nixos

Archived

This repository has been archived on 2026-07-30. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

History

beatzaplentyandClaude Sonnet 4.6 bf4836efac

Check NixOS configurations / eval-hosts (push) Failing after 17m31s

Details

refactor(ha): renumber cluster→VLAN10, storage→VLAN20; iSCSI/NFS protocol separation

Renumber internal HA bridges so VLAN ID matches IP third octet:
  vmbr1 (cluster): 192.168.4.x → 192.168.10.x (VLAN 10, /29)
  vmbr2 (storage): 192.168.5.x → 192.168.20.x (VLAN 20, /24)

Enforce protocol separation at the firewall on both HA nodes:
  - iSCSI (3260/tcp): storage-client subnet (192.168.20.0/24) only
  - NFS (111,2049,20048 tcp+udp): LAN subnet (192.168.2.0/24) only
  - Cluster subnet (192.168.10.224/29) accepted wholesale (DRBD+Corosync)
Moves from allowedTCPPorts/allowedUDPPorts to source-restricted extraCommands
rules on the nixos-fw chain.

NFS exports reduced to LAN-only (drop haClientCidr lines from mkNfsExports).
Storage-client network clients use iSCSI only; no NFS on VLAN 20.

All HA script VIP/storage IP defaults updated to match.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2

2026-07-29 18:19:07 +10:00

auto-installer.md

chore: full sweep — docs sync, SSH key module extraction, NFS dedup, dead code removal

2026-07-28 15:18:06 +10:00

beszel.md

refactor(beszel): move KEY and TOKEN fully into enable-agent.nix

2026-07-29 12:37:54 +10:00

flake-lock-automation.md

Rewrite codex-maintenance.sh to scope CI checks to changed files

2026-07-20 17:25:22 +00:00

ha-network-audit.md

docs(ha): add network segmentation audit report