nixos

beatzaplenty/nixos

Archived

Fork 0

Commit Graph

Select branches

Hide Pull Requests

add-backup-admin-key-script

add-claude-builder-key

feature/ha-docker-swarm

fix-duplicate-host-self-match

fix-nix-cache-probe-retry

fix-proxmox-remote-build-bootstrap

fix-stale-docs

fix-stale-wording

fix-sync-host-keys-clan-vars

fix/static-ips

main

refactor/secrets

remove-deploy-status-from-readme

server-boot-fix

worktree-baremetal-emergency-access

worktree-baremetal-esp-unmount

worktree-beszel-tailscale-router

worktree-claude-md-pve-guardrails

worktree-clone-pve1-to-pve-test

worktree-crispy-churning-kernighan

worktree-docker-gui-fix

worktree-docker-ipa-group

worktree-docs-beszel-guide

worktree-fix-container-dns-search-domain

worktree-fix-duplicate-host-check-exitcode

worktree-fix-lxc-docker-nfs-mounts

worktree-fix-nix-cache-host-key

worktree-fix-pxe-netboot-hang

worktree-fix-tailscale-host-dir

worktree-fix-zfs-install-export

worktree-fizzy-juggling-sedgewick

worktree-flake-e2e-audit

worktree-full-sweep

worktree-functional-mapping-russell

worktree-gentle-cuddling-hippo

worktree-gui-wifi-module

worktree-ha-file-server-test

worktree-ha-resize-disk

worktree-harmonic-jingling-bee

worktree-ipa-client-module

worktree-ipa-common-config

worktree-ipa-lxc-kerberos-fix

worktree-lovely-spinning-bubble

worktree-maintenance-script-changed-files-only

worktree-migrate-vm-script

worktree-nix-cache-502-fix

worktree-nix-cache-client-script

worktree-nix-cache-lxc-migration

worktree-parallel-host-eval

worktree-parsed-mapping-raven

worktree-partitioned-swimming-pizza

worktree-peaceful-stirring-noodle

worktree-phase0-provision-ordering-fix

worktree-polished-wandering-toast

worktree-proxmox-remote-build

worktree-push-host-keys

worktree-pve1-nix-cache-builder

worktree-pxe-menu-rename-and-minimal

worktree-reactive-gliding-map

worktree-refactor-scripts-shared-lib

worktree-reflective-puzzling-frog

worktree-rippling-riding-snail

worktree-rotate-admin-key-script

worktree-scripts-dedup

worktree-starry-painting-whistle

worktree-tailscale-exit-node

worktree-tailscale-subnet-router-rename

worktree-tor-relay-beszel

worktree-warm-discovering-moon

worktree-zesty-wishing-knuth

#1

#10

#100

#101

#102

#103

#104

#105

#106

#107

#108

#11

#12

#13

#14

#15

#16

#17

#18

#19

#2

#20

#21

#22

#23

#24

#25

#26

#27

#28

#29

#3

#30

#31

#32

#33

#34

#35

#36

#37

#38

#39

#4

#40

#41

#42

#43

#44

#45

#46

#47

#48

#49

#5

#50

#51

#52

#53

#54

#55

#56

#57

#58

#59

#6

#60

#61

#62

#63

#64

#65

#66

#67

#68

#69

#7

#70

#71

#72

#73

#74

#75

#76

#77

#78

#79

#8

#80

#81

#82

#83

#84

#85

#86

#87

#88

#89

#9

#90

#91

#92

#93

#94

#95

#96

#97

#98

#99

2741451642 fix(deploy): remove sudo from docker commands; fix grep false-positive on inactive feature/ha-docker-swarm beatzaplentyandClaude Sonnet 4.6 2026-07-30 20:11:58 +10:00
9f1fed26c2 secrets(ha-docker): refresh sops host-key registrations for new VM instances beatzaplenty 2026-07-30 20:01:48 +10:00
3b6ac30946 fix(deploy): use PROXMOX_REMOTE_REPO_DIR for remote repo path in phase 3.5 beatzaplentyandClaude Sonnet 4.6 2026-07-30 19:43:21 +10:00
cee33aa2d8 secrets(ha-docker): add clan SSH host keys and re-encrypt common secrets beatzaplentyandClaude Sonnet 4.6 2026-07-30 19:34:57 +10:00
ac9099a1f2 secrets(ha-docker): add IPA keytabs for ha-docker-1 and ha-docker-2 beatzaplenty 2026-07-30 19:34:40 +10:00
c96752e5d0 Add Docker Swarm HA cluster: ha-docker-1 and ha-docker-2 beatzaplentyandClaude Sonnet 4.6 2026-07-30 19:01:17 +10:00
43314b6aa3 added gitea app secret beatzaplenty 2026-07-30 17:49:57 +10:00
db84a0bcc1 Add Gitea read-only token to nix access-tokens for private repo rebuilds beatzaplenty 2026-07-30 17:47:22 +10:00
419b0f706b updated flake URL beatzaplenty 2026-07-30 17:39:22 +10:00
89e1c5dc9a Fix netbootMinimalSystem: set stateVersion and forceImportRoot beatzaplenty 2026-07-30 17:36:00 +10:00
77db51a88f Fix formatting in pxe-boot host.nix beatzaplenty 2026-07-30 17:28:37 +10:00
ad0b4a14e6 Fix codex-maintenance.sh path prefix when run from mono-repo subtree beatzaplenty 2026-07-30 17:27:48 +10:00
c9dbb03e31 Merge commit 'e812169e521abeccf3903c0ab6ac00538de8b9dc' as 'nixos' beatzaplenty 2026-07-30 17:07:01 +10:00
b6ed0c6007 Remove nixos scaffold placeholder to allow git subtree add beatzaplenty 2026-07-30 17:06:30 +10:00
78fdf3d94c Update network topology: Tailscale routing and DNS proxy, remove Pi-hole beatzaplentyandClaude Sonnet 4.6 2026-07-30 07:10:03 +10:00
f85c65870f Initial infrastructure mono-repo scaffold beatzaplentyandClaude Sonnet 4.6 2026-07-30 07:07:47 +10:00
97c9353fa8 Merge pull request 'refactor: full repo sweep — variables, docs, and comment cleanup' (#108) from worktree-reflective-puzzling-frog into main main beatzaplenty 2026-07-29 20:29:33 +00:00
cded77919d refactor: full repo sweep — variables, docs, and comment cleanup worktree-reflective-puzzling-frog beatzaplentyandClaude Sonnet 4.6 2026-07-30 06:28:52 +10:00
71381ad990 update default editor beatzaplenty 2026-07-30 05:32:23 +10:00
857c81f64a updated beszel key beatzaplenty 2026-07-29 21:33:48 +10:00
334ffbda09 updated beszel token beatzaplenty 2026-07-29 21:27:16 +10:00
620a344d78 feat(pxe-boot): switch NFS mount to HA cluster LAN VIP beatzaplentyandClaude Sonnet 4.6 2026-07-29 20:53:46 +10:00
24e5c9fe0c feat: decommission server.sweet.home beatzaplentyandClaude Sonnet 4.6 2026-07-29 20:46:19 +10:00
4ed2db906a feat(docker): switch NFS mounts to HA cluster storage VIP beatzaplentyandClaude Sonnet 4.6 2026-07-29 20:27:15 +10:00
944af9597d docs(dns): document DNS zone layout for all three networks beatzaplentyandClaude Sonnet 4.6 2026-07-29 20:12:25 +10:00
4f0b07031d fix(ha): add NFS port check on storage VIP in health.sh beatzaplentyandClaude Sonnet 4.6 2026-07-29 19:09:27 +10:00
8c86144694 docs(ha): update docs to reflect implemented network segmentation beatzaplentyandClaude Sonnet 4.6 2026-07-29 19:04:42 +10:00
3c28d48bc7 feat(ha): add NFS exports on storage-client network (VLAN 20) beatzaplentyandClaude Sonnet 4.6 2026-07-29 18:55:25 +10:00
e9a4913069 fix(ha): split health.sh VIP check into LAN (NFS) and storage (iSCSI) beatzaplentyandClaude Sonnet 4.6 2026-07-29 18:33:34 +10:00
bf4836efac refactor(ha): renumber cluster→VLAN10, storage→VLAN20; iSCSI/NFS protocol separation beatzaplentyandClaude Sonnet 4.6 2026-07-29 18:19:07 +10:00
5eea38d3ca fix(flake): fix /etc/flake-target on ha-server-{1,2} so Switch-nix alias works beatzaplentyandClaude Sonnet 4.6 2026-07-29 16:25:51 +10:00
6f38ad67e0 feat(ha): add dual VIP — retain 192.168.2.229 LAN alongside 192.168.5.229 storage beatzaplentyandClaude Sonnet 4.6 2026-07-29 16:18:45 +10:00
8d43b7039c feat(ha): add vmbr2 storage-client network and corosync ring1 beatzaplentyandClaude Sonnet 4.6 2026-07-29 16:02:53 +10:00
8e58226d2b docs(ha): add network segmentation audit report beatzaplentyandClaude Sonnet 4.6 2026-07-29 15:38:21 +10:00
a5fb0404e2 Merge pull request 'fix(gc-hosts): filter discovered guests against flake to exclude non-NixOS hosts' (#107) from worktree-crispy-churning-kernighan into main beatzaplenty 2026-07-29 04:08:05 +00:00
4ba9b141fe fix(gc-hosts): filter discovered guests against flake to exclude non-NixOS hosts worktree-crispy-churning-kernighan beatzaplentyandClaude Sonnet 4.6 2026-07-29 14:06:17 +10:00
f3c2965f78 Merge pull request 'fix(gc-hosts): use pct/qm list output directly as hostnames' (#106) from worktree-crispy-churning-kernighan into main beatzaplenty 2026-07-29 04:02:50 +00:00
b9d3b51028 Merge pull request 'fix(ha): resolve data disk device via by-id symlink even in dry-run' (#105) from worktree-partitioned-swimming-pizza into main beatzaplenty 2026-07-29 04:01:49 +00:00
539bdf9833 fix(ha): resolve data disk device via by-id symlink even in dry-run worktree-partitioned-swimming-pizza beatzaplentyandClaude Sonnet 4.6 2026-07-29 13:58:53 +10:00
a5308a7ee5 fix(gc-hosts): use pct/qm list output directly as hostnames beatzaplentyandClaude Sonnet 4.6 2026-07-29 13:58:45 +10:00
dc6c37ed2e Merge pull request 'fix(ha): prefix qm commands with sudo for non-root Proxmox SSH user' (#104) from worktree-partitioned-swimming-pizza into main beatzaplenty 2026-07-29 03:55:28 +00:00
b5e61d62bd Merge pull request 'fix(gc-hosts): fix pve1 PATH and discovery sudo prompts' (#103) from worktree-crispy-churning-kernighan into main beatzaplenty 2026-07-29 03:53:50 +00:00
ced1657407 fix(ha): prefix qm commands with sudo for non-root Proxmox SSH user beatzaplentyandClaude Sonnet 4.6 2026-07-29 13:53:41 +10:00
7b4794211d fix(gc-hosts): fix pve1 PATH and discovery sudo prompts beatzaplentyandClaude Sonnet 4.6 2026-07-29 13:53:02 +10:00
fdf41c659c Merge pull request 'Worktree crispy churning kernighan' (#102) from worktree-crispy-churning-kernighan into main beatzaplenty 2026-07-29 03:46:05 +00:00
0ef8259225 fix(gc-hosts): source nix-daemon profile on pve1 before running gc beatzaplentyandClaude Sonnet 4.6 2026-07-29 13:45:48 +10:00
629c1457a9 refactor(gc-hosts): discover running pve1 guests dynamically each run beatzaplentyandClaude Sonnet 4.6 2026-07-29 13:44:26 +10:00
7ba603c005 Merge pull request 'feat(scripts): add gc-hosts.sh for parallel nix gc across all live hosts' (#101) from worktree-crispy-churning-kernighan into main beatzaplenty 2026-07-29 03:36:09 +00:00
decf3ddff9 feat(scripts): add gc-hosts.sh for parallel nix gc across all live hosts beatzaplentyandClaude Sonnet 4.6 2026-07-29 13:35:24 +10:00
4490dfab7d Merge pull request 'feat(nix-cache): authorize pve1's wayne key as remote builder client' (#100) from worktree-pve1-nix-cache-builder into main beatzaplenty 2026-07-29 03:16:53 +00:00
fa163b613d feat(nix-cache): authorize pve1's wayne key as remote builder client worktree-pve1-nix-cache-builder beatzaplentyandClaude Sonnet 4.6 2026-07-29 13:16:30 +10:00
15bc5bd369 Merge branch 'main' of https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos beatzaplenty 2026-07-29 13:02:03 +10:00
5a4fbbf7ad enable beszel agent beatzaplenty 2026-07-29 13:01:53 +10:00
e720bbb018 Merge pull request 'fix(nfs): mask rpc-svcgssd on server and ha-server build types' (#99) from worktree-docs-beszel-guide into main beatzaplenty 2026-07-29 02:54:12 +00:00
40cdf724b4 fix(nfs): mask rpc-svcgssd on server and ha-server build types worktree-docs-beszel-guide beatzaplentyandClaude Sonnet 4.6 2026-07-29 12:51:50 +10:00
aaa193645b Merge pull request 'refactor(beszel): move KEY and TOKEN fully into enable-agent.nix' (#98) from worktree-docs-beszel-guide into main beatzaplenty 2026-07-29 02:38:19 +00:00
f22ff7db79 refactor(beszel): move KEY and TOKEN fully into enable-agent.nix beatzaplentyandClaude Sonnet 4.6 2026-07-29 12:37:54 +10:00
0da3c3070f updated flake.lock and added beszel agent environment beatzaplenty 2026-07-29 12:18:38 +10:00
e1551feefd enabled beszel-agent beatzaplenty 2026-07-29 12:14:49 +10:00
b4bc30cb2c chore(secrets): remove per-host beszel-token secrets beatzaplentyandClaude Sonnet 4.6 2026-07-29 12:00:38 +10:00
5c8d55bd78 Merge branch 'main' of https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos beatzaplenty 2026-07-29 11:50:44 +10:00
999c9a3151 add beszel universal token beatzaplenty 2026-07-29 11:50:01 +10:00
1e0fff1b26 Merge pull request 'refactor(beszel): switch to universal token via secrets/common.yaml' (#97) from worktree-docs-beszel-guide into main beatzaplenty 2026-07-29 01:47:15 +00:00
24c6469f10 refactor(beszel): switch to universal token via secrets/common.yaml beatzaplentyandClaude Sonnet 4.6 2026-07-29 10:58:15 +10:00
c9458ac8a6 Merge pull request 'docs: add beszel agent setup guide' (#96) from worktree-docs-beszel-guide into main beatzaplenty 2026-07-29 00:41:22 +00:00
99ba0ed52b docs: add beszel agent setup guide beatzaplentyandClaude Sonnet 4.6 2026-07-29 10:41:03 +10:00
1e4072029e update rmote-builder keys beatzaplenty 2026-07-29 10:39:53 +10:00
46649fc7e0 update remote-builder client keys beatzaplenty 2026-07-29 10:29:40 +10:00
4cbcc3beb9 updated .gitignore and change default editor in home.nix beatzaplenty 2026-07-29 10:17:37 +10:00
35f696ccd5 Merge pull request 'feat(ha): add resize-data-disk.sh for online data disk expansion' (#95) from worktree-ha-resize-disk into main beatzaplenty 2026-07-29 00:01:49 +00:00
e18b605706 feat(ha): add resize-data-disk.sh for online data disk expansion worktree-ha-resize-disk beatzaplentyandClaude Sonnet 4.6 2026-07-29 09:59:39 +10:00
ee2451d87c remove stray pihole backup beatzaplenty 2026-07-29 09:50:50 +10:00
71a6c4738c fix(ha): fix crm_mon active-node detection in all three scripts beatzaplentyandClaude Sonnet 4.6 2026-07-29 02:36:22 +10:00
793a2b5924 feat(ha): add failover.sh and health.sh operator scripts beatzaplentyandClaude Sonnet 4.6 2026-07-29 02:23:47 +10:00
98b5429fb9 secrets(ha): encrypt corosync authkey generated by cluster-init beatzaplenty 2026-07-29 02:04:51 +10:00
f658bdbabc fix(ha/cluster-init): enable Pacemaker maintenance-mode during DRBD sync beatzaplentyandClaude Sonnet 4.6 2026-07-29 01:49:15 +10:00
d7e63cd80e fix(ha/cluster-init): fix DRBD metadata skip condition and StandAlone grace period beatzaplentyandClaude Sonnet 4.6 2026-07-29 01:45:03 +10:00
b88ea49880 fix(ha/cluster-init): keep Pacemaker in standby until DRBD sync completes beatzaplentyandClaude Sonnet 4.6 2026-07-29 01:41:15 +10:00
c7268ade8e fix(ha/cluster-init): detect StandAlone DRBD state in sync wait loop beatzaplentyandClaude Sonnet 4.6 2026-07-29 01:29:04 +10:00
367158548e fix(ha): wrap crm-fence-peer.sh to set PATH for kernel UMH callout beatzaplentyandClaude Sonnet 4.6 2026-07-29 01:22:46 +10:00
585126beee secrets(ha): encrypt corosync authkey generated by cluster-init beatzaplenty 2026-07-29 01:11:23 +10:00
ceb491b18d fix(ha/cluster-init): drop TTY detection, always use \r for sync progress beatzaplentyandClaude Sonnet 4.6 2026-07-29 00:55:31 +10:00
6d16eaff89 fix(ha/cluster-init): fix /proc/drbd sync progress parsing and TTY display beatzaplentyandClaude Sonnet 4.6 2026-07-29 00:51:35 +10:00
e085d4707c fix(ha): add DRBD sync progress indicator and pre-flight sync gate beatzaplentyandClaude Sonnet 4.6 2026-07-29 00:46:57 +10:00
c8d4440787 secrets(ha): encrypt corosync authkey generated by cluster-init beatzaplenty 2026-07-29 00:40:11 +10:00
e7531b276e fix(ha): use crm_mon for Active node detection and add cleanup before VIP wait beatzaplentyandClaude Sonnet 4.6 2026-07-29 00:24:47 +10:00
49a10d7cc5 secrets(ha): encrypt corosync authkey generated by cluster-init beatzaplenty 2026-07-29 00:16:51 +10:00
ead4f55805 fix(ha): use stable by-id disk path for DRBD instead of /dev/sd* beatzaplentyandClaude Sonnet 4.6 2026-07-29 00:11:13 +10:00
cac5ec45cc secrets(ha): encrypt corosync authkey generated by cluster-init beatzaplenty 2026-07-29 00:02:48 +10:00
ec90753a09 fix(ha): per-node DRBD disk assignment (NODE2 data disk is /dev/sda not /dev/sdb) beatzaplentyandClaude Sonnet 4.6 2026-07-28 23:57:07 +10:00
df1ddee735 secrets(ha): encrypt corosync authkey generated by cluster-init beatzaplenty 2026-07-28 23:48:23 +10:00
8e8261be31 fix(ha/cluster-init): drop bash -c wrapper for NODE2 drbdmeta calls beatzaplentyandClaude Sonnet 4.6 2026-07-28 23:42:36 +10:00
5e9541741f secrets(ha): encrypt corosync authkey generated by cluster-init beatzaplenty 2026-07-28 23:30:12 +10:00
07543d7d56 fix(ha/cluster-init): add drbdmeta to PATH and remove openssl dependency beatzaplentyandClaude Sonnet 4.6 2026-07-28 23:24:01 +10:00
a7c4a24fc3 fix(ha): use drbdmeta --force directly; fix T4 grep-c arithmetic bug beatzaplentyandClaude Sonnet 4.6 2026-07-28 23:09:06 +10:00
a98955a8da secrets(ha): encrypt corosync authkey generated by cluster-init beatzaplenty 2026-07-28 23:08:32 +10:00
7d60741e73 secrets(ha): encrypt corosync authkey generated by cluster-init beatzaplenty 2026-07-28 23:00:18 +10:00
427be2b287 secrets(ha): refresh sops host-key registrations for new VM instances beatzaplenty 2026-07-28 22:55:02 +10:00
684351b89b fix(ha): pre-seed SSH host key in disko image; fix DRBD init race beatzaplentyandClaude Sonnet 4.6 2026-07-28 22:51:29 +10:00
327ff0b44d secrets(ha): encrypt corosync authkey generated by cluster-init beatzaplenty 2026-07-28 22:27:29 +10:00

1 2 3 4 5 ...