beatzaplentyandClaude Sonnet 4.6
cded77919d
- variables.nix: switch to rec {}, extract giteaDomain/giteaRepoPath,
extraAdminSshKeys, haLanNfsFqdn, tailscaleResolverIp, ports.dhcp,
ports.dns; ipaServer now derives from homeDomain ref; section headers
- modules: use new vars throughout (pxe-boot, ts-dns-forwarder,
cluster-config, configuration.nix, mount-pxe-images) — eval unchanged
- docs: delete ephemeral planning docs (AUDIT_REPORT, ha-network-audit,
network-cutover); add docs/ha.md; drop migration reference table from
ip-addressing.md; remove stale server example from beszel.md
- CLAUDE.md/README.md/AGENTS.md: fix build types (tailscale-router,
ha-server, drop server); document scripts/ha/, scripts/ipa/, and
all previously undocumented top-level and lib scripts
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2.0 KiB
AGENTS.md
Repo purpose
This repository contains flake-based NixOS configurations for Wayne's LAN servers and workstation.
The flake exposes NixOS configurations named <platform>-<buildtype>
(platforms: linode, proxmox, lxc, baremetal; build types: minimal,
nix-cache, docker, gui, pxe-boot, tailscale-router,
tor-relay, ha-server), generated from modules/platforms/* and
modules/build-types/* by the mkTarget function in flake.nix. Not every
combination is built — pxe-boot has no linode variant, ha-server only
exists on proxmox, and tor-relay only exists on lxc. See README.md
for the full current target list; treat flake.nix as the source of truth
since this list can drift.
Do not deploy, switch, reboot, repartition, format disks, or run destructive install commands from this repository unless explicitly asked.
Safety rules
- Never run
nixos-rebuild switch,boot,test,nixos-install,parted,mkfs,mkswap,swapon,mount, or destructive disk commands in Codex. - Validation work should be limited to evaluation, linting, formatting checks,
and
nix build --dry-run --no-link. - Do not add secrets, tokens, private keys, password hashes, or live credentials to the repo.
- Treat
flake.nix, Home Manager config, and Nix config files as public. - If you find committed tokens or hashes, flag them immediately and recommend rotation/removal.
Expected commands
Use these commands when validating changes:
bash scripts/codex-setup.sh
bash scripts/codex-maintenance.sh
With no flags, codex-maintenance.sh scopes fmt-check/statix/eval to files
changed against a base ref — this is what CI runs on every push/PR. For the
full sweep (every host, every package — slow; CI never runs this), use
bash scripts/codex-maintenance.sh --full-check (add --dry-run for build
planning on top of whichever scope is active).
Host evaluation is safe when limited to drvPath checks:
nix eval .#nixosConfigurations.<host>.config.system.build.toplevel.drvPath --raw