rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden deployment, authentication, firewall and media storage failure paths

Browse source
This commit is contained in:
rope 2026-09-14 11:50:22 +01:00
parent 64ede7bd05
commit 7145a35927
35 changed files with 2529 additions and 499 deletions
Download patch file Download diff file Expand all files Collapse all files

6
CLAUDE.md
View file

@ -20,8 +20,10 @@ This is a NixOS flake-based configuration for multiple hosts:
## Deployment
Hosts never pull this repo locally — they rebuild from the Forgejo remote via the
`update` alias (`nixos-rebuild switch --refresh --flake git+https://forg.gregersen.it/rope/nixos`).
Hosts normally build from the Forgejo remote. On the mediaserver, `update` and
`update2` call `fred-deploy`, sharing a guarded deployment transaction with the
router UI and nightly update. Clients build on the server, copy the closure,
then switch locally. See `docs/deployment.md` for server deployment and recovery.
That means evaluation is **pure**: config can never read files outside the repo
(e.g. `/var/secrets`) at eval time. Secrets must be injected at service runtime
(see `services/crowdsec.nix` and `services/go2rtc.nix` for the pattern).