rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden deployment, authentication, firewall and media storage failure paths

Browse source
This commit is contained in:
rope 2026-09-14 11:50:22 +01:00
parent 64ede7bd05
commit 7145a35927
35 changed files with 2529 additions and 499 deletions
Download patch file Download diff file Expand all files Collapse all files

9
hosts/FredOS-Mediaserver.nix
View file

@ -186,13 +186,8 @@
# unsigned store paths sent by the build client).
nix.settings.trusted-users = [ "root" "fred" ];
# Automatic daily system updates
system.autoUpgrade = {
enable = true;
flake = "git+https://forg.gregersen.it/rope/nixos";
dates = "05:15";
allowReboot = true;
};
# services/deployment.nix owns the 05:15 update and conditional reboot,
# using the same health-checked transaction as manual and router UI applies.
# WAN exposure is controlled by nftables in services/router.nix +
# ports.toml (networking.firewall is disabled on this host).