Flushes stale NAT conntrack on WAN IP change; renews lease then restarts
networkd if internet stays down. ntfy on action. Fixes needing a manual
reboot after the ISP re-IP'd us.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- crowdsec.nix: drop the ntfy notifications (one push per ban was constant
noise on the WAN-exposed box); bans still happen silently
- service-health.nix: OnFailure=notify-failure@%n on 16 core units sends an
ntfy 'down' push when a unit truly fails (after exhausting Restart=), then
a 'recovered' push when it comes back. Shares /var/secrets/ntfy-url.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Remove unnecessary --impure from update alias, shift
auto-upgrade from 04:15 to 05:15 so it runs after the
Forgejo bot updates flake.lock at 04:00 UTC (05:00 BST).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Hourly timer syncs only recently added content (last 2h) by querying
Radarr/Sonarr APIs for new items. Weekly full-library sync runs Sunday
04:00 as a catch-all. Both run the bazarr-sync container via podman.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Stylix on the media server tries to manage files (GTK config,
fontconfig, etc.) that already exist, causing HM activation to fail.
Setting backupFileExtension lets HM move conflicts to .hm-bak.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Switch Stylix from release-25.11 to master, which fixes hyprpaper's
wallpaper config generation for 0.8.4 (structured attributes instead
of raw string concatenation).
Move the Stylix module import from common.nix to flake.nix extraModules
so the Mediaserver (on nixpkgs-stable) doesn't pull in options that
only exist in unstable nixpkgs (services.displayManager.generic).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Lutris and Wine pull in 32-bit (i686-linux) dependencies like openldap.
Without i686-linux in the supported systems list, nix falls back to
building those locally on the gaming PC instead of offloading to the server.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces Vesktop for quick cross-device note-passing. Uses Flatnotes
with auth disabled so Authelia is the only login required.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Rename settings/gnome.nix to settings/desktop.nix (file no longer
has anything to do with GNOME)
- Replace nautilus with nemo — starts fast, has a hamburger menu,
no Tracker3/Mutter D-Bus dependencies
- Exclude thunar (pulled in by XFCE) via environment.xfce.excludePackages
- Remove nautilus Tracker dconf workaround (no longer needed)
- Update $mod+E keybind and common.nix import accordingly
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Deploys code-server on FredOS-Mediaserver (port 4444, user fred) with
Authelia one_factor auth and nginx reverse proxy. Includes claude-code
in system packages for use in the integrated terminal.
Also fixes anyrun launcher width to absolute 350px (was a tiny fraction).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Flips stylix.autoEnable on so every supported target picks up colours
from the wallpaper-derived base16 palette, and tears out the per-app
matugen plumbing it replaces:
- fred.nix: drop the matugen config.toml block and the .keep files;
move btop and ghostty to programs.* with the colour-bearing options
removed (stylix owns those).
- gnome.nix: remove the matugen and jq packages, the hand-written
gtk.css home.file overrides (replaced by gtk.gtk{3,4}.extraCss layered
on top of stylix's theme), the WallpaperShell user-themes override,
and the gtk-theme/cursor-theme/accent-color dconf entries that stylix
now writes.
- stylix.nix: add a home.activation hook that recolours Adwaita folder
SVGs using stylix.colors.base0D and pulls in Papirus mimetypes —
same outcome as the old matugen post-hook but driven by stylix.
- common.nix: drop the matugen invocation from the `update` alias.
Leftover matugen-only behaviour intentionally dropped: Vesktop CSS,
the GNOME accent hue-mapping, the VSCodium colour-merge (stylix's
vscode target handles that natively). Templates in templates/ are kept
on disk for now; can be removed in a follow-up.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds nix-community/stylix on its release-25.11 branch (master references
options that don't exist in 25.11's nixpkgs). autoEnable=false so
matugen keeps owning every app it currently themes; we only opt in to
the five targets matugen doesn't cover.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds settings/hyprland.nix as a sibling to the GNOME module, gated to
the Gaming host. GDM picks up the new session entry automatically; GNOME
remains the default and can be reselected at login.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This reverts db69615. Not pursuing the Windows-VM workaround for the DR
client mod after all. The server-side AdminCommandHandler exposes a
LevelSelf channel that bypasses the DLL flow entirely, which is a
better path than running a whole guest OS for one game.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds libvirtd + virt-manager + OVMFFull (UEFI w/ Secure Boot) + swtpm
(software TPM 2.0) so a Windows 11 VM can install. Brings in virtio-win
ISO for guest drivers and virt-viewer for SPICE console. Adds fred to
the libvirtd group.
Reason: the Dungeon Runners client-side mod (DSOUND.dll inline-hook
trampolines + memory scanner) crashes wine with a guard-page violation
on init regardless of Proton vintage; the only realistic path for
character progression is to run the client on real Windows.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
New service module on FredOS-Mediaserver that launches the friend's
Windows-only Unity server (DR_Server.exe -batchmode -nographics) in a
Win64 wine prefix. wineboot initializes the prefix on first start.
Opens auth/game/queue ports 2110, 2603-2606 (TCP+UDP).
Build files staged separately at ~/dr-server-build on the server;
sudo-move into /var/lib/dr-server/Build after the rebuild.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Same rationale as jq — useful when poking at the AdGuard / DNS path
during incidents, no package on the system currently provides dig/host.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
`nixos-rebuild switch` already builds — the prior `build && switch`
chain made nix evaluate the flake twice and pushed a second
empty-tree nom render to the terminal. With one switch, the nom
output stays clean: single dependency graph, then activation, then nvd.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Useful for ad-hoc shell scripts (e.g. downloads-cleanup.sh) — already a
build-time dep of arr-interconnect, just wasn't on the user PATH.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds nix-output-monitor to systemPackages and pipes nixos-rebuild's
internal-json log stream through `nom --json` for both the build and
switch steps. set -o pipefail at the top so a failed rebuild aborts the
chain (otherwise && only sees nom's exit code, which is always 0).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds services/forgejo-runner.nix as a host-gated module on the mediaserver
and switches the flake-update workflow from runs-on: ubuntu-latest to the
self-hosted fred-nix label, mapped to catthehacker/ubuntu:act-latest for
GitHub-action compatibility. Token lives at /var/secrets/forgejo-runner-token
so it stays out of the Nix store.
Also drops the stray result/ build symlink from the worktree.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
