Archived
beatzaplentyandClaude Sonnet 4.6
cded77919d
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s
- variables.nix: switch to rec {}, extract giteaDomain/giteaRepoPath,
extraAdminSshKeys, haLanNfsFqdn, tailscaleResolverIp, ports.dhcp,
ports.dns; ipaServer now derives from homeDomain ref; section headers
- modules: use new vars throughout (pxe-boot, ts-dns-forwarder,
cluster-config, configuration.nix, mount-pxe-images) — eval unchanged
- docs: delete ephemeral planning docs (AUDIT_REPORT, ha-network-audit,
network-cutover); add docs/ha.md; drop migration reference table from
ip-addressing.md; remove stale server example from beszel.md
- CLAUDE.md/README.md/AGENTS.md: fix build types (tailscale-router,
ha-server, drop server); document scripts/ha/, scripts/ipa/, and
all previously undocumented top-level and lib scripts
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
53 lines
2.0 KiB
Markdown
53 lines
2.0 KiB
Markdown
# AGENTS.md
|
|
|
|
## Repo purpose
|
|
|
|
This repository contains flake-based NixOS configurations for Wayne's LAN
|
|
servers and workstation.
|
|
|
|
The flake exposes NixOS configurations named `<platform>-<buildtype>`
|
|
(platforms: `linode`, `proxmox`, `lxc`, `baremetal`; build types: `minimal`,
|
|
`nix-cache`, `docker`, `gui`, `pxe-boot`, `tailscale-router`,
|
|
`tor-relay`, `ha-server`), generated from `modules/platforms/*` and
|
|
`modules/build-types/*` by the `mkTarget` function in `flake.nix`. Not every
|
|
combination is built — `pxe-boot` has no `linode` variant, `ha-server` only
|
|
exists on `proxmox`, and `tor-relay` only exists on `lxc`. See `README.md`
|
|
for the full current target list; treat `flake.nix` as the source of truth
|
|
since this list can drift.
|
|
|
|
Do not deploy, switch, reboot, repartition, format disks, or run destructive
|
|
install commands from this repository unless explicitly asked.
|
|
|
|
## Safety rules
|
|
|
|
- Never run `nixos-rebuild switch`, `boot`, `test`, `nixos-install`, `parted`,
|
|
`mkfs`, `mkswap`, `swapon`, `mount`, or destructive disk commands in Codex.
|
|
- Validation work should be limited to evaluation, linting, formatting checks,
|
|
and `nix build --dry-run --no-link`.
|
|
- Do not add secrets, tokens, private keys, password hashes, or live credentials
|
|
to the repo.
|
|
- Treat `flake.nix`, Home Manager config, and Nix config files as public.
|
|
- If you find committed tokens or hashes, flag them immediately and recommend
|
|
rotation/removal.
|
|
|
|
## Expected commands
|
|
|
|
Use these commands when validating changes:
|
|
|
|
```bash
|
|
bash scripts/codex-setup.sh
|
|
bash scripts/codex-maintenance.sh
|
|
```
|
|
|
|
With no flags, `codex-maintenance.sh` scopes fmt-check/statix/eval to files
|
|
changed against a base ref — this is what CI runs on every push/PR. For the
|
|
full sweep (every host, every package — slow; CI never runs this), use
|
|
`bash scripts/codex-maintenance.sh --full-check` (add `--dry-run` for build
|
|
planning on top of whichever scope is active).
|
|
|
|
Host evaluation is safe when limited to drvPath checks:
|
|
|
|
```bash
|
|
nix eval .#nixosConfigurations.<host>.config.system.build.toplevel.drvPath --raw
|
|
```
|