No API key and no separate billing: qs-ask now shells out to `claude -p`,
which draws on the existing subscription already authenticated on this
host. The trade is latency — Claude Code boots a Node process per
question, ~6s measured against the raw API's ~1s — so the launcher now
races Wikipedia and Claude instead of chaining them. Wikipedia fills the
card in under a second and Claude supersedes it on arrival; chaining
would have left the card blank for six seconds on every question.
Isolation, verified: --safe-mode drops CLAUDE.md, skills, hooks, plugins
and MCP while leaving auth working, which matters for correctness and not
just speed — the global CLAUDE.md here asks for caveman-mode replies and
that would have leaked into answers. --no-session-persistence writes no
transcript, and a dedicated empty cwd keeps launcher questions out of any
project's history or auto-memory. Confirmed no project namespace, no
transcript and no memory write after a run.
Not --bare, which looks right and is a trap: its auth is strictly
ANTHROPIC_API_KEY, so it cannot use the subscription at all.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Silence on stdout is the launcher's fall-back-to-Wikipedia signal, so it
has to stay clean — but that made a misconfigured key indistinguishable
from a working fallback. Every reason now prints on stderr, which the
launcher discards and a human running qs-ask by hand can read.
Drops curl -f so a 4xx body's own error message ("API key is invalid.")
surfaces instead of just an exit code, and guards the specific mistake of
pasting the sk-ant-... placeholder literally.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Adds qs-ask on the mediaserver — the Anthropic key lives there and nowhere
else, so neither desktop holds a credential and there's one place to
rotate it. The launcher pipes the question over the same SSH path the
server monitor already uses; the query goes over stdin because
`ssh host cmd arg` would re-parse arg through the remote shell.
Claude answers first, Wikipedia is the fallback. The script is the
feature gate: with no key it exits silently, which is the same signal as
a failed call or an UNKNOWN reply, so the Wikipedia path stays the
default with zero configuration. The card names whichever answered.
Haiku 4.5, no thinking and no effort (effort errors on Haiku) — a
one-sentence fact needs no reasoning tokens. ~$0.0005 per query.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Remove unnecessary --impure from update alias, shift
auto-upgrade from 04:15 to 05:15 so it runs after the
Forgejo bot updates flake.lock at 04:00 UTC (05:00 BST).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
systemd.network.links didn't generate files; use udev extraRules
to pin NIC names to MACs. Also disable networking.useDHCP catch-all
that silently misconfigured the LAN NIC when it got a wrong name.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Delete 8 unused matugen template files, remove the matugen package,
homepage custom.css watcher infrastructure, and the wallpaper shell
function. Update remaining comments to reference stylix.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add a stylix-stable input pinned to release-25.11 so the media server
gets Stylix theming without pulling in unstable nixpkgs. btop is now
managed by Home Manager on all hosts with Stylix auto-theming.
Desktop-only config (Zen/Vesktop CSS, GTK icons) is guarded behind
an isDesktop check in stylix.nix.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The M2000's legacy_535 driver caps CUDA support at 12.2; nixpkgs'
default ollama-cuda targets 12.8 (requires driver ≥570), causing
the runner to crash immediately. Override to CUDA 12.2 with sm_52
arch target to match Maxwell GM206 compute capability.
Also open port 11434 on the mediaserver firewall for remote ollama
access from other LAN hosts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
record-update parses nvd diff after switch and writes latest.json;
Homepage polls a local-only nginx listener and renders date/changes/
closure/kernel via a customapi widget.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Share the wallpaper symlink across all hosts by moving it from gnome.nix
into home-manager/fred.nix, and add matugen templates for btop and the
Homepage dashboard.
The Homepage NixOS module writes custom.css into /etc (read-only), so
bind-mount /var/lib/homepage-custom-css/custom.css over it. A systemd
path unit restarts homepage-dashboard whenever matugen rewrites the
file, so regeneration works without sudo.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Queries qBittorrent for individual file sizes of all active torrents.
Files whose size matches a seeded torrent file are skipped, catching
cross-filesystem copies where hardlink detection doesn't work.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Resumable batch script that finds H.264 files, re-encodes to HEVC
(libx265 CRF 24), verifies duration, and replaces originals.
Tracks completed files in /var/lib/transcode-hevc/completed.log.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove virtualisation.docker.enable (no longer used after native
migration of Authelia, go2rtc, and nginx)
- Add migration checklist documenting which state directories and
secrets to back up when moving to new hardware
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds authorised keys for FredOS-Gaming and phone. Disables SSH password
authentication on FredOS-Mediaserver — key auth only going forward.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces bare enable flag with a dedicated service module covering:
- SSH brute force via journald
- Nginx Proxy Manager auth failures via Docker log files
- Jellyfin auth failures via journald
Includes incremental ban times (up to 1 week) and LAN ignore rules.
https://claude.ai/code/session_01PwAXuaoJx7qD5FhVLsn7Sn
