- Add Photon OCI container on nixnuc (rtuszik/photon-docker, planet
index) storing data on the /orico ZFS mirror
- Open port 2322 in nixnuc's main firewall allowlist (LAN + Tailscale)
- Remove services.nominatim, its nginx vhost, and www-data PostgreSQL
user from nixnuc
- Switch Dawarich on hetznix01 from NOMINATIM_API_HOST to
PHOTON_API_HOST pointing at nixnuc.atlas-snares.ts.net:2322
- Add zfs-datasets.nix oneshot to declaratively ensure all orico
datasets exist before services start
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
A minimal Postfix instance on nixnuc accepts local mail submissions from
services and relays everything to hetznix01.atlas-snares.ts.net on port 25
via the Tailscale tunnel. Root and gene aliases forward to @technicalissues.us.
The simple-nixos-mailserver module (postfix + dovecot stack) is removed since
nixnuc does not receive external mail. The nginx server alias for
mail.home.technicalissues.us is dropped. The private-flake input is pinned to
the nixnuc-postfix-relay branch to pick up the matching relay trust change on
hetznix01.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add deadnix, nixfmt, and statix to flake inputs
- Add formatter output to flake for nix fmt support
- Add deadnix, nixfmt, statix to Home Manager packages
- Add GitHub Actions workflow for CI validation
- Add .pre-commit-config.yaml with hooks for nixfmt, deadnix, and statix
- Support x86_64-darwin in formatter
- Delete 2024-12-rework/ folder
- Rename modules/hosts/common to modules/shared, then split into:
- modules/shared/home/general
- modules/shared/home/linux
- modules/shared/nixos
- Update all import paths throughout the codebase
- Update lib/*.nix to use new paths
- Fix hardcoded /Users/${username} to use config.home.homeDirectory
- Update README and examples/flake-structure.nix
SSH key imports removed as they're now handled by private-flake
Email config for hetznix01 moved to private-flake
Network config for hetznix01/02 moved to private-flake
In the UI, I setup the "OAuth" method of logging in, logged in, used my
local account to up my permissions to administrator, then added these
settings so that only my Pocket ID-based login was an option.
The primary motivator here was that the NFO files from Pinchflat had the
path to everything starting at `/downloads` and that didn't work well
with Jellyfin who saw the real path to the files
Prior to this, I had tried to run as my user but that doesn't work here.
It seems you have to use the version of running containers built into
home-manager if you want rootless podman.