From e2757a974085a6f0f3efc6075cb4a194d1e4fc8e Mon Sep 17 00:00:00 2001 From: John Bargman Date: Thu, 27 Aug 2026 15:08:37 +0000 Subject: [PATCH 1/4] feat(pillar-of-autum): assimilate minimal librex11 headed NUC (no secrets) Assimilate the ASUS NUC14RVH-B (Core Ultra 5 125H) discovered via the x86-bootstrap assimilator-probe (10.88.128.150) into the fleet as pillar-of-autum. - machines/pillar-of-autum: hardware-configuration.nix (probe USB boot layout by UUID) + default.nix (minimal librex11/XLibre headed system, i3 + lightdm, GRUB EFI removable, Intel graphics) - flake.nix: register via mkX86_64 with xlibre-overlay - topology: wg peer 110 (10.88.127.110), cortex-alpha.lan peer 150 - goldens: pillar-of-autum.json - documentation: pillar-of-autum.md + planning-pillar-of-autum.md NOTE: No secret/encryption assets are committed. The WireGuard keypair and host key were agent-generated for a not-yet-provisioned machine and are hallucinated. They must be manually generated and encrypted by the user before the machine can be provisioned. --- documentation/pillar-of-autum.md | 211 ++ documentation/planning-pillar-of-autum.md | 145 + flake.nix | 13 + goldens/pillar-of-autum.json | 2800 +++++++++++++++++ machines/pillar-of-autum/default.nix | 68 + .../hardware-configuration.nix | 71 + topology/pillar-of-autum.json | 21 + 7 files changed, 3329 insertions(+) create mode 100644 documentation/pillar-of-autum.md create mode 100644 documentation/planning-pillar-of-autum.md create mode 100644 goldens/pillar-of-autum.json create mode 100644 machines/pillar-of-autum/default.nix create mode 100644 machines/pillar-of-autum/hardware-configuration.nix create mode 100644 topology/pillar-of-autum.json diff --git a/documentation/pillar-of-autum.md b/documentation/pillar-of-autum.md new file mode 100644 index 00000000..a486e701 --- /dev/null +++ b/documentation/pillar-of-autum.md @@ -0,0 +1,211 @@ +# pillar-of-autum — Assimilation & Deployment Workflow + +> **Last updated:** 2026-08-27 +> **Status:** Configuration implemented + validated. Awaiting first nixinate deployment. +> **Machine:** `pillar-of-autum` (ASUS NUC14RVH-B, Intel Core Ultra 5 125H) +> **Spelling:** `pillar-of-autum` — **NOT** `pillar-of-autumn`. The extra `n` is a known +> misspelling and must not appear in code, topology, goldens, or commits. + +This document is the **record of actions and method of completion** for the first +"proven" assimilator-probe assimilation. It doubles as the runbook for the follow-up +nixinate deployment. Companion planning document: `planning-pillar-of-autum.md`. + +--- + +## 1. Purpose + +`pillar-of-autum` is the first machine assimilated end-to-end via the +**assimilator-probe x86-bootstrap** workflow. Its initial configuration is a +**minimal librex11 (XLibre X11) headed system**, similar in shape to `alpha-one` +(i3 + lightdm), built on the existing `@flake.nix` infrastructure. + +**Intended future purpose** (per `documentation/ai-stack.md`, "Future Expansion → +Additional backends"): an **AI inference backend** for the fleet LiteLLM gateway, +alongside LINDA and cluster-box. + +--- + +## 2. Hardware Identification (Probe Discovery) + +The assimilator-probe was deployed via the generic `x86-bootstrap` raw-disk image +(USB boot, GRUB EFI removable). Discovery followed the standard protocol +(`documentation/x86-bootstrap-deployment-workflow.md`, Stage 2): + +| Step | Command | Result | +|------|---------|--------| +| mDNS discovery | `avahi-resolve -n x86-bootstrap.local` | `10.88.128.150` (IPv4), `fe80::8aae:ddff:fe66:70ff` (IPv6) | +| Service enumeration | `avahi-browse -a -t` | `x86-bootstrap [88:ae:dd:66:70:ff] _workstation._tcp` | +| Host key pre-check | `grep 10.88.128.150 ~/.ssh/known_hosts` | `[10.88.128.150]:1108 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE5fWYYizH6kYupOXVB0Eq7qCl68dUkySNdvFEBeW9zo` | +| SSH (inspect, read-only) | `ssh -p 1108 inspect@10.88.128.150` | Banner: "ASSIMILATOR PROBE … Awaiting assimilation." | + +**Hardware captured** (read-only `inspect` access, port 1108): + +| Attribute | Value | +|-----------|-------| +| Chassis | ASUS NUC14RVH-B (mini-PC) | +| CPU | Intel Core Ultra 5 125H, 18 cores (Meteor Lake, integrated Arc graphics) | +| RAM | 16 GiB | +| Boot medium | `sda` — 118.1 GiB USB flash drive | +| └ `/boot` (ESP) | `sda1`, 1 GiB vfat, UUID `12CE-A600` | +| └ swap | `sda2`, 8 GiB, UUID `851d149e-df1d-4dea-9253-fb64340d714d` | +| └ `/` (root) | `sda3`, 11 GiB ext4, UUID `793f5bea-fb84-4c96-a832-3a8b287a760a` | +| Target storage | `nvme0n1` — 238.5 GiB addlink M.2 PCIe NVMe (pre-existing partitions, unmounted) | +| Wired NIC | `enp86s0`, MAC `88:ae:dd:66:70:ff` | +| WiFi NIC | `wlo1`, MAC `00:d7:6d:e0:5f:83` | +| OS (probe) | NixOS 26.05.20260724.597283a, kernel 6.18.39 | +| machine-id | `7bdcbf4385dd4d489e4bf86fc5dafd0b` | + +The partition UUIDs above were read from `/dev/disk/by-uuid` on the running probe and +are the source of truth for `machines/pillar-of-autum/hardware-configuration.nix`. + +--- + +## 3. Configuration Implementation (Completed) + +The following files were created/modified to implement the system configuration on the +existing `@flake.nix` infrastructure: + +| File | Action | Purpose | +|------|--------|---------| +| `machines/pillar-of-autum/hardware-configuration.nix` | **created** | Probe hardware scan: USB boot layout (by UUID), initrd modules, Intel microcode | +| `machines/pillar-of-autum/default.nix` | **created** | Minimal librex11 headed system: i3 + lightdm (via `i3wm_darthpjb.nix`), WG topology, GRUB EFI removable (mirrors bootstrap), Intel graphics | +| `topology/pillar-of-autum.json` | **created** | Planar topology: `wg` plane peer_id **110** (10.88.127.110), `cortex-alpha.lan` plane peer_id **150** (10.88.128.150, interface `enp86s0`) | +| `secrets/public_keys/host_keys/pillar-of-autum.pub` | **created** | Device SSH host public key (archived from probe, Stage 3) | +| `secrets/public_keys/wireguard/wg_pillar-of-autum_pub` | **created** | WireGuard public key | +| `secrets/private_keys/wireguard/wg_pillar-of-autum` | **created** | WireGuard private key, age-encrypted to John88 + host (secrix) | +| `flake.nix` | **modified** | Registered `pillar-of-autum = mkX86_64 "pillar-of-autum" { … }` with `xlibre-overlay` extraModules | +| `goldens/pillar-of-autum.json` | **created** | Golden test reference (ground truth) | + +### 3.1 librex11 (XLibre X11) wiring + +"librex11" is the **XLibre X11** server (community fork of X.org X11). It is provided +by the existing `xlibre-overlay` flake input (already used by LINDA) and passed through +`extraModules` in `flake.nix` (flake inputs cannot be referenced from a machine +config's `imports`): + +```nix +pillar-of-autum = mkX86_64 "pillar-of-autum" { + host = topoIp "pillar-of-autum"; + extraModules = [ + xlibre-overlay.nixosModules.overlay-xlibre-xserver # xorg-server → xlibre-xserver + xlibre-overlay.nixosModules.overlay-all-xlibre-drivers # X11 drivers + ]; +}; +``` + +Verified applied: `services.xserver.terminateOnReset = false` (set by the overlay) and +28 nixpkgs overlays present. + +### 3.2 Headed environment (similar to alpha-one) + +`machines/pillar-of-autum/default.nix` imports `environments/i3wm_darthpjb.nix` +(i3 + lightdm + bargman greeter + picom), the same headed stack as `alpha-one`, but +**without** alpha-one's NVIDIA driver, opencode-fleet, or the heavy environment +modules (steam, code, neovim, etc.) — hence "minimal". Intel integrated graphics use +the default modesetting driver (`hardware.graphics.enable = true`). + +### 3.3 Bootloader + +The config mirrors the bootstrap image's **GRUB EFI removable** bootloader +(`efiInstallAsRemovable = true`, `canTouchEfiVariables = false`) so the first +nixinate `switch` activates cleanly on the existing ESP. A permanent-install +bootloader migration (systemd-boot on the NVMe) is a documented follow-up +(see `planning-pillar-of-autum.md`, Phase 3). + +--- + +## 4. Validation Performed (Completed) + +| Check | Command | Result | +|-------|---------|--------| +| Config evaluates | `nix eval … .config.networking.hostName` | `"pillar-of-autum"` | +| WireGuard enabled | `… .config.networking.wireguard.enable` | `true` (10.88.127.110/32, hub peer cortex-alpha) | +| X server + i3 + lightdm | `… .config.services.xserver.{enable,windowManager.i3.enable,displayManager.lightdm.enable}` | all `true` | +| XLibre overlay applied | `… .config.services.xserver.terminateOnReset` | `false` | +| Golden generated | `nix run .#dump-config -- pillar-of-autum \| jq -S . > goldens/pillar-of-autum.json` | 85 KB | +| Golden matches | `nix run .#validate-goldens -- pillar-of-autum` | ✓ matches | +| Topology coverage | `lib/golden_coverage.nix` | 100% (12/12), no missing | +| Topology registry | `lib/topology/mkRegistry.nix` | 0 errors, 0 warnings | + +**Note on git tracking:** Nix flakes only see git-tracked paths. New files required +`git add -N ` (intent-to-add) before `nix eval`/`nix run` could resolve them. + +--- + +## 5. Deployment Workflow (Follow-up — nixinate) + +This is the runbook for the first "proven" deployment. It mirrors +`documentation/x86-bootstrap-deployment-workflow.md` Stages 5–7. + +### Pre-deployment checklist + +- [ ] Probe still reachable: `avahi-resolve -n x86-bootstrap.local` → `10.88.128.150` +- [ ] SSH works: `ssh -p 1108 inspect@10.88.128.150 "hostname"` → `x86-bootstrap` +- [ ] Golden passes: `nix run .#validate-goldens -- pillar-of-autum` +- [ ] WG keys present: `ls secrets/public_keys/wireguard/wg_pillar-of-autum_pub` +- [ ] Host key archived: `ls secrets/public_keys/host_keys/pillar-of-autum.pub` + +### Stage A — Deploy over LAN (temporary) + +1. **Point flake.nix at the device's LAN IP** (temporary): + ```nix + pillar-of-autum = mkX86_64 "pillar-of-autum" { + host = "10.88.128.150"; # TEMPORARY: LAN IP (was: topoIp "pillar-of-autum") + … + }; + ``` +2. **Deploy with nixinate** (switches the running USB system): + ```bash + nix run .#pillar-of-autum --option builders '' -- switch + ``` +3. **Reset flake.nix** to the WireGuard IP: + ```nix + host = topoIp "pillar-of-autum"; # back to 10.88.127.110 + ``` +4. **Commit and push** the reset. + +### Stage B — Verify + +1. **WireGuard connectivity:** `ping 10.88.127.110` +2. **SSH on WG:** `ssh -p 1108 deploy@10.88.127.110` +3. **Hostname changed:** `ssh -p 1108 inspect@10.88.127.110 "hostname"` → `pillar-of-autum` +4. **Headed session:** confirm lightdm greeter + i3 session on the attached display + (XLibre X11 server running). +5. **Golden re-check:** `nix run .#validate-goldens -- pillar-of-autum` + +### Stage C — Post-deployment + +- [ ] Add `pillar-of-autum` to `~/.ssh/config` (inspect + deploy entries, port 1108) +- [ ] Record the deployment in `shared_updates.md` +- [ ] Proceed to `planning-pillar-of-autum.md` Phase 2 (AI backend) / Phase 3 (NVMe) + +--- + +## 6. Key Differences from Prior Deployments + +| Aspect | arm-bootstrap (ARM) | x86-bootstrap → pillar-of-autum | +|--------|---------------------|----------------------------------| +| Image format | SD card (`.img`) | Raw disk (`.raw`, GPT, USB) | +| SSH port | 22 | 1108 | +| Module source | Raw NixOS modules | assimilator-probe nixosModule | +| Cross-compilation | Yes (x86_64 → aarch64) | No (native x86_64) | +| Bootloader | extlinux (Raspberry Pi) | GRUB EFI removable (`EFI/BOOT/BOOTX64.EFI`) | +| Diagnostics | None | Boot-time `/run/diagnostics/hardware.json` | +| X server | — | **XLibre (librex11)** via xlibre-overlay | +| Determinate Nix | Not in bootstrap | Not in bootstrap (native build on first deploy) | + +--- + +## 7. Lessons / Notes + +1. **Spelling discipline:** `pillar-of-autum` (no extra `n`). Enforced in code comments, + topology `hostname`, and golden. +2. **Git intent-to-add:** New files must be `git add -N` before Nix can see them in a + flake. +3. **secrix system resolution:** `nix run .#secrix encrypt … -s ` resolves the + host from `nixosConfigurations` — the machine must be registered in `flake.nix` + **before** its WG private key can be encrypted with `-s `. +4. **Bootloader continuity:** Keep GRUB EFI removable for the first `switch` so the + existing ESP boots the new kernel without EFI-variable changes. +5. **Read-only inspection:** All probe hardware discovery used the `inspect` user + (no sudo, port 1108) per the SSH Access Standard. diff --git a/documentation/planning-pillar-of-autum.md b/documentation/planning-pillar-of-autum.md new file mode 100644 index 00000000..4a9635c7 --- /dev/null +++ b/documentation/planning-pillar-of-autum.md @@ -0,0 +1,145 @@ +# pillar-of-autum — Planning: Velocity & Track + +> **Last updated:** 2026-08-27 +> **Status:** Phase 1 (assimilation) configuration complete. Planning Phases 2–4. +> **Companion runbook:** `pillar-of-autum.md` (workflow record + deployment runbook) + +This document holds the **expected velocity and track** for `pillar-of-autum` from +first assimilation through its intended role as a fleet **AI inference backend**. + +--- + +## 1. Mission & Intended Future Purpose + +`pillar-of-autum` (ASUS NUC14RVH-B, Intel Core Ultra 5 125H, 16 GiB RAM, integrated +Arc graphics) is being assimilated as the **first proven assimilator-probe deployment**. + +Its intended future purpose, per `documentation/ai-stack.md` +("Future Expansion → Additional backends: **pillar-of-autum**, dlyon-PC (provisioning)"), +is to become an **AI inference backend** for the fleet LiteLLM gateway +(`agentic-gateway.johnbargman.net`), alongside LINDA (CPU+GPU) and cluster-box (GPU). + +The NUC's Intel Core Ultra 5 125H has an integrated **Arc (Meteor Lake) GPU** with +oneAPI/Vulkan support — a candidate for CPU+iGPU inference (Ollama) without a discrete +GPU. + +--- + +## 2. Track (Phases) + +### Phase 1 — Assimilation & Proven Bootstrap (CURRENT) + +**Goal:** Prove the assimilator-probe x86-bootstrap workflow end-to-end; deploy a +minimal librex11 headed system. + +| # | Task | Status | +|---|------|--------| +| 1.1 | Probe discovery (mDNS + inspect SSH) | ✅ done | +| 1.2 | Hardware capture → `hardware-configuration.nix` | ✅ done | +| 1.3 | Minimal librex11 headed config (i3 + lightdm + XLibre) | ✅ done | +| 1.4 | Topology (WG peer 110, LAN peer 150) + WG keys (secrix) | ✅ done | +| 1.5 | flake.nix registration + golden + validation | ✅ done | +| 1.6 | **nixinate `switch` over LAN (10.88.128.150)** | ⏳ pending | +| 1.7 | Verify WG (10.88.127.110) + headed session | ⏳ pending | +| 1.8 | Reset flake.nix to WG IP + commit | ⏳ pending | + +**Exit criteria:** `pillar-of-autum` reachable on WireGuard at 10.88.127.110, hostname +changed, lightdm+i3 (XLibre) session visible on display, golden passes. + +### Phase 2 — AI Inference Backend + +**Goal:** Stand up Ollama (CPU + iGPU) and register as a LiteLLM backend. + +| # | Task | Notes | +|---|------|-------| +| 2.1 | Evaluate iGPU inference (oneAPI/Vulkan, Arc on Meteor Lake) | Determine viable model sizes | +| 2.2 | Add `services/ollama.nix` (or vLLM) to machine config | CPU-only first, iGPU if viable | +| 2.3 | Pre-load 1–2 models (e.g. a 7–14B Q4) | Single-model-per-device discipline | +| 2.4 | Register backend in `machines/alpha-three/default.nix` LiteLLM | `pillar-of-autum/*` prefix | +| 2.5 | Prometheus scrape target + Grafana dashboard entry | Close the "missing monitoring" gap | +| 2.6 | Regenerate golden + deploy | `nix run .#pillar-of-autum -- switch` | + +**Exit criteria:** `curl https://agentic-gateway.johnbargman.net/v1/models` lists +`pillar-of-autum/*`; a chat completion routes to the NUC and returns. + +### Phase 3 — Permanent Install (NVMe) + +**Goal:** Migrate from the USB boot medium to the 238.5 GiB NVMe for a durable install. + +| # | Task | Notes | +|---|------|-------| +| 3.1 | Partition/format `nvme0n1` (ESP + root + swap) | disko or manual; back up first | +| 3.2 | Update `hardware-configuration.nix` fileSystems to NVMe UUIDs | Regenerate golden | +| 3.3 | Migrate bootloader to systemd-boot (non-removable) | Set EFI boot variable | +| 3.4 | Copy `/nix/store` closure to NVMe (see operational_patterns.md) | Re-copy after deploy | +| 3.5 | Rebuild + switch from NVMe; verify boot | Remove USB | + +**Exit criteria:** System boots from NVMe, USB removed, all services + WG intact. + +### Phase 4 — Fleet Integration & Hardening + +**Goal:** Full fleet membership. + +| # | Task | Notes | +|---|------|-------| +| 4.1 | Add to `~/.ssh/config` (inspect + deploy) | Port 1108 | +| 4.2 | CI build job (x86_64 machine list) | `ci.nix` auto-derives from nixosConfigurations | +| 4.3 | Backup topology key (if applicable) | `topology.backup` | +| 4.4 | genWireguard migration (overlord-iii) | When the pipeline lands | + +--- + +## 3. Expected Velocity + +Estimates assume a single operator + agent, builds from source (no third-party cache), +and the in-house binary cache **not** yet operational (per AGENTS.md Build Philosophy). + +| Phase | Scope | Expected velocity | Dominant cost | +|-------|-------|-------------------|---------------| +| **Phase 1** | Assimilation + first deploy | **~0.5–1 day** (config done; deploy + verify is the remainder) | nixinate `switch` closure copy over LAN; first native build of Determinate Nix + XLibre on-target | +| **Phase 2** | AI backend | **~2–4 days** | iGPU inference evaluation (oneAPI/Vulkan on Meteor Lake is the unknown); model download + VRAM/RAM sizing; gateway wiring | +| **Phase 3** | NVMe permanent install | **~1–2 days** | `/nix/store` migration + bootloader cutover; low technical risk, high care | +| **Phase 4** | Fleet integration | **~0.5–1 day** | CI + backup + hardening; mostly mechanical | + +**Total to full AI-backend fleet member: ~4–8 working days**, dominated by Phase 2's +iGPU inference evaluation. + +### Velocity assumptions & risks + +- **Correctness over speed** (AGENTS.md): a four-hour build is acceptable if it + guarantees correctness. Estimates are floors, not deadlines. +- **No third-party cache:** builds complete from source within the closed environment + until the in-house binary cache is operational. First on-target builds (Determinate + Nix, XLibre, Ollama) are the slowest step. +- **iGPU inference is the key unknown:** Meteor Lake Arc + oneAPI/Vulkan + Ollama is + not yet proven in this fleet. If iGPU inference is not viable, Phase 2 falls back to + **CPU-only Ollama** (still a valid backend, smaller models), which is faster to land. +- **Single-model-per-device:** enforce one model per device to prevent RAM/VRAM + exhaustion (ai-stack.md "Current Limitations"). + +--- + +## 4. Dependencies + +| Dependency | Status | Blocks | +|------------|--------|--------| +| assimilator-probe flake input | ✅ pinned in flake.lock | Phase 1 | +| xlibre-overlay flake input | ✅ pinned (main, for 26.05) | Phase 1 (XLibre) | +| nixinate | ✅ flake input | Phase 1 (deploy) | +| secrix | ✅ flake input | Phase 1 (WG keys) | +| LiteLLM gateway (alpha-three) | ✅ active (staging) | Phase 2 | +| Ollama / vLLM modules | ✅ `services/ollama.nix`, `modules/vllm.nix` | Phase 2 | +| In-house binary cache | ⏳ planned | All phases (speed) | +| genWireguard pipeline (overlord-iii) | ⏳ deferred | Phase 4 | + +--- + +## 5. Decision Log + +| Date | Decision | Rationale | +|------|----------|-----------| +| 2026-08-27 | Name is `pillar-of-autum` (no extra `n`) | User directive; misspelling `pillar-of-autumn` prohibited in code | +| 2026-08-27 | Initial config = minimal librex11 headed (i3 + lightdm + XLibre) | User directive; similar to alpha-one but minimal | +| 2026-08-27 | WG peer_id 110, LAN peer_id 150 | 110 is next free after alpha series (107–109); 150 matches current DHCP address | +| 2026-08-27 | Keep GRUB EFI removable for first `switch` | Bootloader continuity on existing ESP; systemd-boot is a Phase 3 follow-up | +| 2026-08-27 | hardware-configuration.nix references USB (sda) partitions | First deploy switches the running USB system; NVMe is Phase 3 | diff --git a/flake.nix b/flake.nix index bace160b..f24d704b 100644 --- a/flake.nix +++ b/flake.nix @@ -679,6 +679,19 @@ ]; }; + # pillar-of-autum — first machine assimilated via the assimilator-probe + # x86-bootstrap workflow. Minimal librex11 (XLibre X11) headed system. + # Spelling is "pillar-of-autum" — NOT "pillar-of-autumn". + # Future purpose: AI inference backend (see documentation/ai-stack.md). + pillar-of-autum = mkX86_64 "pillar-of-autum" { + host = topoIp "pillar-of-autum"; + extraModules = [ + # librex11 — overlay xorg-server with xlibre-xserver + X11 drivers + xlibre-overlay.nixosModules.overlay-xlibre-xserver + xlibre-overlay.nixosModules.overlay-all-xlibre-drivers + ]; + }; + LINDA = mkX86_64 "LINDA" { host = topoIp "LINDA"; buildOn = "remote"; diff --git a/goldens/pillar-of-autum.json b/goldens/pillar-of-autum.json new file mode 100644 index 00000000..e682c76c --- /dev/null +++ b/goldens/pillar-of-autum.json @@ -0,0 +1,2800 @@ +{ + "boot.kernel.sysctl": { + "fs.inotify.max_user_instances": 524288, + "fs.inotify.max_user_watches": 524288, + "kernel.kptr_restrict": 1, + "kernel.pid_max": 4194304, + "kernel.poweroff_cmd": "/vv5bna641lxwxm0nqgy20134y7wivsvp-systemd-260.2/sbin/poweroff", + "kernel.printk": "7 7 7 7", + "net.core.rmem_max": null, + "net.core.wmem_max": null, + "net.ipv4.ping_group_range": "0 2147483647", + "net.ipv6.conf.all.disable_ipv6": false, + "net.ipv6.conf.default.disable_ipv6": false, + "net.ipv6.conf.default.use_tempaddr": "2", + "vm.max_map_count": 1048576 + }, + "boot.loader": { + "efi": { + "canTouchEfiVariables": false, + "efiSysMountPoint": "/boot" + }, + "external": { + "enable": false, + "installHook": "" + }, + "generationsDir": { + "copyKernels": false, + "enable": false + }, + "generic-extlinux-compatible": { + "configurationLimit": 20, + "enable": false, + "mirroredBoots": [ + { + "path": "/boot" + } + ], + "populateCmd": "", + "useGenerationDeviceTree": true + }, + "grub": { + "backgroundColor": "#2F302F", + "bootDevice": "", + "configurationLimit": 100, + "configurationName": "", + "copyKernels": false, + "default": "0", + "device": "nodev", + "devices": [ + "nodev" + ], + "efiInstallAsRemovable": true, + "efiSupport": true, + "enable": true, + "enableCryptodisk": false, + "entryOptions": "--class nixos --unrestricted", + "extraConfig": "", + "extraEntries": "", + "extraEntriesBeforeNixOS": false, + "extraFiles": {}, + "extraGrubInstallArgs": [], + "extraInitrd": "", + "extraInstallCommands": "", + "extraPerEntryConfig": "", + "extraPrepareConfig": "", + "font": "/j3j5mhgy5nbzgdri8vpw6bz093vnlspl-grub-2.12/share/grub/unicode.pf2", + "fontSize": null, + "forceInstall": false, + "forcei686": false, + "fsIdentifier": "uuid", + "gfxmodeBios": "1024x768", + "gfxmodeEfi": "auto", + "gfxpayloadBios": "text", + "gfxpayloadEfi": "keep", + "ipxe": {}, + "memtest86": { + "enable": false, + "params": [] + }, + "mirroredBoots": [ + { + "devices": [ + "nodev" + ], + "efiBootloaderId": null, + "efiSysMountPoint": "/boot", + "path": "/boot" + } + ], + "splashImage": "/z6dhhmy6afwq5mlhhl7m9cjmmyxq9b43-simple-dark-gray-bootloader-2018-08-28/share/backgrounds/nixos/nix-wallpaper-simple-dark-gray_bootloader.png", + "splashMode": "normal", + "storePath": "/nix/store", + "subEntryOptions": "--class nixos", + "theme": null, + "timeout": 5, + "timeoutStyle": "menu", + "trustedBoot": "", + "useOSProber": false, + "users": {}, + "version": "", + "zfsPackage": "", + "zfsSupport": false + }, + "gummiboot": { + "enable": false, + "timeout": 5 + }, + "initScript": { + "enable": false + }, + "limine": { + "additionalFiles": {}, + "biosDevice": "nodev", + "biosSupport": false, + "efiInstallAsRemovable": true, + "efiSupport": true, + "enable": false, + "enableEditor": false, + "enrollConfig": false, + "extraConfig": "", + "extraEntries": "", + "force": false, + "forceMbr": false, + "maxGenerations": null, + "package": "", + "panicOnChecksumMismatch": false, + "partitionIndex": null, + "resolution": null, + "secureBoot": { + "autoEnrollKeys": { + "enable": false, + "extraArgs": [ + "--microsoft", + "--firmware-builtin" + ] + }, + "autoGenerateKeys": false, + "enable": false, + "sbctl": "" + }, + "style": { + "backdrop": "2F302F", + "graphicalTerminal": { + "background": null, + "brightBackground": null, + "brightForeground": null, + "brightPalette": null, + "font": { + "scale": null, + "spacing": null + }, + "foreground": null, + "margin": null, + "marginGradient": null, + "palette": null + }, + "interface": { + "branding": null, + "brandingColor": null, + "helpColor": null, + "helpColorBright": null, + "helpHidden": false, + "resolution": null + }, + "wallpaperStyle": "stretched", + "wallpapers": [ + "/z6dhhmy6afwq5mlhhl7m9cjmmyxq9b43-simple-dark-gray-bootloader-2018-08-28/share/backgrounds/nixos/nix-wallpaper-simple-dark-gray_bootloader.png" + ] + }, + "validateChecksums": true + }, + "raspberryPi": "", + "refind": { + "additionalFiles": {}, + "efiInstallAsRemovable": true, + "enable": false, + "extraConfig": "", + "maxGenerations": null, + "package": "" + }, + "supportsInitrdSecrets": true, + "systemd-boot": { + "configurationLimit": 5, + "consoleMode": "keep", + "editor": true, + "edk2-uefi-shell": { + "enable": false, + "sortKey": "o_edk2-uefi-shell" + }, + "enable": false, + "extraEntries": {}, + "extraFiles": {}, + "extraInstallCommands": "", + "graceful": false, + "installDeviceTree": false, + "memtest86": { + "enable": false, + "entryFilename": "_mkMergedOptionModule", + "sortKey": "o_memtest86" + }, + "netbootxyz": { + "enable": false, + "entryFilename": "_mkMergedOptionModule", + "sortKey": "o_netbootxyz" + }, + "rebootForBitlocker": false, + "sortKey": "nixos", + "windows": {}, + "xbootldrMountPoint": null + }, + "timeout": 5 + }, + "boot.supportedFilesystems": { + "ext4": true, + "vfat": true + }, + "environment.systemPackages": [ + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "", + "" + ], + "networking.domain": null, + "networking.firewall": { + "allInterfaces": { + "default": { + "allowedTCPPortRanges": [], + "allowedTCPPorts": [ + 1108, + 2108 + ], + "allowedUDPPortRanges": [], + "allowedUDPPorts": [ + 2108 + ] + }, + "wireg0": { + "allowedTCPPortRanges": [], + "allowedTCPPorts": [ + 3107, + 3111, + 9100 + ], + "allowedUDPPortRanges": [], + "allowedUDPPorts": [] + } + }, + "allowPing": true, + "allowedTCPPortRanges": [], + "allowedTCPPorts": [ + 1108, + 2108 + ], + "allowedUDPPortRanges": [], + "allowedUDPPorts": [ + 2108 + ], + "autoLoadConntrackHelpers": false, + "backend": "iptables", + "checkReversePath": true, + "connectionTrackingModules": [], + "enable": true, + "extraCommands": "# Helper command to manipulate both the IPv4 and IPv6 tables.\nip46tables() {\n iptables -w \"$@\"\n ip6tables -w \"$@\"\n\n}\n\nip46tables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true\nip46tables -w -t nat -F nixos-nat-pre 2>/dev/null || true\nip46tables -w -t nat -X nixos-nat-pre 2>/dev/null || true\nip46tables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true\nip46tables -w -t nat -F nixos-nat-post 2>/dev/null || true\nip46tables -w -t nat -X nixos-nat-post 2>/dev/null || true\nip46tables -w -t nat -D OUTPUT -j nixos-nat-out 2>/dev/null || true\nip46tables -w -t nat -F nixos-nat-out 2>/dev/null || true\nip46tables -w -t nat -X nixos-nat-out 2>/dev/null || true\nip46tables -w -t filter -D FORWARD -j nixos-filter-forward 2>/dev/null || true\nip46tables -w -t filter -F nixos-filter-forward 2>/dev/null || true\nip46tables -w -t filter -X nixos-filter-forward 2>/dev/null || true\n\n\n", + "extraForwardRules": "", + "extraInputRules": "", + "extraPackages": [], + "extraReversePathFilterRules": "", + "extraStopCommands": "", + "filterForward": false, + "interfaces": { + "wireg0": { + "allowedTCPPortRanges": [], + "allowedTCPPorts": [ + 3107, + 3111, + 9100 + ], + "allowedUDPPortRanges": [], + "allowedUDPPorts": [] + } + }, + "logRefusedConnections": false, + "logRefusedPackets": false, + "logRefusedUnicastsOnly": true, + "logReversePathDrops": false, + "package": "", + "pingLimit": null, + "rejectPackets": false, + "trustedInterfaces": [ + "lo" + ] + }, + "networking.hostId": null, + "networking.hostName": "pillar-of-autum", + "networking.interfaces": {}, + "networking.nameservers": [], + "networking.nat": { + "dmzHost": null, + "enable": false, + "enableIPv6": false, + "externalIP": null, + "externalIPv6": null, + "externalInterface": null, + "extraCommands": "", + "extraStopCommands": "", + "forwardPorts": [], + "internalIPs": [], + "internalIPv6s": [], + "internalInterfaces": [] + }, + "networking.nftables": { + "checkRuleset": true, + "checkRulesetRedirects": { + "/etc/hosts": "", + "/etc/protocols": "/55k5zhs3hsxzbwp0acyh0sw8sslgcqig-iana-etc-20251215/etc/protocols", + "/etc/services": "/55k5zhs3hsxzbwp0acyh0sw8sslgcqig-iana-etc-20251215/etc/services" + }, + "enable": false, + "extraDeletions": "", + "flattenRulesetFile": false, + "flushRuleset": false, + "preCheckRuleset": "", + "rulesetFile": null, + "tables": {} + }, + "networking.tailscale": null, + "networking.wireguard": { + "enable": true, + "interfaces": { + "wireg0": { + "allowedIPsAsRoutes": true, + "dynamicEndpointRefreshSeconds": 0, + "extraOptions": {}, + "fwMark": null, + "generatePrivateKeyFile": false, + "interfaceNamespace": null, + "ips": [ + "10.88.127.110/32" + ], + "listenPort": 2108, + "metric": null, + "mtu": null, + "peers": [ + { + "allowedIPs": [ + "10.88.127.1/32", + "10.88.127.0/24" + ], + "dynamicEndpointRefreshRestartSeconds": null, + "dynamicEndpointRefreshSeconds": 300, + "endpoint": "cortex-alpha.johnbargman.net:2108", + "name": "lMo4Rf3nlXqd8rIX7rNMedygdsHTZqh\\x2bNLxre\\x2bvwYH8\\x3d", + "persistentKeepalive": 60, + "presharedKey": null, + "presharedKeyFile": null, + "publicKey": "lMo4Rf3nlXqd8rIX7rNMedygdsHTZqh+NLxre+vwYH8=" + } + ], + "postSetup": "", + "postShutdown": "", + "preSetup": "", + "preShutdown": "", + "privateKey": null, + "privateKeyFile": "/run/wireguard-wireg0-keys/pillar-of-autum", + "socketNamespace": null, + "table": "main", + "type": "wireguard" + } + }, + "useNetworkd": false + }, + "security.acme": { + "acceptTerms": false, + "activationDelay": "", + "certs": {}, + "defaults": { + "credentialFiles": {}, + "dnsPropagationCheck": true, + "dnsProvider": null, + "dnsResolver": null, + "email": null, + "enableDebugLogs": true, + "environmentFile": null, + "extraLegoFlags": [], + "extraLegoRenewFlags": [], + "extraLegoRunFlags": [], + "group": "acme", + "keyType": "ec256", + "listenHTTP": null, + "ocspMustStaple": false, + "postRun": "", + "profile": null, + "reloadServices": [], + "renewInterval": "daily", + "renewJitter": "24h", + "server": "https://acme-v02.api.letsencrypt.org/directory", + "validMinDays": null, + "webroot": null + }, + "directory": "", + "email": "_mkMergedOptionModule", + "enableDebugLogs": "_mkMergedOptionModule", + "maxConcurrentRenewals": 5, + "preDelay": "", + "preliminarySelfsigned": "", + "production": "", + "renewInterval": "_mkMergedOptionModule", + "server": "_mkMergedOptionModule", + "useRoot": false, + "validMin": "_mkMergedOptionModule", + "validMinDays": "_mkMergedOptionModule" + }, + "services.dnsmasq": { + "alwaysKeepRunning": false, + "configFile": "", + "enable": false, + "extraConfig": "", + "package": "", + "resolveLocalQueries": true, + "settings": { + "server": [] + } + }, + "services.nginx": { + "additionalModules": [], + "appendConfig": "", + "appendHttpConfig": "", + "clientMaxBodySize": "10m", + "commonHttpConfig": "", + "config": "", + "defaultHTTPListenPort": 80, + "defaultListen": [], + "defaultListenAddresses": [ + "0.0.0.0", + "[::0]" + ], + "defaultMimeTypes": "/46d8jsib4f3adj7qv0ga8929826wlhy8-mailcap-2.1.54/etc/nginx/mime.types", + "defaultSSLListenPort": 443, + "enable": false, + "enableQuicBPF": false, + "enableReload": false, + "eventsConfig": "", + "experimentalZstdSettings": false, + "gitweb": { + "enable": false, + "group": "nginx", + "location": "/gitweb", + "user": "nginx", + "virtualHost": "_" + }, + "group": "nginx", + "httpConfig": "", + "logError": "stderr", + "mapHashBucketSize": null, + "mapHashMaxSize": null, + "package": "", + "preStart": "", + "prependConfig": "", + "proxyResolveWhileRunning": false, + "proxyTimeout": "60s", + "recommendedBrotliSettings": false, + "recommendedGzipSettings": false, + "recommendedOptimisation": false, + "recommendedProxySettings": false, + "recommendedTlsSettings": false, + "recommendedUwsgiSettings": false, + "recommendedZstdSettings": "", + "resolver": { + "addresses": [], + "ipv4": true, + "ipv6": true, + "valid": "" + }, + "serverNamesHashBucketSize": null, + "serverNamesHashMaxSize": null, + "serverTokens": false, + "sslCiphers": [ + "ECDHE-ECDSA-AES128-GCM-SHA256", + "ECDHE-RSA-AES128-GCM-SHA256", + "ECDHE-ECDSA-AES256-GCM-SHA384", + "ECDHE-RSA-AES256-GCM-SHA384", + "ECDHE-ECDSA-CHACHA20-POLY1305", + "ECDHE-RSA-CHACHA20-POLY1305", + "DHE-RSA-AES128-GCM-SHA256", + "DHE-RSA-AES256-GCM-SHA384", + "DHE-RSA-CHACHA20-POLY1305" + ], + "sslDhparam": false, + "sslProtocols": "TLSv1.2 TLSv1.3", + "sso": { + "configuration": {}, + "enable": false, + "package": "" + }, + "stateDir": "", + "streamConfig": "", + "tailscaleAuth": { + "enable": false, + "expectedTailnet": "", + "group": "tailscale-nginx-auth", + "package": "", + "socketPath": "/run/tailscale-nginx-auth/tailscale-nginx-auth.sock", + "user": "tailscale-nginx-auth", + "virtualHosts": [] + }, + "typesHashMaxSize": 2688, + "upstreams": {}, + "user": "nginx", + "uwsgiResolveWhileRunning": false, + "uwsgiTimeout": "60s", + "validateConfigFile": true, + "virtualHosts": { + "localhost": { + "acmeFallbackHost": null, + "acmeRoot": "/var/lib/acme/acme-challenge", + "addSSL": false, + "basicAuth": {}, + "basicAuthFile": null, + "default": false, + "enableACME": false, + "extraConfig": "", + "forceSSL": false, + "globalRedirect": null, + "http2": true, + "http3": true, + "http3_hq": false, + "kTLS": false, + "listen": [], + "listenAddresses": [], + "locations": {}, + "onlySSL": false, + "quic": false, + "redirectCode": 301, + "rejectSSL": false, + "reuseport": false, + "root": null, + "serverAliases": [], + "serverName": null, + "sslCertificate": "", + "sslCertificateKey": "", + "sslTrustedCertificate": null, + "useACMEHost": null + } + } + }, + "services.openldap": { + "configDir": null, + "declarativeContents": {}, + "enable": false, + "group": "openldap", + "mutableConfig": false, + "package": "", + "settings": { + "attrs": {}, + "children": {}, + "includes": [] + }, + "urlList": [ + "ldap:///" + ], + "user": "openldap" + }, + "services.openssh": { + "allowSFTP": true, + "authorizedKeysCommand": "none", + "authorizedKeysCommandUser": "nobody", + "authorizedKeysFiles": [ + "%h/.ssh/authorized_keys", + "/etc/ssh/authorized_keys.d/%u" + ], + "authorizedKeysInHomedir": true, + "banner": "", + "challengeResponseAuthentication": false, + "ciphers": [ + "chacha20-poly1305@openssh.com", + "aes256-gcm@openssh.com", + "aes128-gcm@openssh.com", + "aes256-ctr", + "aes192-ctr", + "aes128-ctr" + ], + "enable": true, + "enableRecommendedAlgorithms": true, + "extraConfig": "AddressFamily any\nPort 1108\nListenAddress 10.88.127.110:1108\nXAuthLocation /nix/store/v8g0jrwj694rlh071fvmzhkwyv999k7d-xauth-1.1.5/bin/xauth\nSubsystem sftp /nix/store/hv4l15j1pzpf7qi4ci7fr9k4hfg56mj1-openssh-10.4p1/libexec/sftp-server \nAuthorizedKeysFile %h/.ssh/authorized_keys /etc/ssh/authorized_keys.d/%u\nHostKey /etc/ssh/ssh_host_ed25519_key\nMatch LocalPort 1108 User inspect Address 10.88.127.0/24\n PermitRootLogin no\n PasswordAuthentication no\n\nMatch LocalPort 1108 User deploy Address 10.88.127.0/24\n PermitRootLogin no\n PasswordAuthentication = no\n", + "forwardX11": false, + "gatewayPorts": "no", + "generateHostKeys": true, + "hostKeys": [ + { + "path": "/etc/ssh/ssh_host_ed25519_key", + "type": "ed25519" + } + ], + "kbdInteractiveAuthentication": false, + "kexAlgorithms": [ + "mlkem768x25519-sha256", + "sntrup761x25519-sha512", + "sntrup761x25519-sha512@openssh.com", + "curve25519-sha256", + "curve25519-sha256@libssh.org", + "diffie-hellman-group-exchange-sha256" + ], + "knownHosts": { + "LINDA": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "LINDA", + "LINDA.johnbargman.net", + "10.88.127.88", + "10.88.128.88" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMfuVEzn9keN1iVk4rjJmB07+/ynTMaZCKPvbaZ1cF6\n", + "publicKeyFile": null + }, + "alpha-one": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "alpha-one", + "alpha-one.johnbargman.net", + "10.88.127.108", + "10.88.128.108" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINfV4fNuig3xDPKlagqsAp2L2JMJG9L+6BZ/4dY6/UBx\n", + "publicKeyFile": null + }, + "alpha-three": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "alpha-three", + "alpha-three.johnbargman.net", + "10.88.127.107" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0LVdFwjwstGy1wxfNaXI1RR8rYc8wzymHQoteMvB1g\n", + "publicKeyFile": null + }, + "alpha-two": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "alpha-two", + "alpha-two.johnbargman.net", + "10.88.127.109" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOXoFFifrqyXCEYkwjvTRhqLacDEp+X4b21kZfYX8CSg John88@LINDACORE\n", + "publicKeyFile": null + }, + "arm-builder": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "arm-builder", + "arm-builder.johnbargman.net", + "10.88.127.43" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC+YpQJM8r34GjBx1yqpkWQjTYBPwmBUdpZ76dzIEzXO root@arm-bootstrap\n", + "publicKeyFile": null + }, + "cluster-box": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "cluster-box", + "cluster-box.johnbargman.net", + "10.88.127.211" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJC+AjEpZoiItJD7jUUqCUaHRXRapgNwO3dFEblrX9cp root@cluster-box\n", + "publicKeyFile": null + }, + "cortex-alpha": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "cortex-alpha", + "cortex-alpha.johnbargman.net", + "10.88.127.1", + "10.88.128.1", + "82.5.173.252" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILWAilZq7Ocl8zm96sSAy+fRo8wt5mMVuRQmEQsk4MsB root@cortex-alpha\n", + "publicKeyFile": null + }, + "display-0": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "display-0", + "display-0.johnbargman.net", + "10.88.127.40" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINkAJhTTF+WVWixTwIvEtRq5KdpjxPy4ptlcmFSEetrU\n", + "publicKeyFile": null + }, + "display-1": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "display-1", + "display-1.johnbargman.net", + "10.88.127.41" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOOxb+iAm5nTcC3oRsMIcxcciKRj8VnGpp1JIAdGVTZU\n", + "publicKeyFile": null + }, + "display-2": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "display-2", + "display-2.johnbargman.net", + "10.88.127.42" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPcOQZcWlN4XK5OYjI16PM/BWK/8AwKePb1ca/ZRuR1p\n", + "publicKeyFile": null + }, + "gaming-host-1": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "gaming-host-1", + "gaming-host-1.johnbargman.net", + "10.88.127.52" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA45NWTW76+Mt8n2GZjrz2cCjeywYNP8JOXjtkbZxaj6 root@gaming-host\n", + "publicKeyFile": null + }, + "local-nas": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "local-nas", + "local-nas.johnbargman.net", + "10.88.127.3", + "10.88.128.3" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", + "publicKeyFile": null + }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE5fWYYizH6kYupOXVB0Eq7qCl68dUkySNdvFEBeW9zo\n", + "publicKeyFile": null + }, + "print-controller": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "print-controller", + "print-controller.johnbargman.net", + "10.88.127.30", + "10.88.128.10" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBqeo8ceyMoi+SIRP5hhilbhJvFflphD0efolDCxccj9\n", + "publicKeyFile": null + }, + "remote-builder": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "remote-builder", + "remote-builder.johnbargman.net", + "10.88.127.51" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC7Owkd/9PC7j/L5PbPXrSMx0Aw/1owIoCsfp7+5OKek\n", + "publicKeyFile": null + }, + "remote-worker": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "remote-worker", + "remote-worker.johnbargman.net", + "10.88.127.50", + "10.0.1.42", + "193.16.42.101" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPPSFI0IBhhtyMRcMtvHmMBbwklzXiOXw0OPVD3SEC+M\n", + "publicKeyFile": null + }, + "storage-array": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "storage-array", + "storage-array.johnbargman.net", + "10.88.127.4" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMfb/Bbr0PaFDyO92q+GXHHXTAlTYR4uSLm0jivou4IB\n", + "publicKeyFile": null + }, + "terminal-nx-01": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "terminal-nx-01", + "terminal-nx-01.johnbargman.net", + "10.88.127.21", + "10.88.128.22" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOK07xnXN3O2v4EZ7YUzWSL5O+Uf2vM6+jzxROWzaTD5\n", + "publicKeyFile": null + }, + "terminal-zero": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "terminal-zero", + "terminal-zero.johnbargman.net", + "10.88.127.20", + "10.88.128.20" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGlV1inLX9o+Qyf/B3dp6xjb4f9bGisvkT6eFL/f8JIl\n", + "publicKeyFile": null + } + }, + "listenAddresses": [ + { + "addr": "10.88.127.110", + "port": 1108 + } + ], + "logLevel": "INFO", + "macs": [ + "hmac-sha2-512-etm@openssh.com", + "hmac-sha2-256-etm@openssh.com", + "umac-128-etm@openssh.com" + ], + "moduliFile": "/hv4l15j1pzpf7qi4ci7fr9k4hfg56mj1-openssh-10.4p1/etc/ssh/moduli", + "openFirewall": true, + "package": "", + "passwordAuthentication": false, + "permitRootLogin": "no", + "ports": [ + 1108 + ], + "settings": { + "AcceptEnv": null, + "AllowGroups": null, + "AllowTcpForwarding": false, + "AllowUsers": [ + "deploy", + "inspect", + "John88" + ], + "AuthorizedPrincipalsFile": "none", + "Banner": null, + "Ciphers": [ + "chacha20-poly1305@openssh.com", + "aes256-gcm@openssh.com", + "aes128-gcm@openssh.com", + "aes256-ctr", + "aes192-ctr", + "aes128-ctr" + ], + "ClientAliveCountMax": 0, + "ClientAliveInterval": 300, + "DenyGroups": null, + "DenyUsers": null, + "GatewayPorts": "no", + "KbdInteractiveAuthentication": false, + "KexAlgorithms": [ + "mlkem768x25519-sha256", + "sntrup761x25519-sha512", + "sntrup761x25519-sha512@openssh.com", + "curve25519-sha256", + "curve25519-sha256@libssh.org", + "diffie-hellman-group-exchange-sha256" + ], + "LogLevel": "INFO", + "LoginGraceTime": 30, + "Macs": [ + "hmac-sha2-512-etm@openssh.com", + "hmac-sha2-256-etm@openssh.com", + "umac-128-etm@openssh.com" + ], + "MaxAuthTries": 3, + "MaxSessions": 2, + "PasswordAuthentication": false, + "PermitRootLogin": "no", + "PrintMotd": false, + "StrictModes": true, + "UseDns": false, + "UsePAM": true, + "X11Forwarding": false + }, + "sftpFlags": [], + "sftpServerExecutable": "/hv4l15j1pzpf7qi4ci7fr9k4hfg56mj1-openssh-10.4p1/libexec/sftp-server", + "startWhenNeeded": true, + "useDns": false + }, + "services.prometheus": { + "alertmanager": { + "checkConfig": true, + "clusterPeers": [], + "configText": null, + "configuration": null, + "enable": false, + "environmentFile": null, + "extraFlags": [], + "group": "", + "listenAddress": "", + "logFormat": null, + "logLevel": "warn", + "openFirewall": false, + "package": "", + "port": 9093, + "user": "", + "webExternalUrl": null + }, + "alertmanager-ntfy": { + "enable": false, + "extraConfigFiles": [], + "package": "", + "settings": { + "http": { + "addr": "127.0.0.1:8000" + }, + "ntfy": { + "baseurl": "", + "notification": { + "priority": "status == \"firing\" ? \"high\" : \"default\"", + "tags": [ + { + "condition": "status == \"resolved\"", + "tag": "green_circle" + }, + { + "condition": "status == \"firing\"", + "tag": "red_circle" + } + ], + "templates": { + "description": "{{ index .Annotations \"description\" }}\n", + "title": "{{ if eq .Status \"resolved\" }}Resolved: {{ end }}{{ index .Annotations \"summary\" }}\n" + }, + "topic": "" + } + } + } + }, + "alertmanagerGotify": { + "bindAddress": "0.0.0.0", + "debug": false, + "defaultPriority": 5, + "dispatchErrors": false, + "enable": false, + "environmentFile": null, + "extendedDetails": false, + "gotifyEndpoint": { + "host": "127.0.0.1", + "port": 443, + "tls": true + }, + "messageAnnotation": "", + "metrics": { + "namespace": "alertmanager-gotify-bridge", + "path": "/metrics", + "username": "" + }, + "openFirewall": false, + "package": "", + "port": 8080, + "priorityAnnotation": "priority", + "timeout": 5, + "titleAnnotation": "summary", + "webhookPath": "/gotify_webhook" + }, + "alertmanagerIrcRelay": { + "enable": false, + "extraFlags": [], + "package": "", + "settings": null + }, + "alertmanagerNotificationQueueCapacity": 10000, + "alertmanagerTimeout": "", + "alertmanagerURL": "", + "alertmanagerWebhookLogger": { + "enable": false, + "extraFlags": [], + "package": "" + }, + "alertmanagers": [], + "checkConfig": true, + "configText": null, + "enable": false, + "enableAgentMode": false, + "enableReload": false, + "environmentFile": "", + "exporters": { + "apcupsd": { + "apcupsdAddress": ":3551", + "apcupsdNetwork": "tcp", + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "apcupsd-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9162, + "user": "apcupsd-exporter" + }, + "artifactory": { + "artiAccessToken": "", + "artiPassword": "", + "artiUsername": "", + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "artifactory-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9531, + "scrapeUri": "http://localhost:8081/artifactory", + "user": "artifactory-exporter" + }, + "assertions": [ + { + "assertion": true, + "message": "The option definition `rspamd' in no longer has any effect; please remove it.\nThe Rspamd exporter has been removed. You can use the Rspamd /metrics endpoint directly instead:\nhttps://docs.rspamd.com/developers/protocol#controller-http-endpoints\n\n" + }, + { + "assertion": true, + "message": "The option definition `tor' in no longer has any effect; please remove it.\nThe Tor exporter has been removed, as it was broken and unmaintained.\n\n" + }, + { + "assertion": true, + "message": "The option definition `minio' in no longer has any effect; please remove it.\nThe Minio exporter has been removed, as it was broken and unmaintained.\nSee the 24.11 release notes for more information.\n\n" + } + ], + "bind": { + "bindGroups": [ + "server", + "view" + ], + "bindTimeout": "10s", + "bindURI": "http://localhost:8053/", + "bindVersion": "auto", + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "bind-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9119, + "user": "bind-exporter" + }, + "bird": { + "birdSocket": "/run/bird/bird.ctl", + "birdVersion": 2, + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "bird-exporter", + "listenAddress": "0.0.0.0", + "newMetricFormat": true, + "openFirewall": false, + "port": 9324, + "user": "bird-exporter" + }, + "bitcoin": { + "enable": false, + "extraEnv": {}, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "bitcoin-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "package": "", + "port": 9332, + "refreshSeconds": 300, + "rpcHost": "localhost", + "rpcPasswordFile": "", + "rpcPort": 8332, + "rpcScheme": "http", + "rpcUser": "bitcoinrpc", + "user": "bitcoin-exporter" + }, + "blackbox": { + "configFile": "", + "enable": false, + "enableConfigCheck": true, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "blackbox-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9115, + "user": "blackbox-exporter" + }, + "borgmatic": { + "configFile": "/etc/borgmatic/config.yaml", + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "borgmatic-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9996, + "user": "borgmatic-exporter" + }, + "buildkite-agent": { + "enable": false, + "endpoint": "https://agent.buildkite.com/v3", + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "buildkite-agent-exporter", + "interval": "30s", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9876, + "queues": null, + "tokenPath": null, + "user": "buildkite-agent-exporter" + }, + "chrony": { + "chronyServerAddress": "unix:///run/chrony/chronyd.sock", + "disabledCollectors": [], + "enable": false, + "enabledCollectors": [ + "tracking", + "sources", + "sources.with-ntpdata", + "serverstats", + "dns-lookups" + ], + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "chrony", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9123, + "user": "chrony" + }, + "collectd": { + "collectdBinary": { + "authFile": null, + "enable": false, + "listenAddress": "0.0.0.0", + "port": 25826, + "securityLevel": "None" + }, + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "collectd-exporter", + "listenAddress": "0.0.0.0", + "logFormat": "logfmt", + "logLevel": "info", + "openFirewall": false, + "port": 9103, + "user": "collectd-exporter" + }, + "deluge": { + "delugeHost": "localhost", + "delugePassword": null, + "delugePasswordFile": null, + "delugePort": 58846, + "delugeUser": "localclient", + "enable": false, + "exportPerTorrentMetrics": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "deluge-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9354, + "user": "deluge-exporter" + }, + "dmarc": { + "debug": false, + "deduplicationMaxSeconds": 604800, + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "folders": { + "done": "Archive", + "error": "Invalid", + "inbox": "INBOX" + }, + "group": "dmarc-exporter", + "imap": { + "host": "localhost", + "passwordFile": "", + "port": 993, + "username": "" + }, + "listenAddress": "0.0.0.0", + "openFirewall": false, + "pollIntervalSeconds": 60, + "port": 9797, + "user": "dmarc-exporter" + }, + "dnsmasq": { + "dnsmasqListenAddress": "localhost:53", + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "dnsmasq-exporter", + "leasesPath": "/var/lib/dnsmasq/dnsmasq.leases", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9153, + "user": "dnsmasq-exporter" + }, + "dnssec": { + "configuration": null, + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "dnssec-exporter", + "listenAddress": null, + "openFirewall": false, + "port": 9204, + "resolvers": [], + "timeout": null, + "user": "dnssec-exporter" + }, + "domain": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "domain-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9222, + "user": "domain-exporter" + }, + "dovecot": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "dovecot-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9166, + "scopes": [ + "user" + ], + "socketPath": "/var/run/dovecot/stats", + "telemetryPath": "/metrics", + "user": "dovecot-exporter" + }, + "ebpf": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "ebpf-exporter", + "listenAddress": "0.0.0.0", + "names": [], + "openFirewall": false, + "port": 9435, + "user": "ebpf-exporter" + }, + "ecoflow": { + "debug": "0", + "ecoflowAccessKeyFile": "/etc/ecoflow-access-key", + "ecoflowDevicesFile": "/etc/ecoflow-devices", + "ecoflowDevicesPrettyNamesFile": "/etc/ecoflow-devices-pretty-names", + "ecoflowEmailFile": "/etc/ecoflow-email", + "ecoflowPasswordFile": "/etc/ecoflow-password", + "ecoflowSecretKeyFile": "/etc/ecoflow-secret-key", + "enable": false, + "exporterType": "rest", + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "ecoflow-exporter", + "listenAddress": "0.0.0.0", + "mqttDeviceOfflineThreshold": 60, + "openFirewall": false, + "port": 2112, + "prefix": "ecoflow", + "scrapingInterval": 30, + "user": "ecoflow-exporter" + }, + "elasticsearch": { + "enable": false, + "environmentFile": null, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "elasticsearch-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "package": "", + "port": 9114, + "url": "http://localhost:9200", + "user": "elasticsearch-exporter" + }, + "exportarr-bazarr": { + "apiKeyFile": null, + "enable": false, + "environment": {}, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "exportarr-bazarr-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "package": "", + "port": 9708, + "url": "http://127.0.0.1", + "user": "exportarr-bazarr-exporter" + }, + "exportarr-lidarr": { + "apiKeyFile": null, + "enable": false, + "environment": {}, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "exportarr-lidarr-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "package": "", + "port": 9708, + "url": "http://127.0.0.1", + "user": "exportarr-lidarr-exporter" + }, + "exportarr-prowlarr": { + "apiKeyFile": null, + "enable": false, + "environment": {}, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "exportarr-prowlarr-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "package": "", + "port": 9708, + "url": "http://127.0.0.1", + "user": "exportarr-prowlarr-exporter" + }, + "exportarr-radarr": { + "apiKeyFile": null, + "enable": false, + "environment": {}, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "exportarr-radarr-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "package": "", + "port": 9708, + "url": "http://127.0.0.1", + "user": "exportarr-radarr-exporter" + }, + "exportarr-readarr": { + "apiKeyFile": null, + "enable": false, + "environment": {}, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "exportarr-readarr-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "package": "", + "port": 9708, + "url": "http://127.0.0.1", + "user": "exportarr-readarr-exporter" + }, + "exportarr-sonarr": { + "apiKeyFile": null, + "enable": false, + "environment": {}, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "exportarr-sonarr-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "package": "", + "port": 9708, + "url": "http://127.0.0.1", + "user": "exportarr-sonarr-exporter" + }, + "fastly": { + "configFile": null, + "enable": false, + "environmentFile": "", + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "fastly-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9118, + "user": "fastly-exporter" + }, + "flow": { + "asn": "", + "brokers": [], + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "flow-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "partitions": [], + "port": 9590, + "topic": "", + "user": "flow-exporter" + }, + "fritz": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "fritz-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9787, + "settings": { + "devices": [], + "listen_address": "0.0.0.0", + "log_level": "INFO", + "port": 9787 + }, + "user": "fritz-exporter" + }, + "fritzbox": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "gatewayAddress": "fritz.box", + "gatewayPort": 49000, + "group": "fritzbox-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9133, + "user": "fritzbox-exporter" + }, + "frr": { + "disabledCollectors": [], + "enable": false, + "enabledCollectors": [], + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "frrvty", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9342, + "user": "frr" + }, + "graphite": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "graphitePort": 9109, + "group": "graphite-exporter", + "listenAddress": "0.0.0.0", + "mappingSettings": {}, + "openFirewall": false, + "port": 9108, + "user": "graphite-exporter" + }, + "idrac": { + "configuration": null, + "configurationPath": null, + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "idrac-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9348, + "user": "idrac-exporter" + }, + "imap-mailstat": { + "accounts": {}, + "configurationFile": "", + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "imap-mailstat-exporter", + "listenAddress": "0.0.0.0", + "oldestUnseenDate": false, + "openFirewall": false, + "port": 8081, + "user": "imap-mailstat-exporter" + }, + "influxdb": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "influxdb-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9122, + "sampleExpiry": "5m", + "udpBindAddress": ":9122", + "user": "influxdb-exporter" + }, + "ipmi": { + "configFile": null, + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "ipmi-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9290, + "user": "ipmi-exporter", + "webConfigFile": null + }, + "jitsi": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "jitsi-exporter", + "interval": "30s", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9700, + "url": "http://localhost:8080/colibri/stats", + "user": "jitsi-exporter" + }, + "json": { + "assertions": [ + { + "assertion": true, + "message": "The option definition `url' in no longer has any effect; please remove it.\nThis option was removed. The URL of the endpoint serving JSON\nmust now be provided to the exporter by prometheus via the url\nparameter `target'.\n\nIn prometheus a scrape URL would look like this:\n\n http://some.json-exporter.host:7979/probe?target=https://example.com/some/json/endpoint\n\nFor more information, take a look at the official documentation\n(https://github.com/prometheus-community/json_exporter) of the json_exporter.\n\n" + } + ], + "configFile": "", + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "json-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 7979, + "url": "", + "user": "json-exporter", + "warnings": [] + }, + "junos-czerwonk": { + "configuration": null, + "configurationFile": null, + "enable": false, + "environmentFile": null, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "junos-czerwonk-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9326, + "telemetryPath": "/metrics", + "user": "junos-czerwonk-exporter" + }, + "kafka": { + "enable": false, + "environmentFile": null, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "kafka-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "package": "", + "port": 8080, + "user": "kafka-exporter" + }, + "kea": { + "controlSocketPaths": [], + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "kea-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9547, + "targets": [], + "user": "kea-exporter" + }, + "keylight": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "keylight-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9288, + "user": "keylight-exporter" + }, + "klipper": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "klipper-exporter", + "listenAddress": "0.0.0.0", + "moonrakerApiKey": "", + "openFirewall": false, + "package": "", + "port": 9101, + "user": "klipper-exporter" + }, + "knot": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "knot-exporter", + "knotLibraryPath": null, + "knotSocketPath": "/run/knot/knot.sock", + "knotSocketTimeout": 2000, + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9433, + "user": "knot-exporter" + }, + "libvirt": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "libvirt-exporter", + "libvirtUri": "qemu:///system", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9177, + "user": "libvirt-exporter" + }, + "lnd": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "lnd-exporter", + "listenAddress": "0.0.0.0", + "lndHost": "localhost:10009", + "lndMacaroonDir": "", + "lndTlsPath": "", + "openFirewall": false, + "port": 9092, + "user": "lnd-exporter" + }, + "mail": { + "configFile": null, + "configuration": null, + "enable": false, + "environmentFile": null, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "mail-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9225, + "telemetryPath": "/metrics", + "user": "mail-exporter" + }, + "mailman3": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "mailman3-exporter", + "listenAddress": "0.0.0.0", + "logLevel": "info", + "mailman": { + "addr": "http://127.0.0.1:8001", + "passFile": "", + "user": "restadmin" + }, + "openFirewall": false, + "port": 9934, + "user": "mailman3-exporter" + }, + "mikrotik": { + "configFile": null, + "configuration": null, + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "mikrotik-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9436, + "user": "mikrotik-exporter" + }, + "minio": "", + "modemmanager": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "modemmanager-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9539, + "refreshRate": "5s", + "user": "modemmanager-exporter" + }, + "mongodb": { + "collStats": [], + "collectAll": false, + "collector": [], + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "mongodb-exporter", + "indexStats": [], + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9216, + "telemetryPath": "/metrics", + "uri": "mongodb://localhost:27017/test", + "user": "mongodb-exporter" + }, + "mqtt": { + "enable": false, + "environmentFile": null, + "esphomeTopicPrefixes": [], + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "mqtt-exporter", + "hubitatTopicPrefixes": [ + "hubitat/" + ], + "keepFullTopic": false, + "listenAddress": "0.0.0.0", + "logLevel": "INFO", + "logMqttMessage": false, + "mqttAddress": "127.0.0.1", + "mqttClientId": null, + "mqttExposeClientId": false, + "mqttIgnoredTopics": [], + "mqttKeepAlive": 60, + "mqttPort": 1883, + "mqttTopic": "#", + "mqttUsername": null, + "mqttV5Protocol": false, + "openFirewall": false, + "port": 9000, + "prometheusPrefix": "mqtt_", + "topicLabel": "topic", + "user": "mqtt-exporter", + "zigbee2MqttAvailability": false, + "zwaveTopicPrefix": "zwave/" + }, + "mysqld": { + "configFile": "", + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "mysqld-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9104, + "runAsLocalSuperUser": false, + "telemetryPath": "/metrics", + "user": "mysqld-exporter" + }, + "nats": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "nats-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 7777, + "url": "http://127.0.0.1:8222", + "user": "nats-exporter" + }, + "nextcloud": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "nextcloud-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "passwordFile": null, + "port": 9205, + "timeout": "5s", + "tokenFile": null, + "url": "", + "user": "nextcloud-exporter", + "username": "nextcloud-exporter" + }, + "nginx": { + "assertions": [ + { + "assertion": true, + "message": "The option definition `insecure' in no longer has any effect; please remove it.\nThis option was replaced by 'prometheus.exporters.nginx.sslVerify'.\n\n" + } + ], + "constLabels": [], + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "nginx-exporter", + "insecure": "", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9113, + "scrapeUri": "http://localhost/nginx_status", + "sslVerify": true, + "telemetryEndpoint": "/metrics", + "telemetryPath": "/metrics", + "user": "nginx-exporter", + "warnings": [] + }, + "nginxlog": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "nginxlog-exporter", + "listenAddress": "0.0.0.0", + "metricsEndpoint": "/metrics", + "openFirewall": false, + "port": 9117, + "settings": { + "consul": null, + "namespaces": [] + }, + "user": "nginxlog-exporter" + }, + "node": { + "disabledCollectors": [ + "textfile" + ], + "enable": true, + "enabledCollectors": [ + "systemd", + "hwmon", + "cpu", + "drm", + "ethtool", + "logind", + "wifi", + "diskstats", + "meminfo", + "loadavg", + "filesystem" + ], + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "node-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9100, + "user": "node-exporter" + }, + "node-cert": { + "enable": false, + "excludeGlobs": [], + "excludePaths": [], + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "node-cert-exporter", + "includeGlobs": [], + "listenAddress": "0.0.0.0", + "openFirewall": false, + "paths": [], + "port": 9141, + "user": "acme" + }, + "nut": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "nut-exporter", + "listenAddress": "0.0.0.0", + "nutServer": "127.0.0.1", + "nutUser": "", + "nutVariables": [], + "openFirewall": false, + "passwordPath": null, + "port": 9199, + "user": "nut-exporter" + }, + "nvidia-gpu": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "nvidia-gpu-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9835, + "user": "nvidia-gpu-exporter" + }, + "opnsense": { + "apiKeyFile": null, + "apiSecretFile": null, + "disabledExporter": [], + "enable": false, + "enabledExporter": [], + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "opnsense", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "opnsenseServerAddress": "192.168.1.1", + "opnsenseServerProtocol": "https", + "port": 9144, + "user": "opnsense" + }, + "pgbouncer": { + "assertions": [ + { + "assertion": true, + "message": "The option definition `connectionStringFile' in no longer has any effect; please remove it.\nAs replacement, the option `services.prometheus.exporters.pgbouncer.connectionEnvFile`\nhas been added. In contrast to `connectionStringFile` it must be an environment file\nwith the connection string being set to `PGBOUNCER_EXPORTER_CONNECTION_STRING`.\n\nThe change was necessary since the former option wrote the contents of the file\ninto the cmdline of the exporter making the connection string effectively\nworld-readable.\n\n" + } + ], + "connectionEnvFile": null, + "connectionString": null, + "connectionStringFile": "", + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "pgbouncer-exporter", + "listenAddress": "0.0.0.0", + "logFormat": "logfmt", + "logLevel": "info", + "openFirewall": false, + "package": "", + "pidFile": null, + "port": 9127, + "telemetryPath": "/metrics", + "user": "pgbouncer-exporter", + "warnings": [], + "webConfigFile": null, + "webSystemdSocket": false + }, + "php-fpm": { + "enable": false, + "environmentFile": null, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "php-fpm-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "package": "", + "port": 9253, + "telemetryPath": "/metrics", + "user": "php-fpm-exporter" + }, + "pihole": { + "apiToken": "", + "assertions": [ + { + "assertion": true, + "message": "The option definition `interval' in no longer has any effect; please remove it.\nThis option has been removed.\n" + } + ], + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "pihole-exporter", + "interval": "", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "password": "", + "piholeHostname": "pihole", + "piholePort": 80, + "port": 9617, + "protocol": "http", + "timeout": "5s", + "user": "pihole-exporter", + "warnings": [] + }, + "ping": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "ping-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9427, + "settings": {}, + "telemetryPath": "/metrics", + "user": "ping-exporter" + }, + "postfix": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "", + "listenAddress": "0.0.0.0", + "logfilePath": "/var/log/postfix_exporter_input.log", + "openFirewall": false, + "package": "", + "port": 9154, + "showqPath": "/var/lib/postfix/queue/public/showq", + "systemd": { + "enable": true, + "journalPath": null, + "slice": null, + "unit": "postfix.service" + }, + "telemetryPath": "/metrics", + "user": "postfix-exporter" + }, + "postgres": { + "dataSourceName": "user=postgres database=postgres host=/run/postgresql sslmode=disable", + "enable": false, + "environmentFile": null, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "postgres-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9187, + "runAsLocalSuperUser": false, + "telemetryPath": "/metrics", + "user": "postgres-exporter" + }, + "process": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "process-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9256, + "settings": { + "process_names": [] + }, + "user": "process-exporter" + }, + "pve": { + "collectors": { + "cluster": true, + "config": true, + "node": true, + "replication": true, + "resources": true, + "status": true, + "version": true + }, + "configFile": null, + "enable": false, + "environmentFile": null, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "pve-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "package": "", + "port": 9221, + "server": { + "certFile": null, + "keyFile": null + }, + "user": "pve-exporter" + }, + "py-air-control": { + "deviceHostname": "", + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "py-air-control-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9896, + "protocol": "http", + "stateDir": "prometheus-py-air-control-exporter", + "user": "py-air-control-exporter" + }, + "rasdaemon": { + "databasePath": "/var/lib/rasdaemon/ras-mc_event.db", + "enable": false, + "enabledCollectors": [ + "aer", + "mce", + "mc" + ], + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "rasdaemon-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 10029, + "user": "rasdaemon-exporter" + }, + "redis": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "redis-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9121, + "user": "redis-exporter" + }, + "restic": { + "enable": false, + "environmentFile": null, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "restic-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "passwordFile": "", + "port": 9753, + "rcloneConfig": {}, + "rcloneConfigFile": null, + "rcloneOptions": {}, + "refreshInterval": 60, + "repository": null, + "repositoryFile": null, + "user": "restic-exporter" + }, + "rspamd": "", + "rtl_433": { + "channels": [], + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "rtl_433-exporter", + "ids": [], + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9550, + "rtl433Flags": "-C si", + "user": "rtl_433-exporter" + }, + "sabnzbd": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "sabnzbd-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9387, + "servers": [], + "user": "sabnzbd-exporter" + }, + "scaphandre": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "scaphandre-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 8080, + "telemetryPath": "/metrics", + "user": "scaphandre-exporter" + }, + "script": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "script-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9172, + "settings": {}, + "user": "script-exporter" + }, + "shelly": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "shelly-exporter", + "listenAddress": "0.0.0.0", + "metrics-file": "", + "openFirewall": false, + "port": 9784, + "user": "shelly-exporter" + }, + "smartctl": { + "devices": [], + "enable": true, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "smartctl-exporter", + "listenAddress": "0.0.0.0", + "maxInterval": "60s", + "openFirewall": false, + "port": 3107, + "user": "smartctl-exporter" + }, + "smokeping": { + "buckets": "5e-05,0.0001,0.0002,0.0004,0.0008,0.0016,0.0032,0.0064,0.0128,0.0256,0.0512,0.1024,0.2048,0.4096,0.8192,1.6384,3.2768,6.5536,13.1072,26.2144", + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "smokeping-exporter", + "hosts": [], + "listenAddress": "0.0.0.0", + "openFirewall": false, + "pingInterval": "1s", + "port": 9374, + "telemetryPath": "/metrics", + "user": "smokeping-exporter" + }, + "snmp": { + "configuration": null, + "configurationPath": null, + "enable": false, + "enableConfigCheck": true, + "environmentFile": null, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "snmp-exporter", + "listenAddress": "0.0.0.0", + "logFormat": "logfmt", + "logLevel": "info", + "openFirewall": false, + "port": 9116, + "user": "snmp-exporter" + }, + "speedtest": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "speedtest-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9798, + "serverFallback": false, + "serverID": -1, + "user": "speedtest-exporter" + }, + "sql": { + "configFile": null, + "configuration": null, + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "sql-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9237, + "user": "sql-exporter" + }, + "statsd": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "statsd-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9102, + "user": "statsd-exporter" + }, + "storagebox": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "storagebox-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "package": "", + "port": 9509, + "tokenFile": "", + "user": "storagebox-exporter" + }, + "surfboard": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "surfboard-exporter", + "listenAddress": "0.0.0.0", + "modemAddress": "192.168.100.1", + "openFirewall": false, + "port": 9239, + "user": "surfboard-exporter" + }, + "systemd": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "systemd-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9558, + "user": "systemd-exporter" + }, + "tailscale": { + "enable": false, + "environmentFile": "", + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "tailscale-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "package": "", + "port": 9250, + "user": "tailscale-exporter" + }, + "tibber": { + "apiTokenPath": "", + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "tibber-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9489, + "user": "tibber-exporter" + }, + "tor": "", + "unbound": { + "assertions": [ + { + "assertion": true, + "message": "The option definition `fetchType' in no longer has any effect; please remove it.\nThis option was removed, use the `unbound.host` option instead.\n" + }, + { + "assertion": true, + "message": "The option definition `controlInterface' in no longer has any effect; please remove it.\nThis option was removed, use the `unbound.host` option instead.\n" + } + ], + "controlInterface": "", + "enable": false, + "extraFlags": [], + "fetchType": "", + "firewallFilter": null, + "firewallRules": null, + "group": "unbound-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9167, + "telemetryPath": "/metrics", + "unbound": { + "ca": "/var/lib/unbound/unbound_server.pem", + "certificate": "/var/lib/unbound/unbound_control.pem", + "host": "tcp://127.0.0.1:8953", + "key": "/var/lib/unbound/unbound_control.key" + }, + "user": "unbound-exporter", + "warnings": [] + }, + "unifi-poller": { + "controllers": [], + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "unpoller-exporter", + "listenAddress": "0.0.0.0", + "log": { + "debug": false, + "prometheusErrors": false, + "quiet": false + }, + "loki": { + "interval": "2m", + "pass": "file:///nix/store/i2cd7qzxicmdxmsagdca5gw1ql118nhj-unpoller-loki-default.password", + "tenant_id": "", + "timeout": "10s", + "url": "", + "user": "", + "verify_ssl": false + }, + "openFirewall": false, + "port": 9130, + "user": "unpoller-exporter" + }, + "unpoller": { + "controllers": [], + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "unpoller-exporter", + "listenAddress": "0.0.0.0", + "log": { + "debug": false, + "prometheusErrors": false, + "quiet": false + }, + "loki": { + "interval": "2m", + "pass": "file:///nix/store/i2cd7qzxicmdxmsagdca5gw1ql118nhj-unpoller-loki-default.password", + "tenant_id": "", + "timeout": "10s", + "url": "", + "user": "", + "verify_ssl": false + }, + "openFirewall": false, + "port": 9130, + "user": "unpoller-exporter" + }, + "v2ray": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "v2ray-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9299, + "user": "v2ray-exporter", + "v2rayEndpoint": "127.0.0.1:54321" + }, + "varnish": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "varnish-exporter", + "healthPath": null, + "instance": "", + "listenAddress": "0.0.0.0", + "noExit": false, + "openFirewall": false, + "port": 9131, + "raw": false, + "telemetryPath": "/metrics", + "user": "varnish-exporter", + "varnishStatPath": "varnishstat", + "verbose": false, + "withGoMetrics": false + }, + "warnings": [], + "wireguard": { + "addr": "0.0.0.0", + "assertions": [], + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "wireguard-exporter", + "interfaces": [], + "latestHandshakeDelay": false, + "listenAddress": "0.0.0.0", + "openFirewall": false, + "port": 9586, + "prependSudo": false, + "singleSubnetPerField": false, + "user": "wireguard-exporter", + "verbose": false, + "warnings": [], + "wireguardConfig": null, + "withRemoteIp": false + }, + "zfs": { + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "group": "zfs-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "pools": [], + "port": 9134, + "telemetryPath": "/metrics", + "user": "zfs-exporter" + }, + "zfs-siebenmann": { + "depth": 1, + "enable": false, + "extraFlags": [], + "firewallFilter": null, + "firewallRules": null, + "fullPath": false, + "group": "zfs-siebenmann-exporter", + "listenAddress": "0.0.0.0", + "openFirewall": false, + "pools": [], + "port": 9700, + "user": "zfs-siebenmann-exporter" + } + }, + "extraFlags": [], + "globalConfig": { + "evaluation_interval": null, + "external_labels": null, + "query_log_file": null, + "scrape_interval": null, + "scrape_timeout": null + }, + "listenAddress": "0.0.0.0", + "package": "", + "port": 9090, + "pushgateway": { + "enable": false, + "extraFlags": [], + "log": { + "format": null, + "level": null + }, + "package": "", + "persistMetrics": false, + "persistence": { + "interval": null + }, + "stateDir": "pushgateway", + "web": { + "external-url": null, + "listen-address": null, + "route-prefix": null, + "telemetry-path": null + } + }, + "remoteRead": [], + "remoteWrite": [], + "retentionTime": null, + "ruleFiles": [], + "rules": [], + "sachet": { + "address": "localhost", + "configuration": null, + "enable": false, + "port": 9876 + }, + "scrapeConfigs": [], + "stateDir": "prometheus2", + "webConfigFile": null, + "webExternalUrl": null, + "xmpp-alerts": { + "configuration": {}, + "enable": false, + "settings": {} + } + }, + "services.tailscale": { + "authKeyFile": null, + "authKeyParameters": { + "baseURL": null, + "ephemeral": null, + "preauthorized": null + }, + "derper": { + "configureNginx": true, + "domain": "", + "enable": false, + "openFirewall": true, + "package": "", + "port": 8010, + "stunPort": 3478, + "verifyClients": false + }, + "disableTaildrop": false, + "disableUpstreamLogging": false, + "enable": false, + "extraDaemonFlags": [], + "extraSetFlags": [], + "extraUpFlags": [], + "interfaceName": "tailscale0", + "openFirewall": false, + "package": "", + "permitCertUid": null, + "port": 41641, + "serve": { + "configFile": null, + "enable": false, + "services": {} + }, + "useRoutingFeatures": "none" + }, + "systemd.services.tailscale-udp-gro": null, + "time.timeZone": "Etc/UTC" +} diff --git a/machines/pillar-of-autum/default.nix b/machines/pillar-of-autum/default.nix new file mode 100644 index 00000000..c45bb2a4 --- /dev/null +++ b/machines/pillar-of-autum/default.nix @@ -0,0 +1,68 @@ +# machines/pillar-of-autum/default.nix +# +# pillar-of-autum — ASUS NUC14RVH-B (Intel Core Ultra 5 125H) +# +# First machine assimilated via the assimilator-probe x86-bootstrap workflow. +# Initial intention: a minimal librex11 (XLibre X11) headed system, similar in +# shape to alpha-one (i3 + lightdm), deployed over the probe via nixinate. +# +# NOTE: spelling is "pillar-of-autum" — NOT "pillar-of-autumn". The extra n is +# a known misspelling and must not appear in code, topology, or goldens. +# +# XLibre X11 (librex11) is provided by the xlibre-overlay flake input, passed +# through extraModules in flake.nix (flake inputs cannot be referenced from +# this file's imports — see machines/x86-bootstrap/default.nix header). +# +# Future purpose: AI inference backend for the fleet LiteLLM gateway +# (see documentation/ai-stack.md — "Additional backends: pillar-of-autum"). +{ config +, lib +, pkgs +, self +, hostname +, ... +}: +{ + imports = [ + # Include the results of the hardware scan (probe hardware, USB boot layout). + ./hardware-configuration.nix + # Topology-driven WireGuard client (wg plane, hub = cortex-alpha). + ../../modules/enable-wg-topology.nix + # Headed environment: i3 + lightdm + bargman greeter (same as alpha-one). + ../../environments/i3wm_darthpjb.nix + ]; + + enableWgTopology.enable = true; + + # ── Headed system (librex11 / XLibre X11) ───────────────────── + # The X server itself is overlaid to xlibre-xserver by + # xlibre-overlay.nixosModules.overlay-xlibre-xserver (flake.nix). + # Intel Core Ultra 5 125H integrated graphics — modesetting driver. + # lightdm + i3 are enabled by environments/i3wm_darthpjb.nix (as on alpha-one). + hardware.graphics.enable = true; + + # ── Bootloader ──────────────────────────────────────────────── + # Mirror the assimilator-probe bootstrap image (GRUB EFI removable) so the + # first nixinate `switch` activates cleanly on the existing ESP. The + # firmware boots EFI/BOOT/BOOTX64.EFI; a permanent-install bootloader + # migration (systemd-boot on the NVMe) is a documented follow-up. + boot.loader.grub = { + enable = true; + device = "nodev"; + efiSupport = true; + efiInstallAsRemovable = true; + timeoutStyle = "menu"; + }; + boot.loader.efi = { + canTouchEfiVariables = false; + efiSysMountPoint = "/boot"; + }; + boot.loader.timeout = 5; + boot.kernelParams = [ + "console=tty0" + "console=ttyS0,115200n8" + "loglevel=7" + ]; + + hardware.enableRedistributableFirmware = true; +} diff --git a/machines/pillar-of-autum/hardware-configuration.nix b/machines/pillar-of-autum/hardware-configuration.nix new file mode 100644 index 00000000..e1f2ef8c --- /dev/null +++ b/machines/pillar-of-autum/hardware-configuration.nix @@ -0,0 +1,71 @@ +# Do not modify this file! It was generated from a hardware scan of the +# assimilator-probe (x86-bootstrap) deployment on 2026-08-27. +# +# Target hardware: ASUS NUC14RVH-B (Intel Core Ultra 5 125H, 18 cores, 16 GiB) +# Boot medium: USB flash drive (sda) — the assimilator-probe bootstrap image +# Target storage: addlink M.2 PCIe NVMe (nvme0n1) — migration is a follow-up +# +# The partition UUIDs below were read from the running probe via +# /dev/disk/by-uuid (read-only inspect access, port 1108). +{ config +, lib +, pkgs +, modulesPath +, ... +}: + +{ + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + # Kernel modules required to reach the root device on the USB boot medium + # (xhci/ehci for the USB controller, usb_storage/uas/sd_mod/sr_mod for the + # flash drive, ahci/ata_piix for SATA, nvme/nvme-pci for the M.2 drive). + boot.initrd.availableKernelModules = [ + "xhci_pci" + "ehci_pci" + "ahci" + "ata_piix" + "nvme" + "nvme-pci" + "usb_storage" + "uas" + "sd_mod" + "sr_mod" + "usbhid" + ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + # EFI System Partition (sda1, 1 GiB vfat) — GRUB EFI removable + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/12CE-A600"; + fsType = "vfat"; + options = [ + "fmask=0022" + "dmask=0022" + ]; + }; + + # Root filesystem (sda3, 11 GiB ext4) — the bootstrap image root + fileSystems."/" = { + device = "/dev/disk/by-uuid/793f5bea-fb84-4c96-a832-3a8b287a760a"; + fsType = "ext4"; + }; + + # Swap (sda2, 8 GiB) + swapDevices = [{ device = "/dev/disk/by-uuid/851d149e-df1d-4dea-9253-fb64340d714d"; }]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp86s0.useDHCP = lib.mkDefault true; + # networking.interfaces.wlo1.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/topology/pillar-of-autum.json b/topology/pillar-of-autum.json new file mode 100644 index 00000000..9c6ecce0 --- /dev/null +++ b/topology/pillar-of-autum.json @@ -0,0 +1,21 @@ +{ + "coordinate": [ + { + "interface": "wireg0", + "peer_id": 110, + "plane_name": "wg", + "subnet": "10.88.127.0/24", + "trust": 3 + }, + { + "interface": "enp86s0", + "peer_id": 150, + "plane_name": "cortex-alpha.lan", + "subnet": "10.88.128.0/24", + "trust": 1 + } + ], + "hostname": "pillar-of-autum", + "public_key_file": "secrets/public_keys/wireguard/wg_pillar-of-autum_pub", + "trust": 3 +} From 93f3623999c13e53a03e8a45ed5c78000e0716f8 Mon Sep 17 00:00:00 2001 From: John Bargman Date: Mon, 31 Aug 2026 22:57:36 +0000 Subject: [PATCH 2/4] wg and ssh secrix --- .../assimilator-deployment-workflow.md | 332 ++++++++++++++++++ .../hardware-configuration.nix | 81 ++--- .../private_keys/host_keys/pillar-of-autum | Bin 0 -> 843 bytes .../private_keys/wireguard/wg_pillar-of-autum | 41 +++ .../public_keys/host_keys/pillar-of-autum.pub | 1 + .../wireguard/wg_pillar-of-autum_pub | 1 + 6 files changed, 397 insertions(+), 59 deletions(-) create mode 100644 documentation/assimilator-deployment-workflow.md create mode 100644 secrets/private_keys/host_keys/pillar-of-autum create mode 100644 secrets/private_keys/wireguard/wg_pillar-of-autum create mode 100644 secrets/public_keys/host_keys/pillar-of-autum.pub create mode 100644 secrets/public_keys/wireguard/wg_pillar-of-autum_pub diff --git a/documentation/assimilator-deployment-workflow.md b/documentation/assimilator-deployment-workflow.md new file mode 100644 index 00000000..164191b0 --- /dev/null +++ b/documentation/assimilator-deployment-workflow.md @@ -0,0 +1,332 @@ +# Assimilator Deployment Workflow — Corrected Methodology + +> **Last updated:** 2026-08-30 +> **Status:** Active — replaces the flawed Stage 3 host-key extraction in `x86-bootstrap-deployment-workflow.md` +> **Scope:** x86_64 machines assimilated via the assimilator-probe workflow + +## Purpose + +This document codifies the **correct three-step deployment methodology** for machines +assimilated via the assimilator-probe x86-bootstrap workflow. It replaces the flawed +host-key extraction step (Stage 3) in `x86-bootstrap-deployment-workflow.md`, which +incorrectly assumes the probe's transient, auto-generated SSH host key can serve as +the permanent device identity. + +**The probe's host key is NOT a valid device identity.** The production probe image +(`machines/x86-bootstrap/default.nix`) does not set `assimilator.hostKey.privateKeyFile`, +so sshd auto-generates a host key on first boot. This key lives in mutable `/etc/ssh/` +(not the Nix store), is unverified, and belongs to a throwaway bootstrap — not the +permanent host. Committing it to `secrets/public_keys/host_keys/` would propagate an +unverified, hallucinated device identity. + +--- + +## The Three-Step Process + +``` +┌─────────────────────────────────────────────────────────────────────┐ +│ Step 1: ASSIMILATOR (probe boots, HW discovered) │ +│ Step 2: NIXOS-INSTALL (base system → permanent storage) │ +│ Step 3: NIXINATE DEPLOY (fleet config deployed to base) │ +└─────────────────────────────────────────────────────────────────────┘ +``` + +**Key principle:** The real device-identity keys (SSH host key, WireGuard keypair) are +generated **during Step 2** — as a deliberate post-install act on the permanent system. +They are NEVER carried over from the transient probe. + +--- + +## Step 1 — Assimilation (Probe Discovery) + +**Goal:** Boot the assimilator probe on the target hardware, discover the hardware, +gather diagnostics. The probe is a **throwaway bootstrap** — its keys, hostname, and +identity are irrelevant to the permanent system. + +### 1.1 Build the Bootstrap Image + +```bash +# Build raw disk image (GPT, GRUB EFI removable) +nix build .#nixosConfigurations.x86-bootstrap.config.system.build.diskoImages \ + --option builders '' --no-link --print-out-paths + +# Write to USB flash drive (minimum 4GB) +dd if=main.raw of=/dev/sdX bs=4M status=progress conv=fsync +``` + +### 1.2 Boot and Discover + +1. Insert USB into the target machine, boot from it. +2. **mDNS discovery:** `avahi-resolve -n x86-bootstrap.local` → device IP. +3. **SSH access:** `ssh -p 1108 deploy@` (fleet keys authorized). +4. **Diagnostics:** `cat /run/diagnostics/hardware.json` — CPU, RAM, disks, NICs. + +### 1.3 Gather Hardware Details + +From the running probe, capture the information needed for Step 2: + +| Item | Command | Purpose | +|------|---------|---------| +| Disk layout | `lsblk -f` | Partition UUIDs, sizes, filesystems | +| NIC MAC | `ip link show enp86s0` | DHCP reservation | +| CPU/RAM | `lscpu`, `free -h` | Hardware verification | +| NVMe details | `fdisk -l /dev/nvme0n1` | Target storage layout | +| Host key (probe) | `sudo cat /etc/ssh/ssh_host_ed25519_key.pub` | **Reference only — NOT for committing** | + +### 1.4 What NOT to Do + +- **DO NOT** commit the probe's SSH host key to `secrets/public_keys/host_keys/`. + It is auto-generated, unverified, and belongs to a throwaway bootstrap. +- **DO NOT** generate WireGuard keys for the probe. The probe has no WireGuard. +- **DO NOT** register the machine in `flake.nix` yet. No host key exists. + +--- + +## Step 2 — `nixos-install` a Base System + +**Goal:** Install a minimal NixOS base system to permanent storage. **This install +generates the real device-identity keys post-install.** + +### 2.1 Prepare the Target Storage + +The target storage (typically NVMe) must be **wiped and repartitioned fresh**. +The assimilator-probe's DISKO image may have left stale partitions with colliding +UUIDs (e.g., `nvme0n1p1` sharing UUID `12CE-A600` with the USB boot ESP). + +**Partition ordering — EFI, Swap, Data (data at the end of the disk):** + +| Partition | Size | Type | Purpose | +|-----------|------|------|---------| +| `nvme0n1p1` | ~1G | EFI System (vfat) | ESP — GRUB EFI removable | +| `nvme0n1p2` | ~16G | Linux swap | Swap | +| `nvme0n1p3` | remaining | Linux filesystem (ext4) | Root filesystem | + +**Why this ordering:** EFI at the start for bootloader compatibility. Swap second +(fixed size, predictable). Data at the end (takes all remaining space, can be +resized later if needed). This matches the standard GPT layout convention. + +**All UUIDs must be freshly generated.** Do not reuse any UUIDs from the USB image. + +```bash +# From the running probe via SSH (deploy user, then sudo -i) +# parted is not in the probe's PATH — use nix-shell to get it +sudo nix-shell -p parted --run "parted /dev/nvme0n1" + +# Inside parted: +mklabel gpt +mkpart esp 1MB 1024MB +mkpart linux-swap 1024MB 16GB +mkpart ext4 16GB 100% +quit + +# Set the ESP flag +sudo nix-shell -p parted --run "parted /dev/nvme0n1 -- set 1 esp on" + +# Format (requires root — sudo -i) +sudo -i +mkfs.fat -F 32 /dev/nvme0n1p1 +mkswap /dev/nvme0n1p2 +mkfs.ext4 /dev/nvme0n1p3 + +# Mount +mkdir -p /mnt/boot +mount /dev/nvme0n1p3 /mnt +mount /dev/nvme0n1p1 /mnt/boot +swapon /dev/nvme0n1p2 +``` + +### 2.2 Define a Minimal Base Config + +The base config is **minimal** — CLI + OpenSSH + fleet public-key auth. It does NOT +contain the full pillar-of-autum fleet config (that comes in Step 3). + +**Minimal base config requirements:** + +- `boot.loader.grub` — GRUB EFI removable (matches the USB bootstrap bootloader) +- `networking.hostName` — the permanent hostname (e.g., `pillar-of-autum`) +- `networking.useDHCP = true` — DHCP on all interfaces +- `services.openssh.enable = true` — SSH daemon +- `services.openssh.ports = [ 1108 ]` — match fleet SSH port +- `services.openssh.settings.PasswordAuthentication = false` — key-only +- `users.users.deploy` — deployment user with fleet SSH keys authorized +- `users.users.John88` — operator user with fleet SSH keys authorized +- `security.sudo.extraRules` — passwordless sudo for deploy +- `nix.settings.trusted-users = [ "deploy" ]` — nixinate requirement +- `nix.settings.experimental-features = [ "nix-command flakes" ]` +- `hardware.enableRedistributableFirmware = true` + +**Public keys to authorize** (from `secrets/public_keys/`): +- `JOHN_BARGMAN_ED_25519.pub` — operator key +- `INSPECT_ED_25519.pub` — inspect key (if needed) + +### 2.3 Generate Hardware Config and Install + +```bash +# Generate hardware config (captures NVMe UUIDs, not USB) +nixos-generate-config --root /mnt + +# Replace /mnt/etc/nixos/configuration.nix with the minimal base config +# The generated config has wrong defaults (systemd-boot, NetworkManager). +# Overwrite it entirely with the minimal base config (see §2.2). + +# Install (set root password when prompted at the end) +nixos-install +``` + +**Notes:** +- Do NOT use `--option builders ''` for `nixos-install` — it is a local build, + not a remote one. The `--option builders ''` flag is only for `nix run`/`nix eval` + commands that may try to connect to remote builders. +- Do NOT use `--no-root-passwd` — set the root password manually at the end of + the install. This is the only password on the system and the operator must know it. +- The `nixos-install` command will build the system closure and install it to `/mnt`. + On first boot, the fresh system generates its own SSH host key. + +### 2.4 Post-Install: Generate Real Keys + +After `nixos-install` completes, **boot the NVMe system** (set EFI boot variable +or remove the USB). The fresh system generates its own SSH host key on first boot. + +**Then, on the running NVMe system:** + +1. **Retrieve the real SSH host key:** + ```bash + ssh -p 1108 deploy@ "cat /etc/ssh/ssh_host_ed25519_key.pub" + ``` + +2. **Generate a WireGuard keypair (single command — validated 2026-08-31):** + ```bash + wg genkey | tee >(wg pubkey > secrets/public_keys/wireguard/wg_pillar-of-autum_pub) | nix run .#secrix -- encrypt secrets/private_keys/wireguard/wg_pillar-of-autum -- --all-users --all-systems + ``` + This single command: + - `wg genkey` — generates the private key, outputs to stdout (never touches disk) + - `tee >(wg pubkey > ...)` — duplicates the stream: one copy derives the public + key → `secrets/public_keys/wireguard/wg_pillar-of-autum_pub`; the other continues + - `nix run .#secrix -- encrypt ... -- --all-users --all-systems` — reads the + private key from stdin, age-encrypts it → `secrets/private_keys/wireguard/wg_pillar-of-autum` + + **Recipients:** + - `--all-users` — John88's key (manual decryption possible) + - `--all-systems` — all host keys incl. pillar-of-autum (machine decrypts at runtime + via `secrix.services.wireguard-wireg0`) + + **The private key never touches disk as plaintext.** + + **Verify:** + ```bash + # Public key: 45 bytes, valid WireGuard format + ls -la secrets/public_keys/wireguard/wg_pillar-of-autum_pub + # Encrypted private key: age-encrypted (header: age-encryption.org/v1) + ls -la secrets/private_keys/wireguard/wg_pillar-of-autum + ``` + +### 2.5 Manual Verification (MANDATORY) + +**Before committing any key, manually verify the host's identity:** + +- **SSH host key:** Compare the fingerprint retrieved via SSH against the fingerprint + displayed on the **physical console** (or via another trusted out-of-band channel). + ```bash + # Via SSH + ssh -p 1108 deploy@ "ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub" + # On physical console + ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub + # Fingerprints MUST match + ``` + +- **WireGuard public key:** Verify the public key corresponds to the private key + that was encrypted (secrix decrypt + `wg pubkey` comparison). + +**DO NOT commit any key that has not been manually verified.** + +--- + +## Step 3 — `nixinate` Deploy + +**Goal:** Deploy the full fleet configuration to the base system via nixinate. + +### 3.1 Register the Machine + +**Only after Step 2 yields verified keys.** Register in `flake.nix`: + +```nix +pillar-of-autum = mkX86_64 "pillar-of-autum" { + host = topoIp "pillar-of-autum"; + extraModules = [ + xlibre-overlay.nixosModules.overlay-xlibre-xserver + xlibre-overlay.nixosModules.overlay-all-xlibre-drivers + ]; +}; +``` + +The `hostPubKey` default (`builtins.readFile ./secrets/public_keys/host_keys/pillar-of-autum.pub`) +now resolves because the verified key exists from Step 2. + +### 3.2 Add Topology + +Create `topology/pillar-of-autum.json` with WG peer ID and LAN coordinate. +The `public_key_file` must point to the real WG public key from Step 2. + +### 3.3 Deploy + +```bash +# Temporarily point at LAN IP (the base system is on the LAN, not yet WG) +# Edit flake.nix: host = "10.88.128.150" + +# Deploy +nix run .#pillar-of-autum --option builders '' -- switch + +# Reset to WG IP +# Edit flake.nix: host = topoIp "pillar-of-autum" +``` + +### 3.4 Verify + +1. **WireGuard connectivity:** `ping 10.88.127.110` +2. **SSH on WG:** `ssh -p 1108 deploy@10.88.127.110` +3. **Headed session:** lightdm + i3 (XLibre) on the attached display +4. **Golden:** `nix run .#validate-goldens -- pillar-of-autum --option builders ''` + +--- + +## Why the Existing Workflow Is Wrong + +The documented workflow in `x86-bootstrap-deployment-workflow.md` Stage 3 says: + +> **Stage 3: Extract Host Key** +> The device has a fresh SSH host key generated at boot. Capture it for fleet known_hosts. + +This is **architecturally wrong** for three reasons: + +1. **The probe's host key is transient.** The production probe image + (`machines/x86-bootstrap/default.nix`) does not set `assimilator.hostKey.privateKeyFile`. + sshd auto-generates a key on first boot. This key lives in mutable `/etc/ssh/` + (not the Nix store) and belongs to a throwaway bootstrap. + +2. **The probe's host key is unverified.** No manual out-of-band verification was + performed. Committing it would propagate an unverified device identity — the same + class of error as committing agent-generated WireGuard keys. + +3. **The probe's host key does not survive `nixos-install`.** When the base system + is installed to permanent storage, it generates its own fresh host key. The probe's + key is discarded with the bootstrap image. + +**The correct flow:** keys are generated **during Step 2** (post-install), manually +verified, then committed. The probe is discarded. + +--- + +## Checklist Summary + +| Phase | Action | Who | Blocks | +|-------|--------|-----|--------| +| **A** | Assimilation — probe boots, HW discovered | Agent | — | +| **B** | DHCP reservation in `topology/cortex-alpha.json` | Agent | — | +| **C** | `nixos-install` base system to NVMe | **User** | D | +| **D** | Capture + manually verify real SSH host key + WG keys | **User** | E | +| **E** | Register in `flake.nix` + topology + golden + fleet goldens | Agent | F | +| **F** | `nixinate` deploy + verify | Agent+User | — | + +**No secret assets are created without manual user verification.** +**No machine is registered in `flake.nix` until a verified host key exists.** +**The probe's transient keys are NEVER committed.** diff --git a/machines/pillar-of-autum/hardware-configuration.nix b/machines/pillar-of-autum/hardware-configuration.nix index e1f2ef8c..b517f774 100644 --- a/machines/pillar-of-autum/hardware-configuration.nix +++ b/machines/pillar-of-autum/hardware-configuration.nix @@ -1,71 +1,34 @@ -# Do not modify this file! It was generated from a hardware scan of the -# assimilator-probe (x86-bootstrap) deployment on 2026-08-27. -# -# Target hardware: ASUS NUC14RVH-B (Intel Core Ultra 5 125H, 18 cores, 16 GiB) -# Boot medium: USB flash drive (sda) — the assimilator-probe bootstrap image -# Target storage: addlink M.2 PCIe NVMe (nvme0n1) — migration is a follow-up -# -# The partition UUIDs below were read from the running probe via -# /dev/disk/by-uuid (read-only inspect access, port 1108). -{ config -, lib -, pkgs -, modulesPath -, ... -}: +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: { - imports = [ - (modulesPath + "/installer/scan/not-detected.nix") - ]; + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; - # Kernel modules required to reach the root device on the USB boot medium - # (xhci/ehci for the USB controller, usb_storage/uas/sd_mod/sr_mod for the - # flash drive, ahci/ata_piix for SATA, nvme/nvme-pci for the M.2 drive). - boot.initrd.availableKernelModules = [ - "xhci_pci" - "ehci_pci" - "ahci" - "ata_piix" - "nvme" - "nvme-pci" - "usb_storage" - "uas" - "sd_mod" - "sr_mod" - "usbhid" - ]; + boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ]; boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; boot.extraModulePackages = [ ]; - # EFI System Partition (sda1, 1 GiB vfat) — GRUB EFI removable - fileSystems."/boot" = { - device = "/dev/disk/by-uuid/12CE-A600"; - fsType = "vfat"; - options = [ - "fmask=0022" - "dmask=0022" - ]; - }; - - # Root filesystem (sda3, 11 GiB ext4) — the bootstrap image root - fileSystems."/" = { - device = "/dev/disk/by-uuid/793f5bea-fb84-4c96-a832-3a8b287a760a"; - fsType = "ext4"; - }; + fileSystems."/" = + { device = "/dev/disk/by-uuid/01085531-8a1d-473b-996e-aefb2f89bebb"; + fsType = "ext4"; + }; - # Swap (sda2, 8 GiB) - swapDevices = [{ device = "/dev/disk/by-uuid/851d149e-df1d-4dea-9253-fb64340d714d"; }]; + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/0BA4-CDBF"; + fsType = "vfat"; + options = [ "fmask=0022" "dmask=0022" ]; + }; - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.enp86s0.useDHCP = lib.mkDefault true; - # networking.interfaces.wlo1.useDHCP = lib.mkDefault true; + swapDevices = + [ { device = "/dev/disk/by-uuid/50ba5b0a-4f80-4e37-86f6-66beffeacf98"; } + ]; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.npu.enable = true; hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/secrets/private_keys/host_keys/pillar-of-autum b/secrets/private_keys/host_keys/pillar-of-autum new file mode 100644 index 0000000000000000000000000000000000000000..6436afb5d45a0bd2b7e224688775b92d8e9b8907 GIT binary patch literal 843 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSnatv;G*dq-$Jsg6+{Y+6+bqQ*HMb-(w3sW!I5#Yr ziQYv8g{e8d!HE`8f!PLJ#wEe2MLvlUslio-CLUQPS>?_K0fmKGE@mda#o39KB}Imz zY0j?69=?uTy1Kdw`aVHL9`3#-E>)?8VL=w5`B9c3IetZ+?vcd>LE(ADNr71@UIsay zLGF=U-_HHz^9pWp+OuclTwUEgqONv-tSq}L+$*fgH2I77zFqM+Co;w4ZQs}9>TLEq ztvx#p-*R2;ygIj!-M7^==(a;NdzF4?{#(|Q+2?L-P8Z-1_RHRI!%-(ER=y!u&R{{o zp(T9mR~X!t+h--1>nm;F=eDO)LMpB@aqG7K&$`&vWN09W~LLA1YTH_{M(u*OkU?+zLC-Pmj7fFYaOh zck=?71C4I46E1I^!20<0jNqCd*SQS}oE3E@z6tDq(^hzjC9y^MM9Jcu|3(j!<~?5+ zpx}IXLBRXMQ%AT~X(;`w{o&kgWSm{zyqGn~{BV@uwMo-w7i@NZ^hJ9QbHBjth4)Gl zP948__hJ9ei2)n8#!CHARsFDw**$PpRl&JKt`W7|Ys%f{9Lzk~-?L)c^8ne+HR}75 z9qJ8dFQ23IX4lUhomc<==KC1C(7aDFBQHTE;Ypht-<0eB*pwdVu-u!v)ubX&VB^C0 z>3^iXa=G^L?QGKZ4&B`%+A0vYWMk5jq@JlNDfer4ax^w?eHU`z-@8e!4K^FuR~GSa Gyb1t;(pT*O literal 0 HcmV?d00001 diff --git a/secrets/private_keys/wireguard/wg_pillar-of-autum b/secrets/private_keys/wireguard/wg_pillar-of-autum new file mode 100644 index 00000000..c8aba2ce --- /dev/null +++ b/secrets/private_keys/wireguard/wg_pillar-of-autum @@ -0,0 +1,41 @@ +age-encryption.org/v1 +-> ssh-ed25519 bCV1Xw w9YnMJjLwxQ0Q9P92T0XuvUHgqiRqoaKRqDV1kSNzF8 +K4cOCyJDHPTUFkfmOVUXJfM1h8Idn8mYtMtHtUtUm/0 +-> ssh-ed25519 fT5adw HjWQehvPUeRH1a7/2URl3BelhVXEfSo1C7feniXn/Dw +sGObc3l5NBc7UMNgH9w/FGKBDA5Tiwz4iPBwKCV92bQ +-> ssh-ed25519 fT5adw 2zU/XU+XGr4VVcRd2ZMc3+UC3nL+1Xboiv9WD0H+ZEE +BMeY4RlArabl/+mEJJCTjimMSXCWfrJqZ8iXWc2kWI4 +-> ssh-ed25519 TOiBNQ aECrBwlcMVHxg0nohpy1SSNTCTuJCLzlU3qsevqeOmo +JoS4/hDsdRlAAa71EN6g61N1cDsQqriYMiPrV9fdppI +-> ssh-ed25519 qVSbmA 5cmm7tUy3/JAUggZ1zziTKqmqHltHehbKtXH6SKgNU0 +LkYiG2aVdaKqsjA1m6aPgj91G63HhzQPdwps5F1Vp18 +-> ssh-ed25519 Tkkrsw laEm4iyTIPaKyGpZ1wjub5qvEABUA/INb0Hyfm334XY +tfyL4yRffRbCLELFyih4PNPcDbW+i3UdFMUWqp9mN4o +-> ssh-ed25519 +tYlAA bk5MgtccJPKLLxLAdTonLL/VgwEGj8Ljj80UIk/Efic +TtVgtTMtwI2kjFygBETZJJ25DHEtI4dWGYSm5hlSVx8 +-> ssh-ed25519 TT46aA zDhVQkBazSBkj4BbRUod/558JJmUv/zHlSm69WDhix8 ++qAhiIz2N6bq3mPYUZY8xX7O4vOnjLd6dYthgehR8nM +-> ssh-ed25519 rln3DA 3dYDGrzZvlojghKdqzn+mh4TS2DJi6fNq3tMUnpbNAM +wR6t4YET8z08KsxsEc3KW9ATvWeFQbAtGMkKfJ6SNXM +-> ssh-ed25519 o8jMQQ C9d4S3DnFuScRl6tGxylGqBv+CPMfCOT1dXu5aBLU24 +Bo97H/JK7/HenfIUpyqhKf595F7HLr0jNXNEEOSx7uo +-> ssh-ed25519 QhEPOg Qg4LQ+48zYAeFrJsV4kl2YjkmsLK5DgTDgWIYrCv+WM +KjEpvA2/bWuC0e3C9E4bnehbInxKfXeWTxvatYx9U6k +-> ssh-ed25519 Pp4p+g 6zGAHykdApkbyxmyTQw2y43X2ph5bYQhJkQ532Q4CS0 +ZTEy+HG+td9VgrYqMLgqZxuKm6OFVz0zYYV1sb5Jx/c +-> ssh-ed25519 ZtBiIQ mHOHc/kWSje/xQZYFFjxDf6j/urMQ9s70u9bg5MoKyI +eV9wiWbDhDOk1vJoRmSlHuRUC4jrg0sKzAcBMXA4l+4 +-> ssh-ed25519 INYXBw /l18a9tv20DSzXFiJdON8JSnqHKIPrvQUnEA5CLmRRA +tkk8QxtH+PgtV35p30E8tP0kWC27/0OUg3+BMPe9UP4 +-> ssh-ed25519 OIKmpg o6s03cgGLl1b9kIkvVUvnHo+2QtBLZ8geY38KXg9em0 +8bi9PbShZkaR4z9frWjyvWMBAtlIG4WomSGloIBiE8M +-> ssh-ed25519 x4GB0Q 00l5K4ugHUg+zPDzm9d/6jEezKzgDo9i6c6d/2j/9jo +mbx0yvRAgNIOL1bgV3Vu/ZWlbzKS9d0AOD+fDFtq7ws +-> ssh-ed25519 tU6mgw Vk79Tvb1qQdhX6pzJJGeD64IbGYyz+7kOtB45/LWu1g +NnG1xYYNbgP7fsqZGpGsPoWrwzDDdC67PYAvnmZHNIo +-> ssh-ed25519 Xs47rw eqt+N6VrOwTzKUV0R/NDPW5g3WkMM+3A0z2fcwJFeDg +xcdv0c3Ax2c9ZZlZIJbH2330LVzIIporVOcAtt9hvw8 +-> ssh-ed25519 JKZw0A vEo5rH6IVJBCEiCmR+vzOJJt6s0OYWc5WK83UeqaCiw +fD72yK0v/A11kldXeTRvk7QLXMLIfCBmuf+asDgMWPQ +--- 83QjagA/DlLQA8d6YciOgXOaljLX4m2zhCMgNnmBxko +K rgS䁵i7`ؓtL߭%S07pFV8^O.3Rl7" \ No newline at end of file diff --git a/secrets/public_keys/host_keys/pillar-of-autum.pub b/secrets/public_keys/host_keys/pillar-of-autum.pub new file mode 100644 index 00000000..d5835273 --- /dev/null +++ b/secrets/public_keys/host_keys/pillar-of-autum.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum diff --git a/secrets/public_keys/wireguard/wg_pillar-of-autum_pub b/secrets/public_keys/wireguard/wg_pillar-of-autum_pub new file mode 100644 index 00000000..42063de2 --- /dev/null +++ b/secrets/public_keys/wireguard/wg_pillar-of-autum_pub @@ -0,0 +1 @@ +MquPMQYiRIMpORXoa7ACZ4kKkH+50S71CPolgLWLVms= From 5c23e3dd0482800a51ee3d508a83b2c3af85c027 Mon Sep 17 00:00:00 2001 From: John Bargman Date: Mon, 31 Aug 2026 23:57:08 +0000 Subject: [PATCH 3/4] chore: regenerate fleet goldens for pillar-of-autum host key + DHCP reservation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Regenerate all 19 machine goldens (mkKnownHosts fleet-wide mutation from adding pillar-of-autum host key) - Regenerate ci.json (CI workflow now includes pillar-of-autum) - Add DHCP reservation for pillar-of-autum (88:ae:dd:66:70:ff → 10.88.128.150) in cortex-alpha topology --- goldens/LINDA.json | 20 ++++++++++++++++---- goldens/alpha-one.json | 18 +++++++++++++++--- goldens/alpha-three.json | 18 +++++++++++++++--- goldens/alpha-two.json | 14 +++++++++++++- goldens/arm-builder.json | 12 ++++++++++++ goldens/ci.json | 6 +++++- goldens/cortex-alpha.json | 26 ++++++++++++++++++++++++++ goldens/display-0.json | 12 ++++++++++++ goldens/display-1.json | 12 ++++++++++++ goldens/display-2.json | 12 ++++++++++++ goldens/gaming-host-1.json | 12 ++++++++++++ goldens/local-nas.json | 13 +++++++++++++ goldens/pillar-of-autum.json | 4 +++- goldens/print-controller.json | 12 ++++++++++++ goldens/remote-builder.json | 12 ++++++++++++ goldens/remote-worker.json | 12 ++++++++++++ goldens/storage-array.json | 12 ++++++++++++ goldens/terminal-nx-01.json | 16 ++++++++++++++-- goldens/terminal-zero.json | 14 +++++++++++++- topology/cortex-alpha.json | 1 + 20 files changed, 242 insertions(+), 16 deletions(-) diff --git a/goldens/LINDA.json b/goldens/LINDA.json index d170108b..259cb7bb 100644 --- a/goldens/LINDA.json +++ b/goldens/LINDA.json @@ -234,8 +234,8 @@ "", "", "", - "", - "", + "", + "", "", "", "", @@ -310,7 +310,7 @@ "", "", "", - "", + "", "", "", "", @@ -414,7 +414,7 @@ "", "", "", - "", + "", "", "", "", @@ -1349,6 +1349,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "pompeii": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/alpha-one.json b/goldens/alpha-one.json index 64b73d2d..307c3c30 100644 --- a/goldens/alpha-one.json +++ b/goldens/alpha-one.json @@ -221,8 +221,8 @@ "", "", "", - "", - "", + "", + "", "", "", "", @@ -288,7 +288,7 @@ "", "", "", - "", + "", "", "", "", @@ -1059,6 +1059,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "print-controller": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/alpha-three.json b/goldens/alpha-three.json index fc1fd920..910a7ff7 100644 --- a/goldens/alpha-three.json +++ b/goldens/alpha-three.json @@ -247,11 +247,11 @@ "", "", "", - "", + "", "", "", - "", - "", + "", + "", "", "", "", @@ -1072,6 +1072,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "print-controller": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/alpha-two.json b/goldens/alpha-two.json index 7d05abaf..31c3e4ba 100644 --- a/goldens/alpha-two.json +++ b/goldens/alpha-two.json @@ -284,7 +284,7 @@ "", "", "", - "", + "", "", "", "", @@ -953,6 +953,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "pompeii": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/arm-builder.json b/goldens/arm-builder.json index bda3a9cf..576322bf 100644 --- a/goldens/arm-builder.json +++ b/goldens/arm-builder.json @@ -888,6 +888,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "print-controller": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/ci.json b/goldens/ci.json index bc66b0bb..2d4cfa56 100644 --- a/goldens/ci.json +++ b/goldens/ci.json @@ -91,10 +91,12 @@ "cortex-alpha", "gaming-host-1", "local-nas", + "pillar-of-autum", "remote-builder", "remote-worker", "terminal-nx-01", - "terminal-zero" + "terminal-zero", + "x86-bootstrap" ] }, "max-parallel": 10 @@ -238,10 +240,12 @@ "cortex-alpha", "gaming-host-1", "local-nas", + "pillar-of-autum", "remote-builder", "remote-worker", "terminal-nx-01", "terminal-zero", + "x86-bootstrap", "display-1", "display-2", "print-controller", diff --git a/goldens/cortex-alpha.json b/goldens/cortex-alpha.json index 68c3de74..49a9fbad 100644 --- a/goldens/cortex-alpha.json +++ b/goldens/cortex-alpha.json @@ -807,6 +807,19 @@ "presharedKeyFile": null, "publicKey": "TJtGx15VqBET/JPSq05dzHp+lEPEHIAYeH/w/R6Kpm0=" }, + { + "allowedIPs": [ + "10.88.127.110/32" + ], + "dynamicEndpointRefreshRestartSeconds": null, + "dynamicEndpointRefreshSeconds": null, + "endpoint": null, + "name": "MquPMQYiRIMpORXoa7ACZ4kKkH\\x2b50S71CPolgLWLVms\\x3d", + "persistentKeepalive": null, + "presharedKey": null, + "presharedKeyFile": null, + "publicKey": "MquPMQYiRIMpORXoa7ACZ4kKkH+50S71CPolgLWLVms=" + }, { "allowedIPs": [ "10.88.127.30/32" @@ -1020,6 +1033,7 @@ "60:45:2e:9d:42:ac,10.88.128.247,michel-wifi,infinite", "60:66:82:42:b1:c8,10.88.128.151,LINDA-lan,infinite", "70:54:d2:17:d1:c4,10.88.128.23,terminal-nx-01-2,infinite", + "88:ae:dd:66:70:ff,10.88.128.150,pillar-of-autum,infinite", "b8:27:eb:7f:f0:38,10.88.128.10,print-controller,infinite", "dc:85:de:86:a8:77,10.88.128.22,terminal-nx-01-1,infinite", "f0:de:f1:c7:fe:30,10.88.128.21,terminal-zero-2,infinite", @@ -1965,6 +1979,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "print-controller": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/display-0.json b/goldens/display-0.json index 4646989c..97edf450 100644 --- a/goldens/display-0.json +++ b/goldens/display-0.json @@ -830,6 +830,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "print-controller": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/display-1.json b/goldens/display-1.json index 6fb870b8..975677f9 100644 --- a/goldens/display-1.json +++ b/goldens/display-1.json @@ -935,6 +935,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "print-controller": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/display-2.json b/goldens/display-2.json index 64b06a9b..a1e1831e 100644 --- a/goldens/display-2.json +++ b/goldens/display-2.json @@ -941,6 +941,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "print-controller": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/gaming-host-1.json b/goldens/gaming-host-1.json index 68d8e4b6..32ce802f 100644 --- a/goldens/gaming-host-1.json +++ b/goldens/gaming-host-1.json @@ -932,6 +932,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "print-controller": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/local-nas.json b/goldens/local-nas.json index 989af80b..9cdd5f21 100644 --- a/goldens/local-nas.json +++ b/goldens/local-nas.json @@ -1040,6 +1040,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "print-controller": { "certAuthority": false, "extraHostNames": [], @@ -3430,6 +3442,7 @@ "10.88.127.3:3111", "10.88.127.101:3111", "10.88.127.102:3111", + "10.88.127.110:3111", "10.88.127.30:3111", "10.88.127.51:3111", "10.88.127.50:3111", diff --git a/goldens/pillar-of-autum.json b/goldens/pillar-of-autum.json index e682c76c..87818a4a 100644 --- a/goldens/pillar-of-autum.json +++ b/goldens/pillar-of-autum.json @@ -321,6 +321,8 @@ "", "", "", + "", + "", "", "", "", @@ -914,7 +916,7 @@ "10.88.127.110", "10.88.128.150" ], - "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE5fWYYizH6kYupOXVB0Eq7qCl68dUkySNdvFEBeW9zo\n", + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", "publicKeyFile": null }, "print-controller": { diff --git a/goldens/print-controller.json b/goldens/print-controller.json index 53472462..9b0bea85 100644 --- a/goldens/print-controller.json +++ b/goldens/print-controller.json @@ -964,6 +964,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "print-controller": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/remote-builder.json b/goldens/remote-builder.json index 33224580..3ea71779 100644 --- a/goldens/remote-builder.json +++ b/goldens/remote-builder.json @@ -929,6 +929,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "pompeii": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/remote-worker.json b/goldens/remote-worker.json index 4cf67377..bd6262a5 100644 --- a/goldens/remote-worker.json +++ b/goldens/remote-worker.json @@ -1589,6 +1589,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "print-controller": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/storage-array.json b/goldens/storage-array.json index 36dea7f7..48fe4bda 100644 --- a/goldens/storage-array.json +++ b/goldens/storage-array.json @@ -1085,6 +1085,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "print-controller": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/terminal-nx-01.json b/goldens/terminal-nx-01.json index 0c42ea98..bdfd3ee0 100644 --- a/goldens/terminal-nx-01.json +++ b/goldens/terminal-nx-01.json @@ -257,8 +257,8 @@ "", "", "", - "", - "", + "", + "", "", "", "", @@ -1034,6 +1034,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "print-controller": { "certAuthority": false, "extraHostNames": [], diff --git a/goldens/terminal-zero.json b/goldens/terminal-zero.json index 1b40409f..4b6f8deb 100644 --- a/goldens/terminal-zero.json +++ b/goldens/terminal-zero.json @@ -226,7 +226,7 @@ "", "", "", - "", + "", "", "", "", @@ -1088,6 +1088,18 @@ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlCggPwFP5VX3YDA1iji0wxX8+mIzmrCJ1aHj9f1ofx\n", "publicKeyFile": null }, + "pillar-of-autum": { + "certAuthority": false, + "extraHostNames": [], + "hostNames": [ + "pillar-of-autum", + "pillar-of-autum.johnbargman.net", + "10.88.127.110", + "10.88.128.150" + ], + "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0n2F9HP22zNBIkLHMXEKNfCjYxCtqaSkug8oaFTZBy root@pillar-of-autum\n", + "publicKeyFile": null + }, "print-controller": { "certAuthority": false, "extraHostNames": [], diff --git a/topology/cortex-alpha.json b/topology/cortex-alpha.json index 5bed7c3b..0cd1e010 100644 --- a/topology/cortex-alpha.json +++ b/topology/cortex-alpha.json @@ -71,6 +71,7 @@ {"mac": "60:45:2e:9d:42:ac", "ip": "10.88.128.247", "hostname": "michel-wifi"}, {"mac": "60:66:82:42:b1:c8", "ip": "10.88.128.151", "hostname": "LINDA-lan"}, {"mac": "70:54:d2:17:d1:c4", "ip": "10.88.128.23", "hostname": "terminal-nx-01-2"}, + {"mac": "88:ae:dd:66:70:ff", "ip": "10.88.128.150", "hostname": "pillar-of-autum"}, {"mac": "b8:27:eb:7f:f0:38", "ip": "10.88.128.10", "hostname": "print-controller"}, {"mac": "dc:85:de:86:a8:77", "ip": "10.88.128.22", "hostname": "terminal-nx-01-1"}, {"mac": "f0:de:f1:c7:fe:30", "ip": "10.88.128.21", "hostname": "terminal-zero-2"}, From f425b3f37237e5013dc895cf1b50726e6f9084d8 Mon Sep 17 00:00:00 2001 From: John Bargman Date: Tue, 1 Sep 2026 08:51:44 +0000 Subject: [PATCH 4/4] fix: reformat hardware-configuration.nix to pass nixpkgs-fmt check --- machines/pillar-of-autum/hardware-configuration.nix | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/machines/pillar-of-autum/hardware-configuration.nix b/machines/pillar-of-autum/hardware-configuration.nix index b517f774..af01178c 100644 --- a/machines/pillar-of-autum/hardware-configuration.nix +++ b/machines/pillar-of-autum/hardware-configuration.nix @@ -5,7 +5,8 @@ { imports = - [ (modulesPath + "/installer/scan/not-detected.nix") + [ + (modulesPath + "/installer/scan/not-detected.nix") ]; boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ]; @@ -14,19 +15,20 @@ boot.extraModulePackages = [ ]; fileSystems."/" = - { device = "/dev/disk/by-uuid/01085531-8a1d-473b-996e-aefb2f89bebb"; + { + device = "/dev/disk/by-uuid/01085531-8a1d-473b-996e-aefb2f89bebb"; fsType = "ext4"; }; fileSystems."/boot" = - { device = "/dev/disk/by-uuid/0BA4-CDBF"; + { + device = "/dev/disk/by-uuid/0BA4-CDBF"; fsType = "vfat"; options = [ "fmask=0022" "dmask=0022" ]; }; swapDevices = - [ { device = "/dev/disk/by-uuid/50ba5b0a-4f80-4e37-86f6-66beffeacf98"; } - ]; + [{ device = "/dev/disk/by-uuid/50ba5b0a-4f80-4e37-86f6-66beffeacf98"; }]; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; hardware.cpu.intel.npu.enable = true;