From feb69235f9eab1bb79151b7fcc8a38a92aa6b2c5 Mon Sep 17 00:00:00 2001 From: John Bargman Date: Wed, 29 Jul 2026 15:23:23 +0000 Subject: [PATCH 1/9] update vhosts to correct addresses --- flake.nix | 23 ++++++++++------------- lib/topology/mkNginxSettings.nix | 5 +++-- machines/remote-worker/default.nix | 9 ++++----- server_services/nextcloud.nix | 6 ++---- topology/cortex-alpha.nix | 18 ++++++++++++++++++ 5 files changed, 37 insertions(+), 24 deletions(-) diff --git a/flake.nix b/flake.nix index fc7629d3..4a4e70cc 100644 --- a/flake.nix +++ b/flake.nix @@ -612,30 +612,27 @@ "csfinancialconsulting.com" = { forceSSL = true; enableACME = true; - listenAddresses = [ "193.16.42.101" "10.0.1.42" "10.88.127.50" ]; #todo: handle this assignment in a fixed fashion 82.5.173.252 + listenAddresses = [ "193.16.42.101" ]; locations."/" = { root = carmelsite.packages.x86_64-linux.default; - #proxywebsockets = false; # needed if you need to use websocket }; }; "csfincon.us" = { forceSSL = true; enableACME = true; - listenAddresses = [ "193.16.42.101" "10.0.1.42" "10.88.127.50" ]; #todo: handle this assignment in a fixed fashion 82.5.173.252 + listenAddresses = [ "193.16.42.101" ]; locations."/" = { root = carmelsite.packages.x86_64-linux.default; - #proxywebsockets = false; # needed if you need to use websocket - }; - }; - "carmel-staging.johnbargman.net" = { - useACMEHost = "johnbargman.net"; - forceSSL = true; - listenAddresses = [ "193.16.42.101" "10.0.1.42" "10.88.127.50" ]; #todo: handle this assignment in a fixed fashion 82.5.173.252 - locations."/" = { - root = carmelsite.packages.x86_64-linux.default; - #proxywebsockets = false; # needed if you need to use websocket }; }; + # "carmel-staging.johnbargman.net" = { + # useACMEHost = "johnbargman.net"; + # forceSSL = true; + # listenAddresses = [ "193.16.42.101" "10.0.1.42" "10.88.127.50" ]; + # locations."/" = { + # root = carmelsite.packages.x86_64-linux.default; + # }; + # }; }; }; } diff --git a/lib/topology/mkNginxSettings.nix b/lib/topology/mkNginxSettings.nix index 8f529d88..d153b455 100644 --- a/lib/topology/mkNginxSettings.nix +++ b/lib/topology/mkNginxSettings.nix @@ -24,8 +24,9 @@ let # Global listen addresses (used by base hosts by default) listenAddresses = safeLookup nginx "listenAddresses" [ ]; - # Default listen addresses for proxy hosts — [gateway, host-IP] - defaultListenAddresses = [ + # Default listen addresses for proxy hosts + # Uses explicit proxyListenAddresses if set, otherwise [gateway, host-IP] + defaultListenAddresses = safeLookup nginx "proxyListenAddresses" [ (lan.gateway or "0.0.0.0") ((lan.hosts or { }).${machine.hostname or ""}.ip or "0.0.0.0") ]; diff --git a/machines/remote-worker/default.nix b/machines/remote-worker/default.nix index 5ffc3f22..e9ece82f 100644 --- a/machines/remote-worker/default.nix +++ b/machines/remote-worker/default.nix @@ -54,25 +54,24 @@ in enableACME = true; acmeRoot = null; forceSSL = true; - listenAddresses = [ "0.0.0.0" ]; + listenAddresses = [ "193.16.42.101" "10.88.127.50" ]; locations."/" = { root = ../../webroot; - #proxyWebsockets = false; # needed if you need to use websocket }; }; # johnbargman.com — split-horizon - # Public: serves existing webroot on all interfaces + # Public: serves existing webroot on external IP "johnbargman.com" = { enableACME = true; acmeRoot = null; forceSSL = true; - listenAddresses = [ "0.0.0.0" ]; + listenAddresses = [ "193.16.42.101" ]; locations."/" = { root = ../../webroot; }; }; # WireGuard: serves personal-site on WG IP only - "johnbargman.com-wg" = { + "johnbargman.com-lan" = { serverName = "johnbargman.com"; enableACME = true; acmeRoot = null; diff --git a/server_services/nextcloud.nix b/server_services/nextcloud.nix index 66d7002a..c491b2e5 100644 --- a/server_services/nextcloud.nix +++ b/server_services/nextcloud.nix @@ -70,9 +70,8 @@ in globalRedirect = "nextcloud.johnbargman.net"; listenAddresses = [ "193.16.42.101" - "10.0.1.42" "10.88.127.50" - ]; # todo: handle this assignment in a fixed fashion 82.5.173.252 + ]; extraConfig = "fastcgi_read_timeout 86400;\n"; }; services.nginx.virtualHosts.${fqdn} = { @@ -80,9 +79,8 @@ in useACMEHost = "johnbargman.net"; listenAddresses = [ "193.16.42.101" - "10.0.1.42" "10.88.127.50" - ]; # todo: handle this assignment in a fixed fashion 82.5.173.252 + ]; extraConfig = "fastcgi_read_timeout 86400;\n"; }; # services.phpfpm.pools.nextcloud = { diff --git a/topology/cortex-alpha.nix b/topology/cortex-alpha.nix index 99d696df..d02a7888 100644 --- a/topology/cortex-alpha.nix +++ b/topology/cortex-alpha.nix @@ -488,6 +488,13 @@ domain = "minio.johnbargman.net"; ip = "10.88.128.1"; } + # Split-DNS: internal clients resolve johnbargman.com to remote-worker + # WireGuard IP, which serves personal-site. External resolves to public + # IP (193.16.42.101) which serves webroot. + { + domain = "johnbargman.com"; + ip = "10.88.127.50"; + } ]; dhcp = { range = "10.88.128.128,10.88.128.254,24h"; @@ -509,12 +516,18 @@ "10.88.127.1" # WireGuard IP "82.5.173.252" # WAN IP ]; + # Proxy vhosts listen on both LAN and WireGuard subnets + proxyListenAddresses = [ + "10.88.128.1" # LAN gateway + "10.88.127.1" # WireGuard IP + ]; # Base virtual hosts that serve static content or default responses baseVhosts = { "_" = { default = true; useACMEHost = null; + listenAddresses = [ "0.0.0.0" ]; locations."/".return = "444"; }; "johnbargman.net" = { @@ -562,6 +575,11 @@ forceSSL = false; websockets = true; }; + "minio.johnbargman.net" = { + backend = "http://10.88.127.3:2223"; + forceSSL = false; + websockets = true; + }; }; }; From 0466d97d023dde514b3196777b06bfcff3be66d9 Mon Sep 17 00:00:00 2001 From: John Bargman Date: Wed, 29 Jul 2026 15:41:05 +0000 Subject: [PATCH 2/9] update site --- flake.lock | 8 ++++---- machines/remote-worker/default.nix | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/flake.lock b/flake.lock index d73a361d..f692c919 100644 --- a/flake.lock +++ b/flake.lock @@ -1364,11 +1364,11 @@ "nixpkgs": "nixpkgs_14" }, "locked": { - "lastModified": 1784474605, - "narHash": "sha256-kKWL5QwK9w3M05eZuZzTtwMe00M9JEt4dDYzHgbhQKc=", + "lastModified": 1785253541, + "narHash": "sha256-2tY3unNiAz+ig4tNelmDigtd6/Wa/OM/E+3l1WuCbjc=", "ref": "refs/heads/main", - "rev": "d8cf00bb36c541324e4cb08e291bca9e697d57cd", - "revCount": 57, + "rev": "37f9bb93239220827ecbd8deab05a929bf84fe45", + "revCount": 60, "type": "git", "url": "https://gitlab.com/mecha-team-zero/bargman-website.git" }, diff --git a/machines/remote-worker/default.nix b/machines/remote-worker/default.nix index e9ece82f..8b292484 100644 --- a/machines/remote-worker/default.nix +++ b/machines/remote-worker/default.nix @@ -60,17 +60,17 @@ in }; }; # johnbargman.com — split-horizon - # Public: serves existing webroot on external IP + # Public: serves release site on external IP "johnbargman.com" = { enableACME = true; acmeRoot = null; forceSSL = true; listenAddresses = [ "193.16.42.101" ]; locations."/" = { - root = ../../webroot; + root = personal-site.packages.${pkgs.stdenv.hostPlatform.system}.personal-site; }; }; - # WireGuard: serves personal-site on WG IP only + # WireGuard: serves staging site on WG IP only "johnbargman.com-lan" = { serverName = "johnbargman.com"; enableACME = true; @@ -78,7 +78,7 @@ in forceSSL = true; listenAddresses = [ "10.88.127.50" ]; locations."/" = { - root = personal-site.packages.${pkgs.stdenv.hostPlatform.system}.webroot; + root = personal-site.packages.${pkgs.stdenv.hostPlatform.system}.personal-site-staging; }; }; }; From 90848d8b3a5d9e84424e5ce7a1c11bb0a38d2046 Mon Sep 17 00:00:00 2001 From: John Bargman Date: Wed, 29 Jul 2026 16:10:26 +0000 Subject: [PATCH 3/9] correct vhosts --- documentation/remote-worker-networking.md | 43 +++++++++++++++++++++++ flake.nix | 6 ++-- machines/remote-worker/default.nix | 10 ++++-- server_services/nextcloud.nix | 6 ++-- 4 files changed, 58 insertions(+), 7 deletions(-) create mode 100644 documentation/remote-worker-networking.md diff --git a/documentation/remote-worker-networking.md b/documentation/remote-worker-networking.md new file mode 100644 index 00000000..5734cb3f --- /dev/null +++ b/documentation/remote-worker-networking.md @@ -0,0 +1,43 @@ +# Remote-Worker Network Configuration + +## IP Addressing + +| Interface | IP | Purpose | +|---|---|---| +| `ens3` | `10.0.1.42/26` | WAN (actual interface) | +| `wireg0` | `10.88.127.50/32` | WireGuard | +| `lo` | `127.0.0.1` | Loopback | + +## NAT Mapping + +The public IP `193.16.42.101` is **not assigned** to any interface on remote-worker. +It is NAT-forwarded to `10.0.1.42` (ens3) by the upstream provider. + +**Nginx must bind to `10.0.1.42`, not `193.16.42.101`.** +Binding to the public IP fails with `Cannot assign requested address` (errno 99) +and crashes the entire nginx service — taking down all vhosts including WireGuard. + +All nginx listen addresses use the internal WAN IP `10.0.1.42` with a comment +noting the external NAT mapping. + +## Split-Horizon DNS + +`johnbargman.com` uses split-horizon via cortex-alpha DNS: + +- **Internal (LAN/WG)**: resolves to `10.88.127.50` (remote-worker WG) → staging site +- **External**: resolves via public DNS to `193.16.42.101` → NAT → `10.0.1.42` → release site + +DNS entry defined in `topology/cortex-alpha.nix` under `dns.static`. + +## Nginx VHosts + +| VHost | Listen Addresses | Source | +|---|---|---| +| `default` (fallthrough) | `0.0.0.0` | `default.nix` | +| `johnbargman.net` | `10.0.1.42`, `10.88.127.50` | `default.nix` | +| `johnbargman.com` (release) | `10.0.1.42` | `default.nix` | +| `johnbargman.com-lan` (staging) | `10.88.127.50` | `default.nix` | +| `csfinancialconsulting.com` | `10.0.1.42` | `flake.nix` | +| `csfincon.us` | `10.0.1.42` | `flake.nix` | +| `nextcloud.johnbargman.net` | `10.0.1.42`, `10.88.127.50` | `nextcloud.nix` | +| `nextcloud.johnbargman.com` | `10.0.1.42`, `10.88.127.50` | `nextcloud.nix` | diff --git a/flake.nix b/flake.nix index 4a4e70cc..939b9b1b 100644 --- a/flake.nix +++ b/flake.nix @@ -612,7 +612,8 @@ "csfinancialconsulting.com" = { forceSSL = true; enableACME = true; - listenAddresses = [ "193.16.42.101" ]; + # External IP 193.16.42.101 NATs to 10.0.1.42 (ens3) + listenAddresses = [ "10.0.1.42" ]; locations."/" = { root = carmelsite.packages.x86_64-linux.default; }; @@ -620,7 +621,8 @@ "csfincon.us" = { forceSSL = true; enableACME = true; - listenAddresses = [ "193.16.42.101" ]; + # External IP 193.16.42.101 NATs to 10.0.1.42 (ens3) + listenAddresses = [ "10.0.1.42" ]; locations."/" = { root = carmelsite.packages.x86_64-linux.default; }; diff --git a/machines/remote-worker/default.nix b/machines/remote-worker/default.nix index 8b292484..ff265065 100644 --- a/machines/remote-worker/default.nix +++ b/machines/remote-worker/default.nix @@ -54,20 +54,24 @@ in enableACME = true; acmeRoot = null; forceSSL = true; - listenAddresses = [ "193.16.42.101" "10.88.127.50" ]; + # External IP 193.16.42.101 NATs to 10.0.1.42 (ens3) + listenAddresses = [ "10.0.1.42" "10.88.127.50" ]; locations."/" = { root = ../../webroot; }; }; # johnbargman.com — split-horizon # Public: serves release site on external IP + # TODO: switch to personal-site.packages once input is stable "johnbargman.com" = { enableACME = true; acmeRoot = null; forceSSL = true; - listenAddresses = [ "193.16.42.101" ]; + # External IP 193.16.42.101 NATs to 10.0.1.42 (ens3) + listenAddresses = [ "10.0.1.42" ]; locations."/" = { - root = personal-site.packages.${pkgs.stdenv.hostPlatform.system}.personal-site; + # root = personal-site.packages.${pkgs.stdenv.hostPlatform.system}.personal-site; + root = ../../webroot; }; }; # WireGuard: serves staging site on WG IP only diff --git a/server_services/nextcloud.nix b/server_services/nextcloud.nix index c491b2e5..588115e7 100644 --- a/server_services/nextcloud.nix +++ b/server_services/nextcloud.nix @@ -68,8 +68,9 @@ in forceSSL = true; useACMEHost = "johnbargman.com"; globalRedirect = "nextcloud.johnbargman.net"; + # External IP 193.16.42.101 NATs to 10.0.1.42 (ens3) listenAddresses = [ - "193.16.42.101" + "10.0.1.42" "10.88.127.50" ]; extraConfig = "fastcgi_read_timeout 86400;\n"; @@ -77,8 +78,9 @@ in services.nginx.virtualHosts.${fqdn} = { forceSSL = true; useACMEHost = "johnbargman.net"; + # External IP 193.16.42.101 NATs to 10.0.1.42 (ens3) listenAddresses = [ - "193.16.42.101" + "10.0.1.42" "10.88.127.50" ]; extraConfig = "fastcgi_read_timeout 86400;\n"; From a96330ad4501ad7e82bafae5f3d71ba2093f91aa Mon Sep 17 00:00:00 2001 From: John Bargman Date: Wed, 29 Jul 2026 16:54:37 +0000 Subject: [PATCH 4/9] update website and post live version --- flake.lock | 8 ++++---- machines/remote-worker/default.nix | 4 +--- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/flake.lock b/flake.lock index f692c919..53d3f476 100644 --- a/flake.lock +++ b/flake.lock @@ -1364,11 +1364,11 @@ "nixpkgs": "nixpkgs_14" }, "locked": { - "lastModified": 1785253541, - "narHash": "sha256-2tY3unNiAz+ig4tNelmDigtd6/Wa/OM/E+3l1WuCbjc=", + "lastModified": 1785342915, + "narHash": "sha256-Sy4qaemi8fglo8It+n5uqOBPKspXW3DXtecKk/0Sl9I=", "ref": "refs/heads/main", - "rev": "37f9bb93239220827ecbd8deab05a929bf84fe45", - "revCount": 60, + "rev": "bcebab7dd007e2e6741b86cf54d6b3db47261afb", + "revCount": 76, "type": "git", "url": "https://gitlab.com/mecha-team-zero/bargman-website.git" }, diff --git a/machines/remote-worker/default.nix b/machines/remote-worker/default.nix index ff265065..3eb75341 100644 --- a/machines/remote-worker/default.nix +++ b/machines/remote-worker/default.nix @@ -62,7 +62,6 @@ in }; # johnbargman.com — split-horizon # Public: serves release site on external IP - # TODO: switch to personal-site.packages once input is stable "johnbargman.com" = { enableACME = true; acmeRoot = null; @@ -70,8 +69,7 @@ in # External IP 193.16.42.101 NATs to 10.0.1.42 (ens3) listenAddresses = [ "10.0.1.42" ]; locations."/" = { - # root = personal-site.packages.${pkgs.stdenv.hostPlatform.system}.personal-site; - root = ../../webroot; + root = personal-site.packages.${pkgs.stdenv.hostPlatform.system}.personal-site; }; }; # WireGuard: serves staging site on WG IP only From b4bf1cfaf3a82255e3bd0ffac424c20246547e13 Mon Sep 17 00:00:00 2001 From: John Bargman Date: Thu, 30 Jul 2026 14:10:00 +0000 Subject: [PATCH 5/9] correct builder capabilitites --- modifier_imports/remote-builder.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modifier_imports/remote-builder.nix b/modifier_imports/remote-builder.nix index e6cff16e..76c74d4b 100644 --- a/modifier_imports/remote-builder.nix +++ b/modifier_imports/remote-builder.nix @@ -36,7 +36,7 @@ let hyperhyperKey = config.secrix.services.nix-daemon.secrets.hyperhyper.decrypted.path; armBuilderKey = config.secrix.services.nix-daemon.secrets.personal-builder.decrypted.path; machinesText = '' - ssh-ng://build@100.107.101.14 x86_64-linux ${hyperhyperKey} 10 10 big-parallel,kvm,nixos-test - - + ssh-ng://build@100.107.101.14 x86_64-linux,i686-linux ${hyperhyperKey} 10 10 big-parallel,kvm,nixos-test - - ssh-ng://build@10.88.127.43?max-connections=1 aarch64-linux ${armBuilderKey} 3 5 big-parallel - - ''; in @@ -64,7 +64,7 @@ in protocol = "ssh-ng"; sshUser = "build"; sshKey = hyperhyperKey; - systems = [ "x86_64-linux" ]; + systems = [ "x86_64-linux" "i686-linux" ]; maxJobs = 10; speedFactor = 10; supportedFeatures = [ From a2ec570cc5bc468e342f77ab7aefad4b61d85c16 Mon Sep 17 00:00:00 2001 From: John Bargman Date: Thu, 30 Jul 2026 17:08:10 +0000 Subject: [PATCH 6/9] update website --- flake.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/flake.lock b/flake.lock index 53d3f476..98bd1399 100644 --- a/flake.lock +++ b/flake.lock @@ -48,11 +48,11 @@ "nixpkgs": "nixpkgs_3" }, "locked": { - "lastModified": 1782448073, - "narHash": "sha256-Pnaby4izMjVTaMv6yqom1jUfq58d5Ufu7Vr/j7hQ5CI=", + "lastModified": 1785431187, + "narHash": "sha256-asuVNR9b67icvzjUUiMGLIDKBTfbctrIwF5b/7kGPX4=", "ref": "refs/heads/main", - "rev": "4588254294534f39f5f56710fb53a9edf0774d98", - "revCount": 39, + "rev": "1eadcc176d7647458a1c651f720b612b370a5f10", + "revCount": 41, "type": "git", "url": "https://gitlab.com/mecha-team-zero/carmelsite.git" }, From fdd3414a9ceaa0e3db4fb39b9bc6b8d0e8574549 Mon Sep 17 00:00:00 2001 From: John Bargman Date: Thu, 30 Jul 2026 22:58:28 +0000 Subject: [PATCH 7/9] =?UTF-8?q?feat:=20add=20Malayalam=20(cluster-box)=20a?= =?UTF-8?q?s=20flake=20input=20=E2=80=94=20verbatim=20passthrough?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add gitlab.com:mecha-team-zero/Malayalam.git as a flake input using git+https for netrc token authentication. cluster-box is imported as a verbatim passthrough — no mkX86_64, no commonModules, no overrides. cluster-box is an UNMANAGED fleet member. Configuration lifecycle is owned by dlyon (GitLab). John88 has architectural authority only. - Topology: 10.88.127.211 (WG), 192.168.0.210 (LAN) - Hub: cortex-alpha - Excluded from golden coverage checks - nixinate uses Malayalam's LAN address for dlyon's local deploys - John88 deploys by cloning Malayalam directly over WireGuard See: documents/architecture-passthrough.md in the Malayalam repo. --- flake.lock | 471 ++++++++++++++++++++++++++++++++++++---- flake.nix | 31 ++- lib/golden_coverage.nix | 2 +- 3 files changed, 458 insertions(+), 46 deletions(-) diff --git a/flake.lock b/flake.lock index 98bd1399..43ea586f 100644 --- a/flake.lock +++ b/flake.lock @@ -185,6 +185,28 @@ "type": "github" } }, + "deadnix_6": { + "inputs": { + "nixpkgs": [ + "malayalam", + "nixpkgs" + ], + "utils": "utils_6" + }, + "locked": { + "lastModified": 1764114543, + "narHash": "sha256-+C39E8qmGODT6eB0rhE/VX+DcekXW/Xww5IL/xlERNY=", + "owner": "astro", + "repo": "deadnix", + "rev": "d590041677add62267bef35ddec63cd9402d3505", + "type": "github" + }, + "original": { + "owner": "astro", + "repo": "deadnix", + "type": "github" + } + }, "denton-glasses": { "inputs": { "deadnix": "deadnix_4", @@ -239,6 +261,18 @@ "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/macOS" } }, + "determinate-nixd-aarch64-darwin_2": { + "flake": false, + "locked": { + "narHash": "sha256-oz9PLBISeJ+ipMoi4xmcVG41P/Q8IcptQ62xAJ9ZiZg=", + "type": "file", + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/macOS" + }, + "original": { + "type": "file", + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/macOS" + } + }, "determinate-nixd-aarch64-linux": { "flake": false, "locked": { @@ -251,6 +285,18 @@ "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/aarch64-linux" } }, + "determinate-nixd-aarch64-linux_2": { + "flake": false, + "locked": { + "narHash": "sha256-tvhnv4tS6GIX0DkngUOxWcZ1wW+G7BEOTszojDNDBeY=", + "type": "file", + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/aarch64-linux" + }, + "original": { + "type": "file", + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/aarch64-linux" + } + }, "determinate-nixd-x86_64-linux": { "flake": false, "locked": { @@ -263,6 +309,39 @@ "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/x86_64-linux" } }, + "determinate-nixd-x86_64-linux_2": { + "flake": false, + "locked": { + "narHash": "sha256-brJCRiMDagnf2TLZLAq7UVfKrgow7I/5uNIXfhZsEWA=", + "type": "file", + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/x86_64-linux" + }, + "original": { + "type": "file", + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/x86_64-linux" + } + }, + "determinate_2": { + "inputs": { + "determinate-nixd-aarch64-darwin": "determinate-nixd-aarch64-darwin_2", + "determinate-nixd-aarch64-linux": "determinate-nixd-aarch64-linux_2", + "determinate-nixd-x86_64-linux": "determinate-nixd-x86_64-linux_2", + "nix": "nix_2", + "nixpkgs": "nixpkgs_13" + }, + "locked": { + "lastModified": 1783537817, + "narHash": "sha256-1Xu/0aFdCij0oyB5/i5flZBfGXOVCYeDvVE2jSv08PM=", + "rev": "7adcb07f6a603447b1d6aa674ce5747a4a91f029", + "revCount": 426, + "type": "tarball", + "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.21.5/019f4326-f1c4-7f13-b58b-98979a78c513/source.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://flakehub.com/f/DeterminateSystems/determinate/3" + } + }, "disko": { "inputs": { "nixpkgs": [ @@ -356,6 +435,22 @@ } }, "flake-compat_2": { + "flake": false, + "locked": { + "lastModified": 1696426674, + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_3": { "flake": false, "locked": { "lastModified": 1777699697, @@ -391,6 +486,28 @@ } }, "flake-parts_2": { + "inputs": { + "nixpkgs-lib": [ + "malayalam", + "determinate", + "nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1748821116, + "narHash": "sha256-F82+gS044J1APL0n4hH50GYdPRv/5JWm34oCJYmVKdE=", + "rev": "49f0870db23e8c1ca0b5259734a02cd9e1e371a1", + "revCount": 377, + "type": "tarball", + "url": "https://api.flakehub.com/f/pinned/hercules-ci/flake-parts/0.1.377%2Brev-49f0870db23e8c1ca0b5259734a02cd9e1e371a1/01972f28-554a-73f8-91f4-d488cc502f08/source.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://flakehub.com/f/hercules-ci/flake-parts/0.1" + } + }, + "flake-parts_3": { "inputs": { "nixpkgs-lib": "nixpkgs-lib" }, @@ -408,7 +525,7 @@ "type": "github" } }, - "flake-parts_3": { + "flake-parts_4": { "inputs": { "nixpkgs-lib": "nixpkgs-lib_2" }, @@ -564,6 +681,34 @@ "url": "https://flakehub.com/f/cachix/git-hooks.nix/0.1.941" } }, + "git-hooks-nix_2": { + "inputs": { + "flake-compat": "flake-compat_2", + "gitignore": [ + "malayalam", + "determinate", + "nix" + ], + "nixpkgs": [ + "malayalam", + "determinate", + "nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1747372754, + "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=", + "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46", + "revCount": 1026, + "type": "tarball", + "url": "https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1026%2Brev-80479b6ec16fefd9c1db3ea13aeb038c60530f46/0196d79a-1b35-7b8e-a021-c894fb62163d/source.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://flakehub.com/f/cachix/git-hooks.nix/0.1.941" + } + }, "gitignore": { "inputs": { "nixpkgs": [ @@ -756,6 +901,30 @@ "type": "github" } }, + "malayalam": { + "inputs": { + "deadnix": "deadnix_6", + "determinate": "determinate_2", + "nixinate": "nixinate", + "nixpkgs": "nixpkgs_14", + "nixpkgs_cuda": "nixpkgs_cuda", + "nixpkgs_unstable": "nixpkgs_unstable_2", + "secrix": "secrix_2" + }, + "locked": { + "lastModified": 1785443298, + "narHash": "sha256-9l6i9LMzq90kpmtf7goJP9v2hNluCFk/fBshFZ17hks=", + "ref": "refs/heads/master", + "rev": "70ede7d5ffd9b3bd720e41de33e6f4ebe48b201c", + "revCount": 40, + "type": "git", + "url": "https://gitlab.com/mecha-team-zero/Malayalam.git" + }, + "original": { + "type": "git", + "url": "https://gitlab.com/mecha-team-zero/Malayalam.git" + } + }, "nix": { "inputs": { "flake-parts": "flake-parts", @@ -785,7 +954,7 @@ "star-citizen", "flake-compat" ], - "flake-parts": "flake-parts_2", + "flake-parts": "flake-parts_3", "git-hooks": "git-hooks", "nixpkgs": [ "star-citizen", @@ -827,7 +996,49 @@ "type": "github" } }, + "nix_2": { + "inputs": { + "flake-parts": "flake-parts_2", + "git-hooks-nix": "git-hooks-nix_2", + "nixpkgs": "nixpkgs_12", + "nixpkgs-23-11": "nixpkgs-23-11_2", + "nixpkgs-regression": "nixpkgs-regression_2" + }, + "locked": { + "lastModified": 1783531012, + "narHash": "sha256-oR+h2cF6jderMyM+CMvGu/gbh8s3xceSY+oFqYOcrGg=", + "rev": "1318433ee92773c7c4ab7b3950c8c24d7a8bcc2b", + "revCount": 26214, + "type": "tarball", + "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.21.5/019f42f2-bfcf-72d3-ba62-dd63f71ea07e/source.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://flakehub.com/f/DeterminateSystems/nix-src/%2A" + } + }, "nixinate": { + "inputs": { + "nixpkgs": [ + "malayalam", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1782233505, + "narHash": "sha256-mtyl83OjZjvBIgaEAU8zNdRzJDVldzcoQjGRTi1b/mY=", + "owner": "DarthPJB", + "repo": "nixinate", + "rev": "cf321cc7a9f765b0b6f358efcee32c8feb7b1123", + "type": "github" + }, + "original": { + "owner": "DarthPJB", + "repo": "nixinate", + "type": "github" + } + }, + "nixinate_2": { "inputs": { "disko": "disko_2", "nixpkgs": [ @@ -850,7 +1061,7 @@ }, "nixos-hardware": { "inputs": { - "nixpkgs": "nixpkgs_12" + "nixpkgs": "nixpkgs_16" }, "locked": { "lastModified": 1782562157, @@ -898,6 +1109,22 @@ "type": "github" } }, + "nixpkgs-23-11_2": { + "locked": { + "lastModified": 1717159533, + "narHash": "sha256-oamiKNfr2MS6yH64rUn99mIZjc45nGJlj9eGth/3Xuw=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446", + "type": "github" + }, + "original": { + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446", + "type": "github" + } + }, "nixpkgs-lib": { "locked": { "lastModified": 1777168982, @@ -944,6 +1171,22 @@ "type": "github" } }, + "nixpkgs-regression_2": { + "locked": { + "lastModified": 1643052045, + "narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2", + "type": "github" + }, + "original": { + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2", + "type": "github" + } + }, "nixpkgs_10": { "locked": { "lastModified": 1773821835, @@ -977,6 +1220,64 @@ } }, "nixpkgs_12": { + "locked": { + "lastModified": 1782767157, + "narHash": "sha256-db/8NgfehQlPNt8rMY0J1gvwzTaURU/foM7y/AQimIM=", + "rev": "1d4e0f865d68258aada31e68e6d79c8c463f3b34", + "revCount": 914302, + "type": "tarball", + "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2511.914302%2Brev-1d4e0f865d68258aada31e68e6d79c8c463f3b34/019f1c78-b5ab-7af2-8516-c0d5406b0646/source.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://flakehub.com/f/NixOS/nixpkgs/0.2511" + } + }, + "nixpkgs_13": { + "locked": { + "lastModified": 1782723713, + "narHash": "sha256-oPXCU/SSUokcGaJREHibG1CBX3+s/W7orDWQOZDsEeQ=", + "rev": "b5aa0fbd538984f6e3d201be0005b4463d8b09f8", + "revCount": 1024265, + "type": "tarball", + "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.1024265%2Brev-b5aa0fbd538984f6e3d201be0005b4463d8b09f8/019f3b54-a452-7bf0-9017-aa0cf4ad1907/source.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://flakehub.com/f/DeterminateSystems/nixpkgs-weekly/0.1" + } + }, + "nixpkgs_14": { + "locked": { + "lastModified": 1783389287, + "narHash": "sha256-0xIy4dVLqq47rA+mRy0hXDfjhQd4E5PoIns/RmB7nR4=", + "rev": "0ad6f47ea4fe188f4bc8f0380f93ae8523337c6c", + "revCount": 1008655, + "type": "tarball", + "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2605.1008655%2Brev-0ad6f47ea4fe188f4bc8f0380f93ae8523337c6c/019f4063-e8c2-7113-9f39-e4425b111fb0/source.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://flakehub.com/f/NixOS/nixpkgs/0" + } + }, + "nixpkgs_15": { + "locked": { + "lastModified": 1763678758, + "narHash": "sha256-+hBiJ+kG5IoffUOdlANKFflTT5nO3FrrR2CA3178Y5s=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "117cc7f94e8072499b0a7aa4c52084fa4e11cc9b", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_16": { "locked": { "lastModified": 1767892417, "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=", @@ -989,7 +1290,7 @@ "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz" } }, - "nixpkgs_13": { + "nixpkgs_17": { "locked": { "lastModified": 1749857119, "narHash": "sha256-tG5xUn3hFaPpAHYIvr2F88b+ovcIO5k1HqajFy7ZFPM=", @@ -1005,7 +1306,7 @@ "type": "github" } }, - "nixpkgs_14": { + "nixpkgs_18": { "locked": { "lastModified": 1780243769, "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=", @@ -1021,7 +1322,7 @@ "type": "github" } }, - "nixpkgs_15": { + "nixpkgs_19": { "locked": { "lastModified": 1777954456, "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=", @@ -1037,7 +1338,21 @@ "type": "github" } }, - "nixpkgs_16": { + "nixpkgs_2": { + "locked": { + "lastModified": 1779560665, + "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=", + "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786", + "revCount": 1004030, + "type": "tarball", + "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.1004030%2Brev-64c08a7ca051951c8eae34e3e3cb1e202fe36786/019e5fd8-b716-7e01-9710-e44ec43dc50b/source.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://flakehub.com/f/NixOS/nixpkgs/0.1" + } + }, + "nixpkgs_20": { "locked": { "lastModified": 1763678758, "narHash": "sha256-+hBiJ+kG5IoffUOdlANKFflTT5nO3FrrR2CA3178Y5s=", @@ -1053,7 +1368,7 @@ "type": "github" } }, - "nixpkgs_17": { + "nixpkgs_21": { "locked": { "lastModified": 1782959384, "narHash": "sha256-xnJJk+ct+D2+wdRxj1wk36w5zV9RVESwRqcklPdt3fM=", @@ -1069,7 +1384,7 @@ "type": "github" } }, - "nixpkgs_18": { + "nixpkgs_22": { "locked": { "lastModified": 1767996987, "narHash": "sha256-/CF5vSpXfjX4Obn1byOuIBirki0U/JDtvVCn6U/HQew=", @@ -1085,20 +1400,6 @@ "type": "github" } }, - "nixpkgs_2": { - "locked": { - "lastModified": 1779560665, - "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=", - "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786", - "revCount": 1004030, - "type": "tarball", - "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.1004030%2Brev-64c08a7ca051951c8eae34e3e3cb1e202fe36786/019e5fd8-b716-7e01-9710-e44ec43dc50b/source.tar.gz" - }, - "original": { - "type": "tarball", - "url": "https://flakehub.com/f/NixOS/nixpkgs/0.1" - } - }, "nixpkgs_3": { "locked": { "lastModified": 1776255774, @@ -1206,6 +1507,20 @@ "type": "github" } }, + "nixpkgs_cuda": { + "locked": { + "lastModified": 1767313136, + "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=", + "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d", + "revCount": 813814, + "type": "tarball", + "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2505.813814%2Brev-ac62194c3917d5f474c1a844b6fd6da2db95077d/019b95ad-fc44-71ef-a5c4-3328eb74a196/source.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://flakehub.com/f/NixOS/nixpkgs/0.2505" + } + }, "nixpkgs_llm": { "locked": { "lastModified": 1784497964, @@ -1263,6 +1578,22 @@ } }, "nixpkgs_unstable_2": { + "locked": { + "lastModified": 1783279667, + "narHash": "sha256-/NAkDSsve+GNM0Bt6tleJdCGfsTlK89nPjkVOzZMo0s=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "f205b5574fd0cb7da5b702a2da51507b7f4fdd1b", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_unstable_3": { "locked": { "lastModified": 1782723713, "narHash": "sha256-oPXCU/SSUokcGaJREHibG1CBX3+s/W7orDWQOZDsEeQ=", @@ -1341,7 +1672,7 @@ }, "parsecgaming": { "inputs": { - "nixpkgs": "nixpkgs_13", + "nixpkgs": "nixpkgs_17", "parsecDeb": "parsecDeb", "parsecMeta": "parsecMeta" }, @@ -1361,7 +1692,7 @@ }, "personal-site": { "inputs": { - "nixpkgs": "nixpkgs_14" + "nixpkgs": "nixpkgs_18" }, "locked": { "lastModified": 1785342915, @@ -1380,7 +1711,7 @@ "ratty": { "inputs": { "crane": "crane", - "nixpkgs": "nixpkgs_15" + "nixpkgs": "nixpkgs_19" }, "locked": { "lastModified": 1782235606, @@ -1409,15 +1740,16 @@ "hype-train-claw": "hype-train-claw", "hype-train-outlaw": "hype-train-outlaw", "ikbaeb-th": "ikbaeb-th", - "nixinate": "nixinate", + "malayalam": "malayalam", + "nixinate": "nixinate_2", "nixos-hardware": "nixos-hardware", "nixpkgs_llm": "nixpkgs_llm", "nixpkgs_stable": "nixpkgs_stable_2", - "nixpkgs_unstable": "nixpkgs_unstable_2", + "nixpkgs_unstable": "nixpkgs_unstable_3", "parsecgaming": "parsecgaming", "personal-site": "personal-site", "ratty": "ratty", - "secrix": "secrix_2", + "secrix": "secrix_3", "star-citizen": "star-citizen", "xlibre-overlay": "xlibre-overlay" } @@ -1459,7 +1791,25 @@ }, "secrix_2": { "inputs": { - "nixpkgs": "nixpkgs_16" + "nixpkgs": "nixpkgs_15" + }, + "locked": { + "lastModified": 1781802448, + "narHash": "sha256-fquZY1SFToXU+M5jBAiNGoMBUfXbDB036lS4K7M81FA=", + "owner": "Platonic-Systems", + "repo": "secrix", + "rev": "f79faf63b260e27c3a1a2ba047ac72963d5b0066", + "type": "github" + }, + "original": { + "owner": "Platonic-Systems", + "repo": "secrix", + "type": "github" + } + }, + "secrix_3": { + "inputs": { + "nixpkgs": "nixpkgs_20" }, "locked": { "lastModified": 1784646685, @@ -1497,9 +1847,9 @@ }, "star-citizen": { "inputs": { - "flake-compat": "flake-compat_2", + "flake-compat": "flake-compat_3", "nix-gaming": "nix-gaming", - "nixpkgs": "nixpkgs_17", + "nixpkgs": "nixpkgs_21", "treefmt-nix": "treefmt-nix_2" }, "locked": { @@ -1531,6 +1881,20 @@ "type": "github" } }, + "systems_10": { + "flake": false, + "locked": { + "path": "./systems.nix", + "type": "path" + }, + "original": { + "path": "./systems.nix", + "type": "path" + }, + "parent": [ + "xlibre-overlay" + ] + }, "systems_2": { "locked": { "lastModified": 1681028828, @@ -1637,18 +2001,19 @@ } }, "systems_9": { - "flake": false, "locked": { - "path": "./systems.nix", - "type": "path" + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" }, "original": { - "path": "./systems.nix", - "type": "path" - }, - "parent": [ - "xlibre-overlay" - ] + "owner": "nix-systems", + "repo": "default", + "type": "github" + } }, "treefmt-nix": { "inputs": { @@ -1782,6 +2147,24 @@ "type": "github" } }, + "utils_6": { + "inputs": { + "systems": "systems_9" + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, "xlibre-drivers-overlay-choice": { "flake": false, "locked": { @@ -1799,9 +2182,9 @@ "xlibre-overlay": { "inputs": { "fetchurl-sources": "fetchurl-sources", - "flake-parts": "flake-parts_3", - "nixpkgs": "nixpkgs_18", - "systems": "systems_9", + "flake-parts": "flake-parts_4", + "nixpkgs": "nixpkgs_22", + "systems": "systems_10", "xlibre-drivers-overlay-choice": "xlibre-drivers-overlay-choice", "xserver-meson-flags": "xserver-meson-flags" }, diff --git a/flake.nix b/flake.nix index 939b9b1b..d935937b 100644 --- a/flake.nix +++ b/flake.nix @@ -34,8 +34,13 @@ denton-glasses.url = "git+https://gitlab.com/mecha-team-zero/denton-glasses.git"; personal-site = { url = "git+https://gitlab.com/mecha-team-zero/bargman-website.git"; }; LLM-CORE = { url = "gitlab:mecha-team-zero/llm-core"; inputs.nixpkgs.follows = "nixpkgs_llm"; inputs.nix-mcp-servers.inputs.nixpkgs.follows = "nixpkgs_stable"; }; + # cluster-box (dlyon's on-site machine) — passthrough from Malayalam flake. + # Uses git+https for netrc token authentication. The configuration is owned + # and operated by dlyon; John88 has architectural authority only. + # See: https://gitlab.com/mecha-team-zero/Malayalam/blob/main/documents/architecture-passthrough.md + malayalam.url = "git+https://gitlab.com/mecha-team-zero/Malayalam.git"; }; - outputs = { self, deadnix, determinate, disko, nixinate, nixos-hardware, nixpkgs_stable, nixpkgs_unstable, nixpkgs_llm, hype-train-outlaw, star-citizen, parsecgaming, secrix, hype-train-claw, carmelsite, xlibre-overlay, ratty, ikbaeb-th, bargman-assets, denton-glasses, personal-site, LLM-CORE }: + outputs = { self, deadnix, determinate, disko, nixinate, nixos-hardware, nixpkgs_stable, nixpkgs_unstable, nixpkgs_llm, hype-train-outlaw, star-citizen, parsecgaming, secrix, hype-train-claw, carmelsite, xlibre-overlay, ratty, ikbaeb-th, bargman-assets, denton-glasses, personal-site, LLM-CORE, malayalam }: let nixpkgs = nixpkgs_stable.legacyPackages.x86_64-linux; lib = nixpkgs_stable.lib; @@ -661,6 +666,30 @@ } ]; }; + + # ---- cluster-box (Malayalam passthrough) ---- + # UNMANAGED FLEET MEMBER — configuration owned by dlyon (GitLab). + # This is a verbatim passthrough of Malayalam's nixosConfigurations.cluster-box. + # No mkX86_64, no commonModules, no extraModules — the derivation is defined + # entirely in the Malayalam repo. Both deploy paths (dlyon via LAN, John88 via + # WireGuard) produce the identical system closure. + # + # Operational authority: dlyon (on-site, LAN deploy, push to GitLab) + # Architectural authority: John88 (WireGuard deploy, approval of structural changes) + # + # nixinate uses Malayalam's LAN address (192.168.0.210:22) for dlyon's local deploys. + # John88 deploys via WireGuard by cloning Malayalam directly and overriding nixinate + # host at the command line, or by deploying from the Malayalam repo on LINDA. + # The derivation is identical regardless of deploy path — same flake.lock inputs, + # same NixOS configuration, same store path. + # + # Topology: 10.88.127.211 (WireGuard), 192.168.0.210 (LAN, eno1) + # Hub: cortex-alpha + # + # DO NOT add this machine to managed topology transforms, golden tests, + # or CI build jobs. The configuration lifecycle is managed externally. + # See: documents/architecture-passthrough.md in the Malayalam repo. + cluster-box = malayalam.nixosConfigurations.cluster-box; }; # Dormant machines: configuration preserved for golden tests but excluded diff --git a/lib/golden_coverage.nix b/lib/golden_coverage.nix index a0810321..0be7a554 100644 --- a/lib/golden_coverage.nix +++ b/lib/golden_coverage.nix @@ -3,7 +3,7 @@ let topology = import ../topology/shared.nix { }; topologyMachines = builtins.attrNames topology; - nixosMachines = builtins.attrNames (builtins.removeAttrs self.nixosConfigurations [ "beta-one" "display-0" "display-1" "display-2" "print-controller" "bargman-greeter-vm" "arm-bootstrap" ]); + nixosMachines = builtins.attrNames (builtins.removeAttrs self.nixosConfigurations [ "beta-one" "display-0" "display-1" "display-2" "print-controller" "bargman-greeter-vm" "arm-bootstrap" "cluster-box" ]); goldenDir = ../goldens; goldenFiles = builtins.readDir goldenDir; From 0eb24b7a5386dbad331c63651b4e6bcfc81ac499 Mon Sep 17 00:00:00 2001 From: John Bargman Date: Thu, 30 Jul 2026 23:55:58 +0000 Subject: [PATCH 8/9] fix: use extendModules to override nixinate args for WireGuard deployment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit extendModules appends one module to the original Malayalam evaluation, overriding _module.args.nixinate with mkForce to target WireGuard (10.88.127.211:1108) instead of LAN (192.168.0.210:22). The system derivation is identical — only _module.args.nixinate changes, which is deployment metadata consumed by nixinate.lib.genDeploy, not by any build script or service. Review: 3/4 agents agreed extendModules is correct. See documentation/2026-07-30-REVIEW/ for full analysis. --- flake.nix | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/flake.nix b/flake.nix index d935937b..f8859fdd 100644 --- a/flake.nix +++ b/flake.nix @@ -689,7 +689,21 @@ # DO NOT add this machine to managed topology transforms, golden tests, # or CI build jobs. The configuration lifecycle is managed externally. # See: documents/architecture-passthrough.md in the Malayalam repo. - cluster-box = malayalam.nixosConfigurations.cluster-box; + # + # extendModules overrides nixinate args for WireGuard deployment from + # this flake. The system derivation is identical — only _module.args.nixinate + # changes, which is deployment metadata consumed by nixinate.lib.genDeploy, + # not by any build script or service. + cluster-box = malayalam.nixosConfigurations.cluster-box.extendModules { + modules = [ + { _module.args.nixinate = lib.mkForce { + host = topoIp "cluster-box"; # "10.88.127.211" from topology/shared.nix + sshUser = "deploy"; + port = 1108; + }; + } + ]; + }; }; # Dormant machines: configuration preserved for golden tests but excluded From a30e9429fee9997822c8ef0884e0827aaf20a03e Mon Sep 17 00:00:00 2001 From: John Bargman Date: Fri, 31 Jul 2026 02:29:55 +0000 Subject: [PATCH 9/9] fix: nixpkgs-fmt formatting for cluster-box extendModules block --- flake.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/flake.nix b/flake.nix index f8859fdd..0dfb9a64 100644 --- a/flake.nix +++ b/flake.nix @@ -696,8 +696,9 @@ # not by any build script or service. cluster-box = malayalam.nixosConfigurations.cluster-box.extendModules { modules = [ - { _module.args.nixinate = lib.mkForce { - host = topoIp "cluster-box"; # "10.88.127.211" from topology/shared.nix + { + _module.args.nixinate = lib.mkForce { + host = topoIp "cluster-box"; # "10.88.127.211" from topology/shared.nix sshUser = "deploy"; port = 1108; };