Archived
beatzaplentyandClaude Sonnet 5
91d8f8fab1
New tor-relay build type (currently lxc-only) running a plain Tor middle relay via modules/tor/enable-relay.nix, plus nyx for interactive monitoring over the relay's control socket. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
46 lines
1.6 KiB
Markdown
46 lines
1.6 KiB
Markdown
# AGENTS.md
|
|
|
|
## Repo purpose
|
|
|
|
This repository contains flake-based NixOS configurations for Wayne's LAN
|
|
servers and workstation.
|
|
|
|
The flake exposes NixOS configurations named `<platform>-<buildtype>`
|
|
(platforms: `linode`, `proxmox`, `lxc`; build types: `minimal`, `nix-cache`,
|
|
`server`, `docker`, `gui`, `pxe-boot`, `tailscale-exit-node`, `tor-relay`), generated from `modules/platforms/*`
|
|
and `modules/build-types/*` by the `mkTarget` function in `flake.nix`. Not
|
|
every combination is built — `pxe-boot` has no `linode` variant. See
|
|
`README.md` for the full current target list; treat `flake.nix` as the
|
|
source of truth since this list can drift.
|
|
|
|
Do not deploy, switch, reboot, repartition, format disks, or run destructive
|
|
install commands from this repository unless explicitly asked.
|
|
|
|
## Safety rules
|
|
|
|
- Never run `nixos-rebuild switch`, `boot`, `test`, `nixos-install`, `parted`,
|
|
`mkfs`, `mkswap`, `swapon`, `mount`, or destructive disk commands in Codex.
|
|
- Validation work should be limited to evaluation, linting, formatting checks,
|
|
and `nix build --dry-run --no-link`.
|
|
- Do not add secrets, tokens, private keys, password hashes, or live credentials
|
|
to the repo.
|
|
- Treat `flake.nix`, Home Manager config, and Nix config files as public.
|
|
- If you find committed tokens or hashes, flag them immediately and recommend
|
|
rotation/removal.
|
|
|
|
## Expected commands
|
|
|
|
Use these commands when validating changes:
|
|
|
|
```bash
|
|
bash scripts/codex-setup.sh
|
|
bash scripts/codex-maintenance.sh
|
|
bash scripts/codex-maintenance.sh dry-run
|
|
```
|
|
|
|
Host evaluation is safe when limited to drvPath checks:
|
|
|
|
```bash
|
|
nix eval .#nixosConfigurations.<host>.config.system.build.toplevel.drvPath --raw
|
|
```
|