- transmission_4: BitTorrent daemon + -remote/-create/-show/-edit/-cli
(transmission alias was removed in nixpkgs in favour of transmission_4)
- yt-dlp: download from YouTube and 1000+ sites
- himalaya: IMAP/SMTP/JMAP mail CLI (JSON output for agent)
- pay: x402/MPP agentic payments CLI via callPackage ./pay.nix
Декларативное правило в /etc/hosts через extraActivation,
чтобы работала короткая ссылка http://pi:30141 на локальный
pi-web (@agegr/pi-web, порт 30141). Идемпотентно.
Токены для https://git.iscg.dev хранятся в ~/.git-credentials (plaintext,
chmod 600, вне git/nix). Нужен для clone приватных репо (memory, pass) с heather,
где ssh deploy key только на nix-config.
pi-web (agegr/pi-web, npm @agegr/pi-web) — web UI для pi coding agent.
systemd service на 127.0.0.1:30141, Caddy pi.iscg.dev терминирует TLS +
basicauth (bcrypt, пароль в pass iscg.dev/pi-web/auth).
nodejs в systemPackages; pi и pi-web ставятся в ~/.npm-global вручную.
teable has no dashboard-icons entry and favicon is 16x16 .ico. Use the
teableio GitHub avatar (420x420 png) placed in /var/lib/homepage-images/.
Next.js caches static file list at container start, so adding images
requires docker restart homepage.
tecnativa/docker-socket-proxy (read-only, CONTAINERS=1, POST=0) exposes
docker API to homepage over compose network. Per-service server/container
in services.yaml → green dot status. statusStyle: dot. Syncthing and
tuwunel-admin are systemd, no container status.
bookmarks.yaml needs href: key (was bare URL → new URL() crash).
jitsi.png -> jitsi-meet.png (proper brand icon in dashboard-icons).
teable has no dashboard-icons entry -> use teable.iscg.dev/favicon.ico.
Background photo (mounted ro from /var/lib/homepage-images into
/app/public/images). cardBlur: md for matte semi-transparent service
cards. opacity 70 to soften the photo.
Revert the fetchurl nix derivation. Keep the static binary at
/var/lib/tuwunel-admin/tuwunel-admin (copied from jul11, v0.0.0).
Service already runs this version on heather (nix derivation was pushed
but never deployed).
Replace manually-copied /var/lib/tuwunel-admin/tuwunel-admin binary with a
nix derivation: fetchurl of GitHub release v0.1.0 x86_64-musl static binary
(sha256 verified against checksums.txt). Binary now lives in nix-store,
survives VM recreation. Config stays at /var/lib/tuwunel-admin/config.toml
(outside git, root:root 0644).
nginx template in jitsi-web hardcodes proxy_pass http://jvb:9090 for
/colibri-ws/jvb/* but service is named jitsi-jvb → DNS NXDOMAIN → 502.
Official compose names service 'jvb'; arion service key is jitsi-jvb so
add network alias 'jvb' to fix bridge channel.
Removed jitsi from arion-compose.nix, caddy.nix, default.nix.
Wiped on heather: containers, volumes, images, secrets, LE cert.
Removed YC SG rule 10000/udp. Will reinstall from scratch following docs only.
Same named volume on /config and /var/spool/cron/crontabs inherited 1730
drwx-wx--T from crontabs dir — nginx (www-data) couldn't traverse /config,
Permission denied on config.js. Crontabs not needed; transcripts stay separate.
Arion: `networks` — top-level опция как `services`, не внутри docker-compose.
service.networks принимает listOf str или attrsOf с aliases. meet.jitsi → meet-jitsi
(имя без точки, docker-compose требование к network names).
:latest (release 2198, 2026-07-11) сломал роутинг: Next.js отдаёт 404
на / и /health, assets под /plugin/. Пиним digest из iscg-dev (март 2026)
где / → 307 → /space работает. Старый образ слушает 3000 (не 3002).
Bind mount /srv/syncthing/herbarium → /space. Данные перенесены с iscg-dev
(564K, 41 файл). Auth-файл .silverbullet.auth.json в составе данных.
SB_USER/SB_INDEX_PAGE из старого compose на iscg-dev.
Syncthing отдаёт 403 'Host check error' когда Host header не совпадает с
адресом прослушивания (127.0.0.1:8384) — это DNS rebinding protection.
Caddy подменяет Host на бэкенде через header_up Host 127.0.0.1:8384.
Relay больше не регистрируется в public pool relays.syncthing.net.
Чужие syncthing-устройства не подключаются, трафик не возим.
Свои устройства могут использовать relay://heather:22067 если прописан в config.
- arion-compose: project.name (required) + docker-compose.volumes (correct
option, was docker-compose.raw.volumes which didn't exist)
- syncthing: tmpfiles for /var/lib/syncthing (configDir) owned by mikl,
fixes 'mkdir /var/lib/syncthing: permission denied' when running as non-default user
- common/default.nix: add mikl to wheel + security.sudo.wheelNeedsPassword=false.
Without this, root is unreachable on a fresh NixOS-yc image (no root password,
no rescue channel) — nixos-rebuild switch is impossible. Mirrors the
NOPASSWD:ALL that old YC boxes got via cloud-config user-data.
- home/server.nix: programs.git.extraConfig -> .settings, programs.git.delta
-> programs.delta with enableGitIntegration=true (deprecated warnings).
- image.nix: boot.loader.grub.timeout -> boot.loader.timeout (renamed option).
- Rename muscari -> heather (YC VM). rosemary reserved for future EU server.
- Add hosts/heather/image.nix: YC guest profile + qcow2 build target based on
nixos/lib/make-disk-image.nix (the nixpkgs-standard cloud image builder).
partitionTableType=legacy (MBR + single ext4 root, label nixos), GRUB in MBR
on /dev/vda, virtio drivers, console=ttyS0, cloud-init (Ec2 datasource) so
poppy ssh key auto-lands from YC metadata, growPartition.
- Drop disko flake input + disk-config.nix (was only for nixos-anywhere runtime
install; replaced by make-disk-image build-time approach, no kexec).
- Add home/server.nix: minimal headless home for NixOS hosts (no ollama/
texliveFull/kitty/syncthing/pass). flake mkNixos uses it instead of full ./home.
- k3s.nix: drop dead firewall block (firewall off in image.nix -> trustedInterfaces
was a no-op). Cilium manages pod networking via BPF.
- image.baseName=heather, configurationLimit=1, remove virtio dups (qemu-guest
profile already provides most).
- Fix sha256 pin on forgejo mikl.keys (was stale, would break fetchurl).
- home/zsh.nix: source yandex-cloud yc completion.
- nodejs from nixpkgs is read-only, breaks pi-coding-agent internal npm install
- Use homebrew node (writable) for proper npm/pnpm global installs
- Remove pi-node hardcoded path hack from PATH
- Replace hardcoded PATH with home.sessionPath for proper ordering
- Use ${config.home.homeDirectory} and ${config.home.username} for portability
- Add PNPM_HOME for pnpm global packages
- Remove hardcoded node version path (install pi via pnpm i -g)
