2025-09-12 - 2026-09-12
Overview
103 Pull requests merged by 1 user
Merged
#108 refactor: full repo sweep — variables, docs, and comment cleanup
Merged
#107 fix(gc-hosts): filter discovered guests against flake to exclude non-NixOS hosts
Merged
#106 fix(gc-hosts): use pct/qm list output directly as hostnames
Merged
#105 fix(ha): resolve data disk device via by-id symlink even in dry-run
Merged
#104 fix(ha): prefix qm commands with sudo for non-root Proxmox SSH user
Merged
#103 fix(gc-hosts): fix pve1 PATH and discovery sudo prompts
Merged
#102 Worktree crispy churning kernighan
Merged
#101 feat(scripts): add gc-hosts.sh for parallel nix gc across all live hosts
Merged
#100 feat(nix-cache): authorize pve1's wayne key as remote builder client
Merged
#99 fix(nfs): mask rpc-svcgssd on server and ha-server build types
Merged
#98 refactor(beszel): move KEY and TOKEN fully into enable-agent.nix
Merged
#97 refactor(beszel): switch to universal token via secrets/common.yaml
Merged
#96 docs: add beszel agent setup guide
Merged
#95 feat(ha): add resize-data-disk.sh for online data disk expansion
Merged
#94 feat(gui): add wayne's GUI Home Manager config matching the nixos user
Merged
#93 Worktree ha file server test
Merged
#92 fix(docker): declaratively apply groupmod --non-unique for IPA GID conflict
Merged
#91 fix(ipa): restore IPA password login via LightDM and su
Merged
#90 feat(ipa/docker): grant docker access via IPA group membership
Merged
#89 chore: full sweep — docs sync, SSH key module extraction, NFS dedup, dead code removal
Merged
#88 Worktree ipa lxc kerberos fix
Merged
#87 fix(ipa): use NOPASSWD sudo for IPA user to bypass broken PAM path
Merged
#86 fix(ipa): add wheel group to IPA user stub for sudo access
Merged
#85 Worktree ipa lxc kerberos fix
Merged
#84 fix(ipa): suppress Kerberos NFS services in LXC containers
Merged
#83 Worktree ipa common config
Merged
#82 fix(ipa): harden script and update module docs
Merged
#80 Worktree ipa client module
Merged
#79 fix(tailscale-router): stop dnsmasq from intercepting host DNS queries
Merged
#78 fix(ipa): stream keytab via sudo cat instead of scp
Merged
#77 fix(ipa): SSH as wayne with sudo instead of root on domain controller
Merged
#76 feat(ipa): add create-nixos-ipa-host-account script
Merged
#75 Worktree ipa client module
Merged
#74 feat(ipa): add reusable declarative FreeIPA client module
Merged
#73 Fix/static ips
Merged
#72 feat(beszel): add beszel agent to tailscale-router
Merged
#71 fix(tailscale-router): add MASQUERADE to POSTROUTING, not nixos-nat-post
Merged
#70 fix(tailscale-router): actually insert MASQUERADE rule via extraCommands
Merged
#69 fix(tailscale-router): masquerade LAN traffic into Tailscale
Merged
#68 feat(tailscale): enable UDP GRO forwarding on subnet router uplink
Merged
#67 fix(create-proxmox-resource): fix VM disk never attaching after import
Merged
#65 fix(common): set mutableUsers = false to fix password setup on disk images
Merged
#64 fix(create-proxmox-resource): case-insensitive importdisk parse + warn on --disk-size for VMs
Merged
#63 docs(sync-host-keys): fix stale host-keys/ references in comments and usage
Merged
#62 fix(sync-host-keys): extend --remove/--regenerate to cover clan vars
Merged
#61 Worktree phase0 provision ordering fix
Merged
#60 chore(secrets): Phase 4 — remove stale sops.yaml anchors and re-encrypt
Merged
#59 refactor(provision): Phase 3 — remove legacy host-keys/ fallback
Merged
#58 chore(vars): clan vars SSH host key for lxc-nix-cache
Merged
#57 fix(lxc): clan vars for lxc-tor-relay + sops-reinstall service fix (network.target)
Merged
#56 feat(provision): Phase 0-2 + fix — clan-core SSH host keys, activation ordering, boot-time sops
Merged
#55 fix(tailscale): rename tailscale-subnet-router to tailscale-router everywhere
Merged
#54 fix(tailscale): rename hosts/tailscale-subnet-router → hosts/tailscale-router
Merged
#53 feat(secrets): add push-host-keys.sh; integrate into sync/recover scripts
Merged
#52 refactor(tailscale): rename exit-node to subnet-router; drop --advertise-exit-node
Merged
#51 tor-relay: wire beszel-agent with token secret and fix sops key
Merged
#50 fix(lxc): prevent SSH host key deletion on every rebuild; add recovery script
Merged
#49 server: auto-create tank ZFS pool on first boot if data disk is blank
Merged
#48 feat: add nixos@nixos workstation SSH key to all hosts
Merged
#47 Worktree harmonic jingling bee
Merged
#46 Worktree harmonic jingling bee
Merged
#45 fix: don't sudo nix build in remote scripts
Merged
#44 fix: prefix Proxmox commands with sudo for non-root SSH user
Merged
#43 Unmount everything under /mnt before zpool export, not just chroot dirs
Merged
#42 Unmount leftover chroot bind mounts before zpool export
Merged
#41 Fix ZFS root import stall on baremetal-gui reboot
Merged
#40 Export ZFS root pool before rebooting from the auto-installer
Merged
#39 Prompt for a host-key path interactively as a third fallback
Merged
#38 Wrap auto-install.sh in a nix-shell shebang for its required tools
Merged
#37 Fix auto-install.sh to work standalone, not just baked into the image
Merged
#36 Worktree gui wifi module
Merged
#35 Run per-host/per-package nix eval and dry-run build concurrently
Merged
#34 Worktree gui wifi module
Merged
#33 Prestage a declarative wifi connection on the gui host
Merged
#31 Rename PXE installer menu entry, add vanilla NixOS minimal netboot entry
Merged
#30 Fix PXE netboot installer hanging at boot (ISO/netboot module conflict)
Merged
#29 Add ad hoc pve1 -> pve-test clone script (vzdump + qmrestore/pct restore)
Merged
#28 Make lxc-docker a privileged container: unprivileged can't NFS-mount at all
Merged
#26 Add pve.sweet.home guard rails to CLAUDE.md
Merged
#25 Fix NFS mount device strings on lxc-docker: use FQDN, not search domain
Merged
#24 Enable QEMU guest agent on Proxmox VMs; register lxc-gui sops key
Merged
#23 Add global DNS search domain to fix NFS mounts on lxc-docker
Merged
#21 Fix nix-cache remote-builder trust: stale host key + wrong sshKey path
Merged
#20 Authorize this box's SSH key as a nix-cache remote-builder client
Merged
#19 Worktree refactor scripts shared lib
Merged
#18 Re-encrypt secrets/nix-cache.yaml for rotated lxc-nix-cache key
Merged
#17 Add nix-cache client config script for non-NixOS Debian machines
Merged
#16 Fix proxmox remote build bootstrap
Merged
#15 Build Proxmox images directly on the node instead of transferring them
Merged
#14 Worktree fix lxc docker nfs mounts
Merged
#13 Add scripts/backup-admin-key.sh to back up the local sops admin key
Merged
#12 Deduplicate reusable shell code in scripts/ into scripts/lib/
Merged
#11 Fix tailscale exit-node module: enable routing, compose on enable-service
Merged
#10 Add scripts/rotate-admin-key.sh to automate sops admin key rotation
Merged
#9 Fix stale documentation: outdated counts, missing build type, spec status
Merged
#8 Fix duplicate-host check reporting false SSH failures
Merged
#7 Stop tracking deployment status in the README Hosts table
Merged
#6 Replace duplicate-host check with live Proxmox query; drop deployedTargets
Merged
#5 Track nix-cache real deployment as lxc-nix-cache, not proxmox-nix-cache
Merged
#4 Trust nix-cache's SSH host key declaratively on remote-builder clients
Merged
#3 Add buildImage shell function for building lxc-* tarballs with host keys
Merged
#2 Fix nix_extra_opts falsely reporting nix-cache's SSH remote builder down
Merged
#1 Fix create-proxmox-resource.sh --dry-run hiding nix-cache probe results