- crowdsec.nix: drop the ntfy notifications (one push per ban was constant
noise on the WAN-exposed box); bans still happen silently
- service-health.nix: OnFailure=notify-failure@%n on 16 core units sends an
ntfy 'down' push when a unit truly fails (after exhausting Restart=), then
a 'recovered' push when it comes back. Shares /var/secrets/ntfy-url.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Remove unnecessary --impure from update alias, shift
auto-upgrade from 04:15 to 05:15 so it runs after the
Forgejo bot updates flake.lock at 04:00 UTC (05:00 BST).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Hourly timer syncs only recently added content (last 2h) by querying
Radarr/Sonarr APIs for new items. Weekly full-library sync runs Sunday
04:00 as a catch-all. Both run the bazarr-sync container via podman.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Stylix on the media server tries to manage files (GTK config,
fontconfig, etc.) that already exist, causing HM activation to fail.
Setting backupFileExtension lets HM move conflicts to .hm-bak.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Switch Stylix from release-25.11 to master, which fixes hyprpaper's
wallpaper config generation for 0.8.4 (structured attributes instead
of raw string concatenation).
Move the Stylix module import from common.nix to flake.nix extraModules
so the Mediaserver (on nixpkgs-stable) doesn't pull in options that
only exist in unstable nixpkgs (services.displayManager.generic).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Lutris and Wine pull in 32-bit (i686-linux) dependencies like openldap.
Without i686-linux in the supported systems list, nix falls back to
building those locally on the gaming PC instead of offloading to the server.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces Vesktop for quick cross-device note-passing. Uses Flatnotes
with auth disabled so Authelia is the only login required.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Rename settings/gnome.nix to settings/desktop.nix (file no longer
has anything to do with GNOME)
- Replace nautilus with nemo — starts fast, has a hamburger menu,
no Tracker3/Mutter D-Bus dependencies
- Exclude thunar (pulled in by XFCE) via environment.xfce.excludePackages
- Remove nautilus Tracker dconf workaround (no longer needed)
- Update $mod+E keybind and common.nix import accordingly
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Deploys code-server on FredOS-Mediaserver (port 4444, user fred) with
Authelia one_factor auth and nginx reverse proxy. Includes claude-code
in system packages for use in the integrated terminal.
Also fixes anyrun launcher width to absolute 350px (was a tiny fraction).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Flips stylix.autoEnable on so every supported target picks up colours
from the wallpaper-derived base16 palette, and tears out the per-app
matugen plumbing it replaces:
- fred.nix: drop the matugen config.toml block and the .keep files;
move btop and ghostty to programs.* with the colour-bearing options
removed (stylix owns those).
- gnome.nix: remove the matugen and jq packages, the hand-written
gtk.css home.file overrides (replaced by gtk.gtk{3,4}.extraCss layered
on top of stylix's theme), the WallpaperShell user-themes override,
and the gtk-theme/cursor-theme/accent-color dconf entries that stylix
now writes.
- stylix.nix: add a home.activation hook that recolours Adwaita folder
SVGs using stylix.colors.base0D and pulls in Papirus mimetypes —
same outcome as the old matugen post-hook but driven by stylix.
- common.nix: drop the matugen invocation from the `update` alias.
Leftover matugen-only behaviour intentionally dropped: Vesktop CSS,
the GNOME accent hue-mapping, the VSCodium colour-merge (stylix's
vscode target handles that natively). Templates in templates/ are kept
on disk for now; can be removed in a follow-up.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds nix-community/stylix on its release-25.11 branch (master references
options that don't exist in 25.11's nixpkgs). autoEnable=false so
matugen keeps owning every app it currently themes; we only opt in to
the five targets matugen doesn't cover.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds settings/hyprland.nix as a sibling to the GNOME module, gated to
the Gaming host. GDM picks up the new session entry automatically; GNOME
remains the default and can be reselected at login.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This reverts db69615. Not pursuing the Windows-VM workaround for the DR
client mod after all. The server-side AdminCommandHandler exposes a
LevelSelf channel that bypasses the DLL flow entirely, which is a
better path than running a whole guest OS for one game.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds libvirtd + virt-manager + OVMFFull (UEFI w/ Secure Boot) + swtpm
(software TPM 2.0) so a Windows 11 VM can install. Brings in virtio-win
ISO for guest drivers and virt-viewer for SPICE console. Adds fred to
the libvirtd group.
Reason: the Dungeon Runners client-side mod (DSOUND.dll inline-hook
trampolines + memory scanner) crashes wine with a guard-page violation
on init regardless of Proton vintage; the only realistic path for
character progression is to run the client on real Windows.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
New service module on FredOS-Mediaserver that launches the friend's
Windows-only Unity server (DR_Server.exe -batchmode -nographics) in a
Win64 wine prefix. wineboot initializes the prefix on first start.
Opens auth/game/queue ports 2110, 2603-2606 (TCP+UDP).
Build files staged separately at ~/dr-server-build on the server;
sudo-move into /var/lib/dr-server/Build after the rebuild.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Same rationale as jq — useful when poking at the AdGuard / DNS path
during incidents, no package on the system currently provides dig/host.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
`nixos-rebuild switch` already builds — the prior `build && switch`
chain made nix evaluate the flake twice and pushed a second
empty-tree nom render to the terminal. With one switch, the nom
output stays clean: single dependency graph, then activation, then nvd.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Useful for ad-hoc shell scripts (e.g. downloads-cleanup.sh) — already a
build-time dep of arr-interconnect, just wasn't on the user PATH.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds nix-output-monitor to systemPackages and pipes nixos-rebuild's
internal-json log stream through `nom --json` for both the build and
switch steps. set -o pipefail at the top so a failed rebuild aborts the
chain (otherwise && only sees nom's exit code, which is always 0).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds services/forgejo-runner.nix as a host-gated module on the mediaserver
and switches the flake-update workflow from runs-on: ubuntu-latest to the
self-hosted fred-nix label, mapped to catthehacker/ubuntu:act-latest for
GitHub-action compatibility. Token lives at /var/secrets/forgejo-runner-token
so it stays out of the Nix store.
Also drops the stray result/ build symlink from the worktree.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Migrating origin from GitHub to a private Forgejo repo at
forg.gregersen.it/rope/nixos. Each host needs the PAT in /root/.git-credentials
(host-local state, set up manually since the repo isn't publicly readable).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The 25.11 channel renamed proton-vpn to protonvpn-gui; Macbook was
patched in an earlier commit but Gaming wasn't, breaking the build.
zramSwap goes back into common.nix as the cheap OOM-during-uncached-build
safety net — even on stable, --refresh against a freshly-bumped lock can
trigger local builds the box has no swap to absorb.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Profilarr replaces the recyclarr/TRaSH-Guides flow with a stateful web
service that owns *arr profiles end-to-end via its own UI. Runs as an
oci-container on 127.0.0.1:6868, fronted by nginx at
profilarr.nordhammer.it behind Authelia (one_factor).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The flag was removed in matugen 3.x; the call now exits with an arg
parse error on every update (caught by '|| true' but noisy). matugen
picks a sensible source color by default, so we just drop the flag.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The mediaserver kept hard-freezing on local builds (gnupg, openldap,
deno/rusty-v8) whenever a fresh unstable revision outran Hydra's
binary cache. It doesn't need bleeding-edge packages — every service
it runs is mature enough that 6-month-old versions are fine — so move
it onto the stable channel where the cache is essentially always
warm. Gaming and Macbook stay on unstable for fresh GPU/kernel work.
Implementation: add nixpkgs-stable + home-manager-stable inputs,
parameterise mkHost to accept a (nixpkgs, home-manager) pair.
Drive-by:
- Switch homepage.nix from environmentFiles (plural, unstable-only)
to environmentFile (singular, present on both channels).
- Gate the openldap-skip-tests overlay to non-mediaserver hosts so
it doesn't force a local rebuild on stable, where openldap is
always cached.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The mediaserver (56 cores, 31 GiB RAM, no swap) was hard-freezing on
local builds of gnupg/openldap because Nix defaulted max-jobs=auto and
launched ~56 parallel gcc compilations, blowing past available memory
and OOM-stalling AdGuard.
Cap parallelism (max-jobs=4, cores=8 per build) and add zramSwap as a
compressed in-memory safety net so a build storm can't take services
with it.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Heavy local builds (gnupg/openldap checkPhase under a freshly-bumped
nixpkgs lock) were saturating CPU and starving AdGuard on the
mediaserver, making DNS effectively unresponsive until the build
finished or got cancelled.
Halving the daemon's CPU share leaves headroom for latency-sensitive
services without meaningfully slowing builds on an otherwise idle box.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Score-based release filtering replaces the brittle "minimum size" approach
— good HEVC encodes from reputable groups now win regardless of file
size, while obfuscated/no-group/lazy-x265 garbage gets banned.
Profiles installed:
Sonarr: WEB-1080p (default), UHD Bluray + WEB (per-show opt-in)
Radarr: HD Bluray + WEB (default), UHD Bluray + WEB (per-movie opt-in)
AV1 is banned across all four profiles since the GPU lacks hardware
decode. API keys are extracted at runtime from each *arr's config.xml,
matching the arr-interconnect pattern.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
test017-syncreplication-refresh is timing-flaky and fails reliably on
local builds when Hydra's binary cache hasn't yet served the upstream
artifact. Overlay sets doCheck=false so the build can proceed. Remove
once the substituter catches up to the pinned nixpkgs revision.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
CrowdSec reads the ntfy topic URL from /var/secrets/ntfy-url at eval
time via builtins.readFile. Pure flake mode forbids reading paths
outside the source tree, so without --impure the read silently falls
through to the placeholder URL on every rebuild. Adding --impure to
both build and switch keeps the secret-file pattern working.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
CrowdSec covers the same surface (sshd, authelia, nginx, *arr apps,
qBit) with the addition of community-sourced threat intel and ntfy
push alerts. Keeping both was redundant. State at /var/lib/fail2ban
will sit unused until cleaned up by hand.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Enables the CrowdSec agent with sshd/nginx/http-cve hub collections,
acquires logs from nginx, sshd, and Authelia journald, and wires the
firewall bouncer to enforce bans via nftables. Alerts are POSTed to a
self-chosen ntfy.sh topic (URL read from /var/secrets/ntfy-url, falls
back to a placeholder so the repo stays eval-clean without the secret).
Module is self-contained — remove the file + import to uninstall; state
lives under /var/lib/crowdsec.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds services/router.nix with systemd-networkd (eno1=WAN via DHCP,
eth0=LAN 10.0.0.1/24), nftables (NAT + firewall, default drop on WAN
in), dnsmasq (DHCP only — AdGuard Home keeps :53 for DNS), and sysctl
IP forwarding. NetworkManager is forced off on this host.
Port forwards live in ports.toml at the repo root and are imported via
builtins.fromTOML. Supports single ports, ranges ("26901-26902"), and
"both" protocol. Initial forwards: 22, 80, 443, 26900, 26901-26902.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- services/adguard.nix: mutableSettings = false so Nix config overrides
UI-made changes on rebuild (settings are the source of truth)
- common.nix: add busybox for its collection of handy utilities
- common.nix: remove networking.nameservers — DNS now comes purely from
per-host NetworkManager config (AdGuard as the only resolver, no leaks)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
