on
the service PATH alongside the existing libnotify/wireplumber.
Assisted-by: Claude Code:claude-opus-4-8
|
|
- replace x-clip with wl-clipboard for wayland machines
- add TODOs I noticed while editing
Assisted-by: Claude Code:claude-opus-4-8
|
|
Assisted-by: Claude:Opus-4.8
|
|
yambar runs on-click commands via execvp with no shell, so the binaries
must be on the systemd service PATH. Since the bar moved from a niri spawn
(full login PATH) to a user service (minimal PATH), every on-click failed
with ENOENT. Add libnotify (notify-send) and wireplumber (wpctl).
Assisted-by: Claude Code:claude-opus-4-8
|
|
Assisted-by: Claude:Opus-4.8
|
|
kusanagi set XCURSOR_THEME=Bibata-Modern-Classic but never declared the
theme in Nix — it only resolved while bibata-cursors lingered in an old
nix-env profile. Once that was gone the theme fell off the icon path and
the pointer/hand cursor disappeared.
Standardize both hosts on Adwaita (matching the shared niri config.kdl):
move XCURSOR_THEME/XCURSOR_SIZE and the adwaita-icon-theme package into
the shared profiles/desktop.nix so the theme is always on the icon path.
Drop the inert HYPRCURSOR_* vars (hyprcursor is unused under niri).
Assisted-by: Claude:claude-opus-4-8
|
|
Move the niri bar (yambar on enzo, waybar on kusanagi) and swaybg wallpaper out
of the shared stowed niri config and into per-machine systemd user services
bound to graphical-session.target, mirroring the existing xdg-user-dirs-update
unit. This makes the bar host-correct (kusanagi previously spawned yambar, which
isn't installed there) and keeps host-specific paths out of the shared config.
Also switch the greetd session to a small wrapper script that shows a fortune
greeting in tuigreet.
Assisted-by: Claude:claude-opus-4-8
|
|
|
|
Bare niri has no power daemon watching for inactivity, so neither box
slept on its own. Add a user swayidle service bound to
graphical-session.target that fires after 15 min of no input:
- enzo: suspend-then-hibernate (matches the existing lid-switch policy)
- kusanagi: plain suspend-to-RAM, plus Wake-on-LAN on enp9s0 so it can
be woken remotely while the Kavita/Immich/Ollama/NFS servers sleep
Assisted-by: Claude:claude-opus-4-8
|
|
The GNOME desktop was only enabled for its apps, but it pulled in ibus,
whose XDG autostart fired ibus-daemon under our niri session and popped
an "IBus has been started" notification on every login. Remove
services.desktopManager.gnome (and the unused X server/GDM) and instead
install nautilus and loupe directly, enabling gvfs so Nautilus keeps
trash, network shares, and removable-media mounting.
Assisted-by: Claude:claude-opus-4-8
|
|
profiles/desktop.nix becomes a username-agnostic shared base (niri, dconf, the
dark-theme portal fix, greetd, pipewire base, gpg agent, graphics, Firefox with
blank-home/no-bookmarks prefs, common desktop tools, font base). Both hosts now
import it.
Per-host desktop config splits into machines/<host>/desktop.nix:
- enzo: Adwaita cursor + monospace, HiDPI console font, yambar, hwebs groups.
- kusanagi (new file): GNOME/X11, printing/avahi/udisks2, pro-audio
(rtkit/jack/32-bit), gpg ssh support, richer fonts, Bibata cursor, henz
desktop groups, waybar/nm-applet.
Shared profile is username-agnostic (enzo=hwebs, kusanagi=henz): shared desktop
tools moved to environment.systemPackages, per-user groups stay in machine
files. Firefox now owned by the shared profile, so its redundant enable is
dropped from profiles/apps.nix. Dark theme + Firefox tweaks now apply to both
hosts. Both configurations build.
Assisted-by: Claude:claude-opus-4-8
|
|
LibreWolf forces web content light via its fingerprinting protection even with
resistFingerprinting disabled and the portal read forced, so it never honored
the desktop dark setting. Plain Firefox honors the portal out of the box (dark
chrome and content) now that the portal serves prefer-dark via
xdg-desktop-portal-gtk.
Restore programs.firefox with the blank home/new-tab and no-bookmarks-toolbar
policy prefs; drop the LibreWolf package and its RFP/widget workarounds. No
theme prefs needed — dark comes from the portal.
Assisted-by: Claude:claude-opus-4-8
|
|
The portal now correctly reports prefer-dark, but LibreWolf content stayed
light: Firefox's default widget.use-xdg-desktop-portal.settings = 2 ("auto")
reads GTK directly under bare niri and ignores the portal. Set it to 1 (always
use the portal) so web content's prefers-color-scheme follows the color-scheme
served by xdg-desktop-portal-gtk. LibreWolf doesn't set this pref, so "default"
status suffices.
Assisted-by: Claude:claude-opus-4-8
|
|
LibreWolf chrome was dark (via GTK theme) but web content stayed light. Root
cause is the portal, not the browser: the niri module routes the Settings
interface to xdg-desktop-portal-gnome, whose color-scheme depends on
gnome-settings-daemon. Under bare niri (no GNOME session) gsd is absent, so the
portal reported "no preference" and content's prefers-color-scheme resolved
light.
Pin org.freedesktop.impl.portal.Settings to the gtk backend, which reads the
org.gnome.desktop.interface color-scheme dconf key directly (no gsd), and add
xdg-desktop-portal-gtk. The key merges into the niri module's
xdg.portal.config.niri. Now the portal reports prefer-dark and content follows.
Assisted-by: Claude:claude-opus-4-8
|
|
Setting it via the policy with Status "default" did not take effect: LibreWolf's
mozilla.cfg does defaultPref("privacy.resistFingerprinting", true), and a policy
"default" pref writes the same branch and loses the tie to the autoconfig, so
RFP stayed on — spoofing web content's prefers-color-scheme to light and
disabling the devtools toggle. Use Status "locked", which wins over defaultPref.
Assisted-by: Claude:claude-opus-4-8
|
|
Replace the programs.firefox block with LibreWolf. Since there's no
programs.librewolf module, bake the policy into the package via
librewolf.override { extraPolicies = ...; } — blank home/new-tab and no
bookmarks toolbar, merged with LibreWolf's own defaults. No profile or /etc
policy file to manage.
Handle dark mode desktop-wide instead of per-browser: set the dconf key
org/gnome/desktop/interface/color-scheme = prefer-dark, which the niri
xdg-desktop-portal (gnome/gtk) backends report to apps. Firefox/LibreWolf Auto
theme and GTK apps all go dark, so the per-browser theme prefs are gone.
LibreWolf defaults resistFingerprinting on, which spoofs web content's
prefers-color-scheme to light; disable it so pages honor the dark setting.
Assisted-by: Claude:claude-opus-4-8
|
|
The previous commit used programs.firefox.profiles, which is a Home Manager
option and does not exist in the native NixOS module — the config failed to
evaluate. Switch to programs.firefox.preferences, which the module delivers as
a Firefox enterprise policy applied to every profile.
Covers dark chrome, blank home/new-tab, and hiding the bookmarks toolbar.
Full nav/tab toolbar removal needs userChrome.css, which the native module
cannot ship.
Assisted-by: Claude:claude-opus-4-8
|
|
Dark chrome, blank home/new-tab, and toolbar removal via userChrome.css.
Assisted-by: Claude:claude-opus-4-8
|
|
XCURSOR_THEME/niri point at Adwaita but the theme wasn't installed, so
named cursor shapes (link pointer/hand) failed to load and the cursor
never changed on hover. Install adwaita-icon-theme so the theme files
exist on disk.
Assisted-by: Claude:claude-opus-4-8
|
|
|
|
|
|
Load amdgpu in the initrd so the native mode is set before the console
font is applied. Previously amdgpu loaded late and reset the fbcon to the
kernel 8x16 font, leaving the greeter with the wrong tiny font while
Terminus only survived in the pre-driver LUKS prompt.
Assisted-by: Claude:claude-opus-4-8
|
|
|
|
|
|
The iwd backend renamed the interface (wlp8s0 -> wlan0), invalidated
saved NM connection profiles pinned to the old name, and hit NM<->iwd
secret hand-off failures. Drop back to the default wpa_supplicant so
existing profiles and the predictable interface name work again.
Assisted-by: Claude:claude-opus-4-8
|
|
Install gnupg and pinentry-gnome3 and enable programs.gnupg.agent so
gpg-agent has a working pinentry from the system config (fixes 'No
pinentry' on key import). enableSSHSupport left off to avoid hijacking
the ssh-agent socket for the existing SSH key.
Assisted-by: Claude:claude-opus-4-8
|
|
Install yambar (status bar) in hwebs's package set. Set a large Terminus
console font (ter-v32n, earlySetup) so the kernel VT and tuigreet greeter
are legible on the HiDPI panel.
Assisted-by: Claude:claude-opus-4-8
|
|
|
|
|
|
Split the single-host config into a shared minimal base plus opt-in
profiles, and add a second machine (enzo laptop) alongside kusanagi.
- flake: add mkMachine helper; declare nixosConfigurations.kusanagi and
.enzo; add the disko input; move overlays per-machine.
- common/: minimal base only (boot, networking, tailscale, locale, nix
settings, neovim editor). Old configuration.nix/programs.nix removed.
- profiles/: coarse opt-in bundles (desktop, dev, apps). kusanagi imports
all three and stays byte-for-byte identical to the running system.
- machines/kusanagi/: all workstation-only config (ROCm, Scarlett audio,
optical-disc archiving, NAS mounts, kavita/immich/ollama); hardware
config moved here unchanged. User stays 'henz'.
- machines/enzo/: new laptop. Declarative LUKS+btrfs via disko
(LVM-on-LUKS, TPM2+PIN unlock, zram + encrypted swap for
suspend-then-hibernate); its own minimal niri desktop with
playback-only audio (no rtkit/jack); user 'hwebs'.
Assisted-by: Claude:claude-opus-4-8
|
