rootandClaude Sonnet 5
5ec7033439
Same class of problem as the deployedTargets/README fixes: hand-maintained prose that drifted from reality and nobody was obligated to update. - CLAUDE.md: "18 hosts" was a stale hardcoded count (actually 20); reworded to not need updating as hosts are added. Also added the missing tailscale-exit-node build type to a list that had it everywhere else in the file except one bullet. - AGENTS.md: same missing tailscale-exit-node build type. - docs/auto-installer.md: the hand-enumerated lxc-* list was missing lxc-tailscale-exit-node. - flake-target-refactor-spec.md: added a "Status: implemented" note so this completed historical spec (referenced elsewhere purely for rationale) can't be mistaken for an open plan with unresolved Open Questions. - remove-sensetive-info-refactor.md: the "Definition of done" checklist was entirely unchecked despite most of the work being done. Checked off what's actually done (sops-nix migration, history scrub just performed, the pre-commit gitleaks hook), and left rotation of the GitHub PAT found in history explicitly flagged as the one still-open item -- an operator action against GitHub, not something this repo can attest to itself. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
1.6 KiB
AGENTS.md
Repo purpose
This repository contains flake-based NixOS configurations for Wayne's LAN servers and workstation.
The flake exposes NixOS configurations named <platform>-<buildtype>
(platforms: linode, proxmox, lxc; build types: minimal, nix-cache,
server, docker, gui, pxe-boot, tailscale-exit-node), generated from modules/platforms/*
and modules/build-types/* by the mkTarget function in flake.nix. Not
every combination is built — pxe-boot has no linode variant. See
README.md for the full current target list; treat flake.nix as the
source of truth since this list can drift.
Do not deploy, switch, reboot, repartition, format disks, or run destructive install commands from this repository unless explicitly asked.
Safety rules
- Never run
nixos-rebuild switch,boot,test,nixos-install,parted,mkfs,mkswap,swapon,mount, or destructive disk commands in Codex. - Validation work should be limited to evaluation, linting, formatting checks,
and
nix build --dry-run --no-link. - Do not add secrets, tokens, private keys, password hashes, or live credentials to the repo.
- Treat
flake.nix, Home Manager config, and Nix config files as public. - If you find committed tokens or hashes, flag them immediately and recommend rotation/removal.
Expected commands
Use these commands when validating changes:
bash scripts/codex-setup.sh
bash scripts/codex-maintenance.sh
bash scripts/codex-maintenance.sh dry-run
Host evaluation is safe when limited to drvPath checks:
nix eval .#nixosConfigurations.<host>.config.system.build.toplevel.drvPath --raw