beatzaplenty and Claude Sonnet 5
2f7831aea8
Migrate live secrets to sops-nix (Milestone 2)
...
Check NixOS configurations / eval-hosts (push) Failing after 11m5s
Audited the working tree and full git history for committed secrets
(gitleaks + trufflehog + manual grep, see secrets-inventory.md, kept
local/gitignored per the spec). Found: a password hash shared by root
and the nixos user across every host, two live Beszel monitoring
tokens, and a GitHub fine-grained PAT embedded in a home-manager
nix.conf.
Migrates all of them to sops-nix:
- .sops.yaml + secrets/*.yaml, encrypted for admin + the age keys
derived (via ssh-to-age) from each live host's existing SSH host
key — no new key material transferred to any machine.
- users.users.{root,nixos}.hashedPasswordFile replaces the inline
hashedPassword shared by every target.
- The GitHub PAT moves from a home-manager-managed, store-visible
nix.conf to a sops.templates-rendered file included via nix.conf's
native !include, system-wide instead of per-user.
- Beszel TOKEN moves from `environment` (store-visible) to
`environmentFile` (runtime-only via sops.templates); the dead
commented-out docker token is removed from the tree entirely.
Added a tracked pre-commit hook (gitleaks protect --staged, wired via
core.hooksPath) so a secret can't be committed by accident again, and
documented the sops workflow in README.md.
Structural verification only: all 17 flake targets evaluate, and
`nix build --dry-run --no-link` succeeds for the three currently
deployed hosts. Per CLAUDE.md, actual `nixos-rebuild switch` — the
step that confirms secrets decrypt and services start on a real
machine — is left for manual verification.
Git history still contains the original plaintext secrets; scrubbing
history (Milestone 3) and rotating every credential (Milestone 4) are
separate, deliberately gated steps per remove-sensetive-info-refactor.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com >
2026-07-19 12:46:39 +10:00
beatzaplenty and Claude Sonnet 5
c05e3a3821
Refactor flake targets into platform x build-type matrix
...
Check NixOS configurations / eval-hosts (push) Failing after 12m2s
Generates all nixosConfigurations from mkTarget(platform, buildType,
hostPath) instead of hand-written per-host blocks, so adding a new
platform or build type is a one-line addition. Per-machine identity
(hostname, hostId, secrets, stateVersion) moves into hosts/<name>/host.nix;
platform-specific config (hardware, boot, networking) into
modules/platforms/*.nix; build-type config (minimal/server/docker/gui/
nix-cache/pxe-boot) into modules/build-types/*.nix.
Old flat targets (nixos, docker, server, nix-cache, nix-minimal, pxe-boot)
are replaced by the 17-target <platform>-<buildtype> matrix; each new
target was verified to evaluate before its old counterpart was removed.
CI workflows and docs/aliases now discover hosts dynamically via
nixosConfigurations attrNames and /etc/flake-target instead of hardcoded
lists, so they can't drift from flake.nix again.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com >
2026-07-19 12:03:33 +10:00
beatzaplenty and Claude Sonnet 5
0b090cab07
Sync host lists with flake.nix and add CLAUDE.md
...
Check NixOS configurations / eval-hosts (push) Successful in 34m44s
Remove the nonexistent kuma host and add the missing linode-minimal
host across README, AGENTS.md, docs, and CI eval workflows so they
match flake.nix's nixosConfigurations. Also add CLAUDE.md with
architecture/safety guidance for future Claude Code sessions.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com >
2026-07-19 09:48:05 +10:00
beatzaplenty
14accceb02
updated to efi boot and resolved module paths
Check NixOS configurations / eval-hosts (push) Failing after 25m24s
2026-07-19 06:27:22 +10:00
beatzaplenty
90baa168d1
remove swap label
Check NixOS configurations / eval-hosts (push) Failing after 14m52s
2026-07-18 08:14:39 +10:00
beatzaplenty
d3ae41a031
updated to efi boot
Check NixOS configurations / eval-hosts (push) Failing after 14m57s
2026-07-18 07:52:30 +10:00
beatzaplenty
a3230128b2
updated proxmox disko configuration
Check NixOS configurations / eval-hosts (push) Failing after 17m51s
2026-07-18 05:54:32 +10:00
beatzaplenty
1395fdaccc
removed fileSystems definition for disko config
Check NixOS configurations / eval-hosts (push) Failing after 23m22s
2026-07-17 11:42:29 +10:00
beatzaplenty
8259e57191
update configuration
Check NixOS configurations / eval-hosts (push) Failing after 14m28s
2026-07-17 09:18:24 +10:00
beatzaplenty
9d42450c65
update grub config
Check NixOS configurations / eval-hosts (push) Failing after 14m19s
2026-07-15 13:23:09 +10:00
beatzaplenty
add9a29908
disabled disko module
Check NixOS configurations / eval-hosts (push) Failing after 14m41s
2026-07-15 13:10:09 +10:00
beatzaplenty
13b0c028a1
updated mounts
Check NixOS configurations / eval-hosts (push) Failing after 14m18s
2026-07-15 12:59:08 +10:00
beatzaplenty
fdc4ea4596
updated mounts
Check NixOS configurations / eval-hosts (push) Failing after 14m26s
2026-07-15 12:57:45 +10:00
beatzaplenty
c2c86f0854
disabled disko in linode-minimal
Check NixOS configurations / eval-hosts (push) Failing after 14m31s
2026-07-15 12:47:35 +10:00
beatzaplenty
40b68c2e16
updated bios partition definition
Check NixOS configurations / eval-hosts (push) Failing after 14m33s
2026-07-15 11:44:03 +10:00
beatzaplenty
2ea39994f8
remove grub mount point
Check NixOS configurations / eval-hosts (push) Failing after 14m54s
2026-07-15 11:29:52 +10:00
beatzaplenty
331246a1cb
remove bios type
Check NixOS configurations / eval-hosts (push) Failing after 18m43s
2026-07-15 11:25:25 +10:00
beatzaplenty
442e7986f2
added bios partition
Check NixOS configurations / eval-hosts (push) Failing after 14m28s
2026-07-15 11:22:21 +10:00
beatzaplenty
6064c69d3b
removed duplicate boot entry
Check NixOS configurations / eval-hosts (push) Failing after 15m0s
2026-07-15 11:08:50 +10:00
beatzaplenty
56a2f3ff51
add boot loader path
Check NixOS configurations / eval-hosts (push) Failing after 15m4s
2026-07-15 11:05:12 +10:00
beatzaplenty
a29efce29e
remove file systems. they are defined in disko
Check NixOS configurations / eval-hosts (push) Failing after 14m22s
2026-07-15 10:29:10 +10:00
beatzaplenty
8e8183e371
updated disko config
Check NixOS configurations / eval-hosts (push) Failing after 14m40s
2026-07-15 09:59:37 +10:00
beatzaplenty
4c53cce35c
update linode host folder name to linode-minimal
Check NixOS configurations / eval-hosts (push) Failing after 14m21s
2026-07-15 09:38:12 +10:00
beatzaplenty
dea6bfec25
add linode disko config
2026-07-15 09:36:04 +10:00
beatzaplenty
04de84d03b
updated flake
Check NixOS configurations / eval-hosts (push) Failing after 14m52s
2026-07-15 09:28:33 +10:00
beatzaplenty
7bfe8cb0b2
added disko configuration to remove disk formatting from auto installer
Check NixOS configurations / eval-hosts (push) Failing after 14m31s
2026-07-15 07:30:32 +10:00
beatzaplenty
8460eff2de
Merge branch 'main' of https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos
Check NixOS configurations / eval-hosts (push) Failing after 14m21s
2026-07-14 20:52:05 +10:00
beatzaplenty
bcfeb08b11
update hardware config
2026-07-14 20:50:21 +10:00
beatzaplenty
783bda00c1
Update hosts/nix-minimal/configuration.nix
Check NixOS configurations / eval-hosts (push) Failing after 15m52s
2026-07-13 14:07:57 +00:00
beatzaplenty
e3ac63aefa
update module path
Check NixOS configurations / eval-hosts (push) Failing after 14m47s
2026-07-13 19:49:45 +10:00
beatzaplenty
4f1aff9a16
updated flake.lock
Check NixOS configurations / eval-hosts (push) Failing after 14m51s
2026-07-13 19:44:35 +10:00
beatzaplenty
befab7f3c6
revert
Check NixOS configurations / eval-hosts (push) Failing after 15m29s
2026-07-13 19:22:10 +10:00
beatzaplenty
b9610dbc9d
update module path
Check NixOS configurations / eval-hosts (push) Failing after 15m0s
2026-07-13 19:19:39 +10:00
beatzaplenty
b605d19870
update disko path
Check NixOS configurations / eval-hosts (push) Failing after 15m18s
2026-07-13 19:17:43 +10:00
beatzaplenty
679dfd80c0
added disko configuration
Check NixOS configurations / eval-hosts (push) Failing after 14m45s
2026-07-13 19:10:21 +10:00
beatzaplenty
298f615929
create linode flake
Check NixOS configurations / eval-hosts (push) Failing after 15m13s
2026-07-13 17:46:12 +10:00
beatzaplenty
5e17baba72
update common home path
Check NixOS configurations / eval-hosts (push) Failing after 15m15s
2026-07-13 16:07:17 +10:00
beatzaplenty
345b5ca657
moved common into modules
Check NixOS configurations / eval-hosts (push) Failing after 18m43s
2026-07-13 16:03:48 +10:00
beatzaplenty
2c4fe8af2b
remove hardware configuration
Check NixOS configurations / eval-hosts (push) Failing after 15m18s
2026-07-13 15:50:24 +10:00
beatzaplenty
c128bff2bf
change path
Check NixOS configurations / eval-hosts (push) Failing after 18m45s
2026-07-13 14:29:29 +10:00
beatzaplenty
8aff9fff29
fix syntax
Check NixOS configurations / eval-hosts (push) Failing after 16m50s
2026-07-13 14:10:38 +10:00
beatzaplenty
8f468d5703
enable beszel agent debugging
Check NixOS configurations / eval-hosts (push) Failing after 14m58s
2026-07-13 14:09:33 +10:00
beatzaplenty
690ecb1eb0
update path
Check NixOS configurations / eval-hosts (push) Failing after 14m32s
2026-07-13 14:04:36 +10:00
beatzaplenty
1ed1b388f5
change paths
Check NixOS configurations / eval-hosts (push) Failing after 14m25s
2026-07-13 13:57:37 +10:00
beatzaplenty
f338843166
update extra filesystems
Check NixOS configurations / eval-hosts (push) Failing after 15m4s
2026-07-13 13:49:58 +10:00
beatzaplenty
1c1f65560c
update path
Check NixOS configurations / eval-hosts (push) Failing after 14m40s
2026-07-13 13:44:50 +10:00
beatzaplenty
258ebfe1bf
fix syntax
Check NixOS configurations / eval-hosts (push) Failing after 14m51s
2026-07-13 13:37:59 +10:00
beatzaplenty
45cb9c38e8
added extra filesystems
Check NixOS configurations / eval-hosts (push) Failing after 14m56s
2026-07-13 13:36:36 +10:00
beatzaplenty
b481324c7d
remove commented lines
Check NixOS configurations / eval-hosts (push) Failing after 14m36s
2026-07-13 13:23:42 +10:00
beatzaplenty
d5467e9a5b
remove raspi docker data mount
Check NixOS configurations / eval-hosts (push) Failing after 6m18s
2026-07-13 12:48:14 +10:00
beatzaplenty
c3c467bb41
permit root login
Check NixOS configurations / eval-hosts (push) Failing after 14m40s
2026-07-13 12:39:58 +10:00
beatzaplenty
80eff2c050
fix path
Check NixOS configurations / eval-hosts (push) Failing after 15m4s
2026-07-13 12:15:00 +10:00
beatzaplenty
1cff38be43
add docker backup share
Check NixOS configurations / eval-hosts (push) Failing after 18m8s
2026-07-13 12:12:58 +10:00
beatzaplenty
960548c2ac
added raspi-backup share
Check NixOS configurations / eval-hosts (push) Failing after 11m30s
2026-07-13 11:44:45 +10:00
beatzaplenty
229cd06f73
updated server configuration
Check NixOS configurations / eval-hosts (push) Failing after 14m23s
2026-07-13 05:55:40 +10:00
beatzaplenty
6e332a6bbd
add boot include to zfs mount module
Check NixOS configurations / eval-hosts (push) Failing after 14m47s
2026-07-13 03:33:09 +10:00
beatzaplenty
fe3041c06c
fix path typo
Check NixOS configurations / eval-hosts (push) Failing after 14m21s
2026-07-13 02:56:20 +10:00
beatzaplenty
591731e3b8
modularized locale settings
Check NixOS configurations / eval-hosts (push) Failing after 14m33s
2026-07-13 02:43:08 +10:00
beatzaplenty
5da5401e91
remove commented lines
2026-07-13 02:26:46 +10:00
beatzaplenty
aca46255f8
add pkgs
Check NixOS configurations / eval-hosts (push) Failing after 14m27s
2026-07-13 02:16:05 +10:00
beatzaplenty
f85559bb18
fix syntax
Check NixOS configurations / eval-hosts (push) Failing after 14m34s
2026-07-13 02:14:49 +10:00
beatzaplenty
07534e64fc
fix syntax
2026-07-13 02:14:21 +10:00
beatzaplenty
54cefce90a
removed port from firewall
Check NixOS configurations / eval-hosts (push) Failing after 13m55s
2026-07-13 02:05:13 +10:00
beatzaplenty
fcb8f5e01e
modularized rpcbind enable and added to server config
Check NixOS configurations / eval-hosts (push) Failing after 13m58s
2026-07-13 02:00:55 +10:00
beatzaplenty
985d4e4bfa
updated module paths
Check NixOS configurations / eval-hosts (push) Failing after 13m53s
2026-07-13 01:53:32 +10:00
beatzaplenty
9462d80ccc
updated flake.lock
Check NixOS configurations / eval-hosts (push) Failing after 14m11s
2026-07-13 01:45:44 +10:00
beatzaplenty
14deedc12d
fix typo
Check NixOS configurations / eval-hosts (push) Failing after 14m27s
2026-07-13 01:44:05 +10:00
beatzaplenty
893a7c997c
clean up commented lines
Check NixOS configurations / eval-hosts (push) Failing after 14m12s
2026-07-13 01:42:28 +10:00
beatzaplenty
d068195fbe
removed let statement
Check NixOS configurations / eval-hosts (push) Failing after 23m55s
2026-07-13 01:34:19 +10:00
beatzaplenty
51fba54d94
modularized docker health to gotify service
Check NixOS configurations / eval-hosts (push) Failing after 22m52s
2026-07-13 01:29:45 +10:00
beatzaplenty
f541688973
modularized nextcloud cron job
Check NixOS configurations / eval-hosts (push) Failing after 1h15m54s
2026-07-13 01:25:16 +10:00
beatzaplenty
3bb2b83370
modularized raspi mount
Check NixOS configurations / eval-hosts (push) Failing after 47m52s
2026-07-13 01:12:43 +10:00
beatzaplenty
8ff22175e5
update log path
Check NixOS configurations / eval-hosts (push) Failing after 47m59s
2026-07-13 01:09:34 +10:00
beatzaplenty
bc719afe39
modularized traefik log rotatation config
Check NixOS configurations / eval-hosts (push) Failing after 53m51s
2026-07-13 01:05:44 +10:00
beatzaplenty
20dc28069c
update path
Check NixOS configurations / eval-hosts (push) Failing after 14m8s
2026-07-13 01:00:03 +10:00
beatzaplenty
28ae709100
updated module directory structure
Check NixOS configurations / eval-hosts (push) Failing after 22m19s
2026-07-13 00:56:19 +10:00
beatzaplenty
3de625309e
enable tailscale module
Check NixOS configurations / eval-hosts (push) Failing after 17m2s
2026-07-13 00:46:07 +10:00
beatzaplenty
f2744bf3a7
modularized tailscale service
Check NixOS configurations / eval-hosts (push) Failing after 40m6s
2026-07-13 00:44:29 +10:00
beatzaplenty
5b118b05da
move docker system packages to docker-service module
Check NixOS configurations / eval-hosts (push) Successful in 39m34s
2026-07-13 00:36:52 +10:00
beatzaplenty
f139333980
added pkgs include
Check NixOS configurations / eval-hosts (push) Successful in 38m27s
2026-07-13 00:32:06 +10:00
beatzaplenty
5d5428014a
modularized docker service
Check NixOS configurations / eval-hosts (push) Failing after 23m17s
2026-07-13 00:30:10 +10:00
beatzaplenty
529a518cd1
removed promotheus exporter
Check NixOS configurations / eval-hosts (push) Successful in 33m35s
2026-07-12 19:09:46 +10:00
beatzaplenty
dc714b41c1
added beszel agent
Check NixOS configurations / eval-hosts (push) Successful in 33m19s
2026-07-12 18:21:03 +10:00
beatzaplenty
c470737316
added beszel agent
Check NixOS configurations / eval-hosts (push) Failing after 6m31s
2026-07-12 18:08:44 +10:00
beatzaplenty
8266f43980
added beszel port to firewall
Check NixOS configurations / eval-hosts (push) Failing after 27m37s
2026-07-12 17:07:42 +10:00
beatzaplenty
474d243649
remove beszel agent from docker and create module
Check NixOS configurations / eval-hosts (push) Failing after 2m12s
2026-07-12 15:48:18 +10:00
beatzaplenty
019afb5609
add semi colons
Check NixOS configurations / eval-hosts (push) Failing after 6m36s
2026-07-10 08:01:58 +10:00
beatzaplenty
63062cdda5
fix nix syntax
Check NixOS configurations / eval-hosts (push) Failing after 6m50s
2026-07-10 08:00:37 +10:00
beatzaplenty
8f5599a1c6
syntax change
Check NixOS configurations / eval-hosts (push) Failing after 6m55s
2026-07-10 07:56:16 +10:00
beatzaplenty
416b7196c2
updated beszel syntax
Check NixOS configurations / eval-hosts (push) Failing after 6m43s
2026-07-10 07:51:54 +10:00
beatzaplenty
0bdadcc772
added beszel agent
Check NixOS configurations / eval-hosts (push) Failing after 6m56s
2026-07-10 07:40:26 +10:00
beatzaplenty
aa08bf60b9
removed tailscale
Check NixOS configurations / eval-hosts (push) Failing after 6m52s
2026-07-08 13:24:43 +10:00
beatzaplenty
99ad7501bb
added new public key for server
Check NixOS configurations / eval-hosts (push) Failing after 6m54s
2026-07-08 13:09:28 +10:00
beatzaplenty
6c973e2300
typo
Check NixOS configurations / eval-hosts (push) Failing after 6m58s
2026-07-08 13:00:26 +10:00
beatzaplenty
eb2d3e3260
added tailscale exit node module and enabled on server
Check NixOS configurations / eval-hosts (push) Failing after 6m55s
2026-07-08 12:48:52 +10:00
beatzaplenty
f9c0f01aba
updated /mnt/docker permissions
Check NixOS configurations / eval-hosts (push) Successful in 42m36s
2026-07-07 03:31:19 +10:00
beatzaplenty
83481b5291
updated NFS shares and deleted individual share modules
Check NixOS configurations / eval-hosts (push) Failing after 14m29s
2026-07-07 03:09:56 +10:00
beatzaplenty
a553958bb9
remove prune task
2026-07-07 00:28:15 +10:00
beatzaplenty
d16b22d2b5
removed --force from docker prune service command
2026-07-07 00:20:10 +10:00
beatzaplenty
3900d617fa
added test share
Check NixOS configurations / eval-hosts (push) Failing after 3h2m9s
2026-07-07 00:03:22 +10:00
beatzaplentyandClaude Sonnet 5