Commit Graph

Select branches

Hide Pull Requests

add-backup-admin-key-script

add-claude-builder-key

feature/ha-docker-swarm

fix-duplicate-host-self-match

fix-nix-cache-probe-retry

fix-proxmox-remote-build-bootstrap

fix-stale-docs

fix-stale-wording

fix-sync-host-keys-clan-vars

fix/static-ips

main

refactor/secrets

remove-deploy-status-from-readme

server-boot-fix

worktree-baremetal-emergency-access

worktree-baremetal-esp-unmount

worktree-beszel-tailscale-router

worktree-claude-md-pve-guardrails

worktree-clone-pve1-to-pve-test

worktree-crispy-churning-kernighan

worktree-docker-gui-fix

worktree-docker-ipa-group

worktree-docs-beszel-guide

worktree-fix-container-dns-search-domain

worktree-fix-duplicate-host-check-exitcode

worktree-fix-lxc-docker-nfs-mounts

worktree-fix-nix-cache-host-key

worktree-fix-pxe-netboot-hang

worktree-fix-tailscale-host-dir

worktree-fix-zfs-install-export

worktree-fizzy-juggling-sedgewick

worktree-flake-e2e-audit

worktree-full-sweep

worktree-functional-mapping-russell

worktree-gentle-cuddling-hippo

worktree-gui-wifi-module

worktree-ha-file-server-test

worktree-ha-resize-disk

worktree-harmonic-jingling-bee

worktree-ipa-client-module

worktree-ipa-common-config

worktree-ipa-lxc-kerberos-fix

worktree-lovely-spinning-bubble

worktree-maintenance-script-changed-files-only

worktree-migrate-vm-script

worktree-nix-cache-502-fix

worktree-nix-cache-client-script

worktree-nix-cache-lxc-migration

worktree-parallel-host-eval

worktree-parsed-mapping-raven

worktree-partitioned-swimming-pizza

worktree-peaceful-stirring-noodle

worktree-phase0-provision-ordering-fix

worktree-polished-wandering-toast

worktree-proxmox-remote-build

worktree-push-host-keys

worktree-pve1-nix-cache-builder

worktree-pxe-menu-rename-and-minimal

worktree-reactive-gliding-map

worktree-refactor-scripts-shared-lib

worktree-reflective-puzzling-frog

worktree-rippling-riding-snail

worktree-rotate-admin-key-script

worktree-scripts-dedup

worktree-starry-painting-whistle

worktree-tailscale-exit-node

worktree-tailscale-subnet-router-rename

worktree-tor-relay-beszel

worktree-warm-discovering-moon

worktree-zesty-wishing-knuth

#1

#10

#100

#101

#102

#103

#104

#105

#106

#107

#108

#11

#12

#13

#14

#15

#16

#17

#18

#19

#2

#20

#21

#22

#23

#24

#25

#26

#27

#28

#29

#3

#30

#31

#32

#33

#34

#35

#36

#37

#38

#39

#4

#40

#41

#42

#43

#44

#45

#46

#47

#48

#49

#5

#50

#51

#52

#53

#54

#55

#56

#57

#58

#59

#6

#60

#61

#62

#63

#64

#65

#66

#67

#68

#69

#7

#70

#71

#72

#73

#74

#75

#76

#77

#78

#79

#8

#80

#81

#82

#83

#84

#85

#86

#87

#88

#89

#9

#90

#91

#92

#93

#94

#95

#96

#97

#98

#99

Mono Color

• 43b4cc6aa6 secrets(ha): regenerate IPA keytabs for ha-server-1 and ha-server-2 beatzaplenty 2026-07-28 21:54:00 +10:00
• dd984019a1 fix(ha): prevent drbd.service from starting alongside Pacemaker beatzaplentyandClaude Sonnet 4.6 2026-07-28 21:48:43 +10:00
• cb8a51b2fd updated sops keys beatzaplenty 2026-07-28 21:41:31 +10:00
• 18ab0ff254 secrets(ha): encrypt corosync authkey generated by cluster-init beatzaplenty 2026-07-28 21:19:22 +10:00
• 5c5f22f84a +x on scripts and remove beszel from ha for now beatzaplenty 2026-07-28 20:48:51 +10:00
• 094eaa752b secrets(ha): encrypt corosync authkey generated by cluster-init beatzaplenty 2026-07-28 20:35:12 +10:00
• fe9fc7364b fix(ha/cluster-init): explicitly start pacemaker after corosync restart beatzaplentyandClaude Sonnet 4.6 2026-07-28 19:47:33 +10:00
• 1ce4589830 fix(ha/deploy): remove _patch_targetctl — iscsi-target.nix now correct beatzaplentyandClaude Sonnet 4.6 2026-07-28 19:41:13 +10:00
• 7417cc1b0a Merge pull request 'feat(gui): add wayne's GUI Home Manager config matching the nixos user' (#94) from worktree-functional-mapping-russell into main beatzaplenty 2026-07-28 09:29:28 +00:00
• ec44b7955b feat(gui): add wayne's GUI Home Manager config matching the nixos user worktree-functional-mapping-russell beatzaplentyandClaude Sonnet 4.6 2026-07-28 19:28:22 +10:00
• cf3d8ea9a5 fix(sops): resolve merge conflicts in ha-server keytab files beatzaplentyandClaude Sonnet 4.6 2026-07-28 19:26:39 +10:00
• 756e45743c fix(sops): resolve merge conflict in .sops.yaml keytab recipients beatzaplentyandClaude Sonnet 4.6 2026-07-28 19:23:07 +10:00
• 7e8755d141 added ipa keytabs for ha servers beatzaplenty 2026-07-28 19:12:23 +10:00
• 8194707478 Merge pull request 'Worktree ha file server test' (#93) from worktree-ha-file-server-test into main beatzaplenty 2026-07-28 09:09:04 +00:00
• d740064a35 fix(ha): all 7 acceptance tests pass — targetctl, fencing, failover, data integrity worktree-ha-file-server-test beatzaplentyandClaude Sonnet 4.6 2026-07-28 19:03:39 +10:00
• 164d14eb87 Merge pull request 'fix(docker): declaratively apply groupmod --non-unique for IPA GID conflict' (#92) from worktree-parsed-mapping-raven into main beatzaplenty 2026-07-28 08:19:53 +00:00
• 720399b00d fix(docker): declaratively apply groupmod --non-unique for IPA GID conflict worktree-parsed-mapping-raven beatzaplentyandClaude Sonnet 4.6 2026-07-28 18:17:43 +10:00
• da4d808c6a fix(ha/cluster-init): use crm configure instead of cibadmin XML for resources beatzaplentyandClaude Sonnet 4.6 2026-07-28 17:57:49 +10:00
• 79cde50e27 fix(ha/cluster-init): use targetcli delete commands for LIO teardown beatzaplentyandClaude Sonnet 4.6 2026-07-28 17:55:26 +10:00
• d31d9fa584 fix(ha/cluster-init): fix LIO teardown, mount idempotency, VIP portal beatzaplentyandClaude Sonnet 4.6 2026-07-28 17:50:24 +10:00
• c76698efb7 fix(ha): add xfsprogs to system packages; fix cluster-init PATH and DRBD check beatzaplentyandClaude Sonnet 4.6 2026-07-28 17:43:27 +10:00
• 601db79689 Merge pull request 'fix(ipa): restore IPA password login via LightDM and su' (#91) from worktree-parsed-mapping-raven into main beatzaplenty 2026-07-28 07:31:46 +00:00
• acebbdbe26 fix(ha/deploy): use nixos+sudo instead of root SSH; temp key for inter-node comms beatzaplentyandClaude Sonnet 4.6 2026-07-28 17:30:53 +10:00
• fc8f7baf3e fix(ipa): restore IPA password login via LightDM and su beatzaplentyandClaude Sonnet 4.6 2026-07-28 17:25:37 +10:00
• 3f9b968a41 fix(ha/deploy): use non-sudo SSH for /nix writability check beatzaplentyandClaude Sonnet 4.6 2026-07-28 17:15:20 +10:00
• 1263c7540c fix(ha/deploy): ensure remote clone is on correct branch before building beatzaplentyandClaude Sonnet 4.6 2026-07-28 17:12:39 +10:00
• a8d8b1465c fix(ha/deploy): fix /nix ownership on pve1 before codex-setup beatzaplentyandClaude Sonnet 4.6 2026-07-28 17:11:05 +10:00
• b76d54e702 fix(ha): fix deploy script bugs and correct cluster configuration beatzaplentyandClaude Sonnet 4.6 2026-07-28 17:04:13 +10:00
• 59854a0229 feat(ha): implement clan vars and fully encrypt all HA secrets beatzaplentyandClaude Sonnet 4.6 2026-07-28 16:48:04 +10:00
• dc83333526 feat(ha): pre-stage IPA enrollment for ha-server-1 and ha-server-2 beatzaplentyandClaude Sonnet 4.6 2026-07-28 16:30:29 +10:00
• a960c662f0 Merge pull request 'feat(ipa/docker): grant docker access via IPA group membership' (#90) from worktree-docker-ipa-group into main beatzaplenty 2026-07-28 05:48:45 +00:00
• 6f602b2245 Merge pull request 'chore: full sweep — docs sync, SSH key module extraction, NFS dedup, dead code removal' (#89) from worktree-full-sweep into main beatzaplenty 2026-07-28 05:26:57 +00:00
• e62e9c9a6a chore: full sweep — docs sync, SSH key module extraction, NFS dedup, dead code removal worktree-full-sweep beatzaplentyandClaude Sonnet 4.6 2026-07-28 15:18:06 +10:00
• 5beed2d75c feat(ipa/docker): grant docker access via IPA group membership worktree-docker-ipa-group beatzaplentyandClaude Sonnet 4.6 2026-07-28 15:16:05 +10:00
• fe7fc55c04 feat(docker): add IPA wayne user to docker group beatzaplentyandClaude Sonnet 4.6 2026-07-28 14:07:29 +10:00
• 6cdae391f4 fix(docker): pin IPA dyndns to eth0 to prevent Docker bridge IP registration beatzaplentyandClaude Sonnet 4.6 2026-07-28 14:03:22 +10:00
• 95eb494370 Merge pull request 'Worktree ipa lxc kerberos fix' (#88) from worktree-ipa-lxc-kerberos-fix into main beatzaplenty 2026-07-28 03:39:23 +00:00
• 9294d2fd25 fix(ipa): skip home-manager-wayne service when home dir absent worktree-ipa-lxc-kerberos-fix beatzaplentyandClaude Sonnet 4.6 2026-07-28 13:38:49 +10:00
• 0fe7ddf6e8 fix(ipa): reject FQDN input in create-nixos-ipa-host-account.sh beatzaplentyandClaude Sonnet 4.6 2026-07-28 13:23:48 +10:00
• 5c2d61d35a Merge pull request 'fix(ipa): use NOPASSWD sudo for IPA user to bypass broken PAM path' (#87) from worktree-ipa-lxc-kerberos-fix into main beatzaplenty 2026-07-28 03:16:03 +00:00
• 186e9187ce fix(ipa): use NOPASSWD sudo for IPA user to bypass broken PAM path beatzaplentyandClaude Sonnet 4.6 2026-07-28 13:12:42 +10:00
• e6f15404f5 Merge pull request 'fix(ipa): add wheel group to IPA user stub for sudo access' (#86) from worktree-ipa-lxc-kerberos-fix into main beatzaplenty 2026-07-28 03:00:33 +00:00
• 44a0acc18f fix(ipa): add wheel group to IPA user stub for sudo access beatzaplentyandClaude Sonnet 4.6 2026-07-28 12:59:46 +10:00
• 1fc6e63178 Merge pull request 'Worktree ipa lxc kerberos fix' (#85) from worktree-ipa-lxc-kerberos-fix into main beatzaplenty 2026-07-28 02:55:20 +00:00
• 3589fc31d7 feat(ipa): add Home Manager config for IPA primary user beatzaplentyandClaude Sonnet 4.6 2026-07-28 12:53:10 +10:00
• 89746718a9 feat(shell): make Switch-nix/Test-nix/buildImage system-wide beatzaplentyandClaude Sonnet 4.6 2026-07-28 12:32:33 +10:00
• 232d0e7c40 Merge pull request 'fix(ipa): suppress Kerberos NFS services in LXC containers' (#84) from worktree-ipa-lxc-kerberos-fix into main beatzaplenty 2026-07-28 02:13:47 +00:00
• 0b60d3ff2d fix(ipa): suppress Kerberos NFS services in LXC containers beatzaplentyandClaude Sonnet 4.6 2026-07-28 12:07:58 +10:00
• ff82e8885d added remaining ipa keytabs beatzaplenty 2026-07-28 11:45:06 +10:00
• 9a7411d1dd Merge pull request 'Worktree ipa common config' (#83) from worktree-ipa-common-config into main beatzaplenty 2026-07-28 01:43:53 +00:00
• 2f829ba3e7 refactor(ipa): move FreeIPA client to common config with auto-enrollment worktree-ipa-common-config beatzaplentyandClaude Sonnet 4.6 2026-07-28 11:15:59 +10:00
• dedd69dc42 secrets: add IPA keytab for nixos.sweet.home beatzaplenty 2026-07-28 10:43:43 +10:00
• f7f670ca4c Merge remote-tracking branch 'origin/worktree-docker-gui-fix' beatzaplenty 2026-07-28 10:33:15 +10:00
• 55ba283c82 Merge branch 'main' into worktree-docker-gui-fix worktree-docker-gui-fix beatzaplenty 2026-07-28 00:32:06 +00:00
• f4831c9370 feat(pxe-boot): enroll in FreeIPA domain worktree-ipa-client-module beatzaplentyandClaude Sonnet 4.6 2026-07-28 10:31:36 +10:00
• 2d46d25a67 Merge pull request 'fix(ipa): harden script and update module docs' (#82) from worktree-ipa-client-module into main beatzaplenty 2026-07-28 00:25:13 +00:00
• f5d29be041 fix(ipa): harden script and update module docs beatzaplentyandClaude Sonnet 4.6 2026-07-28 10:24:23 +10:00
• e10a1572c3 Merge branch 'main' of https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos beatzaplenty 2026-07-28 10:23:34 +10:00
• 578ef70aa9 updated flake.lock beatzaplenty 2026-07-28 10:23:23 +10:00
• e9fcbbbbcb Merge pull request 'Worktree ipa client module' (#80) from worktree-ipa-client-module into main beatzaplenty 2026-07-28 00:13:08 +00:00
• f46ae18672 fix(ipa): work around OpenSSH 10 AuthorizedKeysCommand path check beatzaplentyandClaude Sonnet 4.6 2026-07-28 10:08:57 +10:00
• fc277294f3 add vars to module beatzaplenty 2026-07-28 10:02:58 +10:00
• f3e5ea67a0 add docker group to user in enable docker service module beatzaplenty 2026-07-28 09:59:48 +10:00
• 7a8aebf679 Merge branch 'worktree-docker-gui-fix' beatzaplenty 2026-07-28 09:59:40 +10:00
• a8d95aad02 enable docker beatzaplenty 2026-07-28 09:49:14 +10:00
• dac5fbd574 feat(gui): enable docker service on workstation beatzaplentyandClaude Sonnet 4.6 2026-07-28 09:48:59 +10:00
• da0c651c60 Merge branch 'worktree-ipa-client-module' beatzaplenty 2026-07-28 09:48:55 +10:00
• 97019205da fix(ipa): create home dir on first login + AuthorizedKeysCommand beatzaplentyandClaude Sonnet 4.6 2026-07-28 09:47:11 +10:00
• 5487490b8e feat(ipa): add AuthorizedKeysCommand + enroll tailscale-router beatzaplentyandClaude Sonnet 4.6 2026-07-28 09:42:38 +10:00
• 543ea432f0 Merge pull request 'fix(tailscale-router): stop dnsmasq from intercepting host DNS queries' (#79) from worktree-peaceful-stirring-noodle into main beatzaplenty 2026-07-27 23:27:34 +00:00
• c7bbf88dce fix(tailscale-router): stop dnsmasq from intercepting host DNS queries worktree-peaceful-stirring-noodle beatzaplentyandClaude Sonnet 4.6 2026-07-28 09:26:50 +10:00
• d57145b31e add tailscale-router to domain beatzaplenty 2026-07-28 09:17:29 +10:00
• 1cbe80c0ca secrets: add IPA keytab for tailscale-router beatzaplenty 2026-07-28 09:15:21 +10:00
• 01ee261cf8 Merge pull request 'fix(ipa): stream keytab via sudo cat instead of scp' (#78) from worktree-ipa-client-module into main beatzaplenty 2026-07-27 23:14:41 +00:00
• f6f30c675f fix(ipa): stream keytab via sudo cat instead of scp beatzaplentyandClaude Sonnet 4.6 2026-07-28 09:08:19 +10:00
• 60b80cbd96 Merge pull request 'fix(ipa): SSH as wayne with sudo instead of root on domain controller' (#77) from worktree-ipa-client-module into main beatzaplenty 2026-07-27 23:06:49 +00:00
• 27a8c7fad9 fix(ipa): SSH as wayne with sudo instead of root on domain controller beatzaplentyandClaude Sonnet 4.6 2026-07-28 09:02:32 +10:00
• d9cee0a674 Merge pull request 'feat(ipa): add create-nixos-ipa-host-account script' (#76) from worktree-ipa-client-module into main beatzaplenty 2026-07-27 22:58:46 +00:00
• 6c1891812e feat(ipa): add create-nixos-ipa-host-account script beatzaplentyandClaude Sonnet 4.6 2026-07-28 08:57:55 +10:00
• 59316c982e Merge branch 'main' of https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos beatzaplenty 2026-07-28 07:26:40 +10:00
• 9eca3bd719 Merge pull request 'Worktree ipa client module' (#75) from worktree-ipa-client-module into main beatzaplenty 2026-07-27 21:25:57 +00:00
• f2f0fcf756 certs: add FreeIPA CA certificate beatzaplenty 2026-07-28 07:25:28 +10:00
• b4fb9c25f2 secrets(nix-cache): add sops-encrypted IPA host keytab beatzaplenty 2026-07-28 07:25:25 +10:00
• 8955840f0a fix(ipa): use in-place sops encryption in module docs beatzaplentyandClaude Sonnet 4.6 2026-07-28 07:19:53 +10:00
• a4b49c9909 fix(ipa): correct ipaServer to domain-controller.sweet.home beatzaplentyandClaude Sonnet 4.6 2026-07-28 07:16:53 +10:00
• c0936a10e7 Merge pull request 'feat(ipa): add reusable declarative FreeIPA client module' (#74) from worktree-ipa-client-module into main beatzaplenty 2026-07-27 21:06:28 +00:00
• f4bbd6331d feat(ipa): add reusable declarative FreeIPA client module beatzaplentyandClaude Sonnet 4.6 2026-07-27 23:31:21 +10:00
• b99ba87cf6 Merge branch 'main' of https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos beatzaplenty 2026-07-27 23:05:35 +10:00
• 2128353f9f Merge pull request 'Fix/static ips' (#73) from fix/static-ips into main beatzaplenty 2026-07-27 12:06:33 +00:00
• 7b4ce0ab3d fix(server): prevent zfs-init-tank from wiping pool on udev race fix/static-ips beatzaplentyandClaude Sonnet 4.6 2026-07-27 21:52:39 +10:00
• 3123565011 fix(tailscale-router): scope ts.net forwarder to tailnet subdomain beatzaplentyandClaude Sonnet 4.6 2026-07-27 19:23:46 +10:00
• 36f5ebdf86 feat(tailscale-router): serve ts.net DNS forward zone for LAN hosts beatzaplentyandClaude Sonnet 4.6 2026-07-27 19:20:12 +10:00
• bba054db85 Merge branch 'main' of https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos beatzaplenty 2026-07-27 18:29:07 +10:00
• b63a529a1d Merge branch 'fix/static-ips' beatzaplenty 2026-07-27 18:25:37 +10:00
• ee96713a50 feat(networking): declare static IPs for all NixOS-managed hosts in flake beatzaplentyandClaude Sonnet 4.6 2026-07-27 18:14:31 +10:00
• 1ece0c75d9 Merge pull request 'chore(pxe-boot): remove log-dhcp debug flag now that PXE boot is confirmed working' (#86) from fix/pxe-dnsmasq-port-conflict into main beatzaplenty 2026-07-27 05:52:18 +00:00
• 548c6f5041 chore(pxe-boot): remove log-dhcp debug flag now that PXE boot is confirmed working beatzaplentyandClaude Sonnet 4.6 2026-07-27 15:50:19 +10:00
• bae4c8171f Merge pull request 'fix(pxe-boot): use current pxe-boot IP (.247) in dnsmasq until Stage 5 renumber' (#85) from fix/pxe-dnsmasq-port-conflict into main beatzaplenty 2026-07-27 05:41:38 +00:00
• 3748c86049 fix(pxe-boot): use current pxe-boot IP (.247) in dnsmasq until Stage 5 renumber beatzaplentyandClaude Sonnet 4.6 2026-07-27 15:40:54 +10:00
• 9dd969cf4c Merge pull request 'fix(pxe-boot): open UDP 4011 for PXE boot service discovery' (#84) from fix/pxe-dnsmasq-port-conflict into main beatzaplenty 2026-07-27 05:22:46 +00:00