From 30b7f177c59d16f144116082f277eb60ed7a4a79 Mon Sep 17 00:00:00 2001 From: "Finn@MiBook" Date: Mon, 21 Sep 2026 15:42:31 +0200 Subject: [PATCH 1/7] feat(immich): upgrade to 3.x via unstable overlay nixos-26.05 pins immich at 2.7.5; pull 3.2.0 from pkgs.unstable instead. The machine-learning service picks up the matching version automatically via the package's passthru. Verified jupiter's toplevel still builds; pgvecto.rs->vectorchord migration was already in place so no DB migration is needed for the bump itself. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01DDyhS2N9XEeMq4GisBrqyf --- modules/environments/immich/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/environments/immich/default.nix b/modules/environments/immich/default.nix index 46c6a51..a487d2b 100644 --- a/modules/environments/immich/default.nix +++ b/modules/environments/immich/default.nix @@ -18,6 +18,8 @@ in config = lib.mkIf cfg.enable { services.immich = { enable = true; + # nixos-26.05 pins immich 2.7.5; pull 3.x from the unstable overlay instead. + package = pkgs.unstable.immich; host = "0.0.0.0"; inherit port; openFirewall = true; From 33ac72aaed24cea8d234e83de6a94f6dc08d6aaa Mon Sep 17 00:00:00 2001 From: "Finn@MiBook" Date: Mon, 21 Sep 2026 15:55:20 +0200 Subject: [PATCH 2/7] fix(home-assistant): disable otbr-agent, ZBT-2 antenna not connected otbr-agent can't reach the Thread radio without the antenna attached and crash-loops on every switch, failing the rebuild. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01QD5x9KR8cM7EPPsxKATHfQ --- .../environments/home-assistant/default.nix | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/modules/environments/home-assistant/default.nix b/modules/environments/home-assistant/default.nix index 057b139..d96c7d5 100644 --- a/modules/environments/home-assistant/default.nix +++ b/modules/environments/home-assistant/default.nix @@ -54,14 +54,16 @@ in "f /var/lib/hass/scenes.yaml 0644 hass hass - []" ]; - services.openthread-border-router = { - enable = true; - package = pkgs.unstable.openthread-border-router; - openFirewall = true; - backboneInterfaces = [ "enp3s0" ]; - radio.device = "/dev/serial/by-id/usb-Nabu_Casa_ZBT-2_DCB4D9149C7C-if00"; - radio.baudRate = 460800; - }; + # Disabled: ZBT-2 antenna isn't connected, so otbr-agent can't reach the + # radio and just crash-loops on every switch. + # services.openthread-border-router = { + # enable = true; + # package = pkgs.unstable.openthread-border-router; + # openFirewall = true; + # backboneInterfaces = [ "enp3s0" ]; + # radio.device = "/dev/serial/by-id/usb-Nabu_Casa_ZBT-2_DCB4D9149C7C-if00"; + # radio.baudRate = 460800; + # }; my.homepage.services = [ { From e110cb6b875a70704efe526068831cc78ebf1c5f Mon Sep 17 00:00:00 2001 From: "Finn@MiBook" Date: Mon, 21 Sep 2026 16:01:50 +0200 Subject: [PATCH 3/7] fix(homepage): replace GitLab links with self-hosted Gitea Migrated from gitlab.smoothcloud.de to git.rechberg.online; drop the now-obsolete bookmark and repoint the Services tile. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01QD5x9KR8cM7EPPsxKATHfQ --- modules/environments/homepage/bookmarks.nix | 12 ------------ modules/environments/homepage/manual-services.nix | 8 ++++---- 2 files changed, 4 insertions(+), 16 deletions(-) diff --git a/modules/environments/homepage/bookmarks.nix b/modules/environments/homepage/bookmarks.nix index 420c163..11dfc96 100644 --- a/modules/environments/homepage/bookmarks.nix +++ b/modules/environments/homepage/bookmarks.nix @@ -1,16 +1,4 @@ [ - { - Developer = [ - { - Github = [ - { - abbr = "GitLab - Smoothcloud"; - href = "https://gitlab.smoothcloud.de/"; - } - ]; - } - ]; - } { Social = [ { diff --git a/modules/environments/homepage/manual-services.nix b/modules/environments/homepage/manual-services.nix index ee4bee8..b5b4dac 100644 --- a/modules/environments/homepage/manual-services.nix +++ b/modules/environments/homepage/manual-services.nix @@ -17,10 +17,10 @@ }; } { - "GitLab" = { - href = "https://gitlab.smoothcloud.de"; - description = "Selfhosted GitLab"; - icon = "gitlab.png"; + "Gitea" = { + href = "https://git.rechberg.online"; + description = "Selfhosted Gitea"; + icon = "gitea.png"; }; } { From 34a55841eb39ebfa07ac3099d35289dc64176906 Mon Sep 17 00:00:00 2001 From: "finn.markwitz" Date: Mon, 21 Sep 2026 16:12:45 +0200 Subject: [PATCH 4/7] chore: Flake Update --- flake.lock | 68 +++++++++++++++++++++++++++--------------------------- 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/flake.lock b/flake.lock index b3140bc..6d05189 100644 --- a/flake.lock +++ b/flake.lock @@ -63,11 +63,11 @@ ] }, "locked": { - "lastModified": 1785627969, - "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=", + "lastModified": 1788450739, + "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a", + "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993", "type": "github" }, "original": { @@ -87,11 +87,11 @@ ] }, "locked": { - "lastModified": 1784288435, - "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=", + "lastModified": 1788267358, + "narHash": "sha256-nt+lUqYVpc9Y6JeMd2WmXzCDojasdadKo0mWcluvY2Y=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9", + "rev": "27555e2624241fb116b49095df4caaee85a25691", "type": "github" }, "original": { @@ -113,11 +113,11 @@ "uv2nix": "uv2nix" }, "locked": { - "lastModified": 1789361774, - "narHash": "sha256-ashkMxyQelHq7T4AcJ0Zwuzm9/jMR3hTCWW+2FPwlDg=", + "lastModified": 1789999030, + "narHash": "sha256-oqEWD3Ih/CDejvfWNXFhbwUxvU4RwQZQ9DrI5dD+P10=", "owner": "NousResearch", "repo": "hermes-agent", - "rev": "5eb99eb2844b22ebb723711b8e6a0bbb80bb5f04", + "rev": "8f7b3b48fc61dc411cac6ebcb0aaaf451ba9c1cb", "type": "github" }, "original": { @@ -157,11 +157,11 @@ "nixpkgs-regression": "nixpkgs-regression" }, "locked": { - "lastModified": 1789352761, - "narHash": "sha256-jAcDj4iXkbxa5AlooMRZj7H3E81Cz/q7yN/bX7GPFSU=", + "lastModified": 1789933661, + "narHash": "sha256-GtfSaYgUPu91AafiBAQIVEwQiPfIOrgqwmxGtMNDtMI=", "owner": "NixOS", "repo": "nix", - "rev": "920f6956361496578b8a97ae04ec5f400d729ab4", + "rev": "5711f8fed2fcff91a52646e2e856648eca86c331", "type": "github" }, "original": { @@ -211,11 +211,11 @@ "nixpkgs": "nixpkgs_2" }, "locked": { - "lastModified": 1789127271, - "narHash": "sha256-vL/Fpo7Zxa7wvO8V5FAToUBvP+K3XsMB1wUglTtd/J0=", + "lastModified": 1789978172, + "narHash": "sha256-FIRXajv1pPZ+l6On6ekkmcQ6le0Zi0ncRUoR3nB0vKA=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "24cfdc1f9344b90a1eee329a3906e2f39f4d0f1e", + "rev": "9ebcb7766700d7e006d9505247bd7ce0426f4232", "type": "github" }, "original": { @@ -226,11 +226,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1788921488, - "narHash": "sha256-JLopN/XSodSsJIZ7v7tEjpPZ+QXc883s3HoUIxHD8Io=", - "rev": "6aefcda9401be8acc2b74244fb3b37520ea1f0a8", + "lastModified": 1789344334, + "narHash": "sha256-it+7kNGnOOHBCEnl4SfZ7QtfGziH3EryzHqwvJpjAfg=", + "rev": "c3eea5b2156db11c7eeeada3dc737711255b253e", "type": "tarball", - "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.9440.6aefcda9401b/nixexprs.tar.xz" + "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.9729.c3eea5b2156d/nixexprs.tar.xz" }, "original": { "type": "tarball", @@ -286,11 +286,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1789286504, - "narHash": "sha256-3i80JnZ9pZ7tWReb/Sqpc32cfzffCu8TWLnbnH0hN9c=", - "rev": "ef34387ddd751e1ab8857adf4676492d32eb24ec", + "lastModified": 1789921291, + "narHash": "sha256-uLLUj+TLUmBc6KrUzx76KZdPi5ZkI1ORR9A6lJUIZlo=", + "rev": "44a91898084f46797b5fac650c7e8c9ac38c43d4", "type": "tarball", - "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1073009.ef34387ddd75/nixexprs.tar.xz" + "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1077143.44a91898084f/nixexprs.tar.zst" }, "original": { "id": "nixpkgs", @@ -300,11 +300,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1767892417, - "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=", - "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba", + "lastModified": 1789546076, + "narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=", + "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3", "type": "tarball", - "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz" + "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.xz" }, "original": { "type": "tarball", @@ -313,11 +313,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1789114715, - "narHash": "sha256-eeH+/1GxEjw8NCObjaHVIy3YvCQ4Qckrx4LZj5xBaU4=", - "rev": "21a67dc470149f337cecafbe965d8d252a390518", + "lastModified": 1789885152, + "narHash": "sha256-lIL3uDaS4Q9Ks6klLrBlDr+XS71sbjMJFSipIp2yPjs=", + "rev": "6d663c0533ff269008fb84e45930151e37c99db9", "type": "tarball", - "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.9592.21a67dc47014/nixexprs.tar.xz" + "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.10304.6d663c0533ff/nixexprs.tar.zst" }, "original": { "id": "nixpkgs", @@ -415,11 +415,11 @@ ] }, "locked": { - "lastModified": 1788914643, - "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=", + "lastModified": 1789890976, + "narHash": "sha256-GKwH3zpy7tartuJMG0Rv/xUsdetG1QLmTVv8UKgJLmA=", "owner": "Mic92", "repo": "sops-nix", - "rev": "13616fff713a9f94055c66f15687ebdc17a335df", + "rev": "7214124c20c1542c90deb54af50e2f53ae02711f", "type": "github" }, "original": { From 565ec2bf39dd4fbc36c357ab0739ea61b13daa19 Mon Sep 17 00:00:00 2001 From: "Finn@MiBook" Date: Tue, 22 Sep 2026 11:51:02 +0200 Subject: [PATCH 5/7] feat(jupiter): rename jellyseerr profile to seerr Jellyseerr was rebranded upstream to Seerr (seerr-team/seerr), and nixpkgs now aliases services.jellyseerr to services.seerr with an identical state directory, so this is a same-data rename. Also fixes systemd.services.jellyseerr.after, which was a silent no-op since the underlying unit has always been named seerr. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_019MLWL7mWHCV6UGfzmhnfqN --- machines/jupiter/environments.nix | 2 +- modules/environments/default.nix | 2 +- .../environments/{jellyseerr => seerr}/default.nix | 12 ++++++------ 3 files changed, 8 insertions(+), 8 deletions(-) rename modules/environments/{jellyseerr => seerr}/default.nix (67%) diff --git a/machines/jupiter/environments.nix b/machines/jupiter/environments.nix index 8fc6ae3..b8f5ac1 100644 --- a/machines/jupiter/environments.nix +++ b/machines/jupiter/environments.nix @@ -17,7 +17,7 @@ _: { readarr.enable = true; sonarr.enable = true; jellyfin.enable = true; - jellyseerr.enable = true; + seerr.enable = true; immich.enable = true; development.enable = true; home-assistant.enable = true; diff --git a/modules/environments/default.nix b/modules/environments/default.nix index a910b44..8c728be 100644 --- a/modules/environments/default.nix +++ b/modules/environments/default.nix @@ -18,7 +18,7 @@ ./readarr ./sonarr ./jellyfin - ./jellyseerr + ./seerr ./immich ./hermes-agent ]; diff --git a/modules/environments/jellyseerr/default.nix b/modules/environments/seerr/default.nix similarity index 67% rename from modules/environments/jellyseerr/default.nix rename to modules/environments/seerr/default.nix index 2e783d3..960bf20 100644 --- a/modules/environments/jellyseerr/default.nix +++ b/modules/environments/seerr/default.nix @@ -1,17 +1,17 @@ # manages and downloads films { config, lib, ... }: let - cfg = config.my.profiles.jellyseerr; + cfg = config.my.profiles.seerr; hostName = config.networking.hostName; port = 5055; in { - options.my.profiles.jellyseerr = with lib; { - enable = mkEnableOption "JellySeerr Media Service"; + options.my.profiles.seerr = with lib; { + enable = mkEnableOption "Seerr Media Service"; }; config = lib.mkIf cfg.enable { - services.jellyseerr = { + services.seerr = { enable = true; openFirewall = true; }; @@ -19,14 +19,14 @@ in my.homepage.services = [ { group = "Media"; - name = "Jellyseerr"; + name = "Seerr"; description = "Media requests"; href = "http://${hostName}:${toString port}"; icon = "mdi-television-guide"; } ]; - systemd.services.jellyseerr = { + systemd.services.seerr = { after = [ "network-online.target" ]; }; }; From 07a1d8ee62c6af374cbd605b3a6f17cac2809195 Mon Sep 17 00:00:00 2001 From: "Finn@MiBook" Date: Sat, 26 Sep 2026 08:15:58 +0200 Subject: [PATCH 6/7] feat(mibook): open port 47823 for hermes ad-hoc webpage hosting MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Distinct from the existing 9119 dashboard port — this lets the agent serve one-off pages to devices on the local network. --- machines/mibook/network.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/machines/mibook/network.nix b/machines/mibook/network.nix index 717010c..58d4970 100644 --- a/machines/mibook/network.nix +++ b/machines/mibook/network.nix @@ -4,5 +4,6 @@ _: { # firewall otherwise blocks inbound connections from other devices. networking.firewall.allowedTCPPorts = [ 9119 # athena hermes dashboard + 47823 # hermes agent ad-hoc webpage server ]; } From 84ada68069489cb6959a88ea164567ef7c9a4268 Mon Sep 17 00:00:00 2001 From: "Finn@MiBook" Date: Tue, 29 Sep 2026 17:36:18 +0200 Subject: [PATCH 7/7] fix(mibook): disable hermes-agent's built-in self-update GitHub polling Its self-updater was independently polling GitHub for the same repo the flake input tracks, and stacked with a runaway crash-restart loop this exhausted the GitHub rate limit, causing unrelated flake fetches to 429. The Nix flake input is already the source of truth for hermes's version. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01F9ge2kVMD55sLJExx3v2G3 --- modules/environments/hermes-agent/default.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/modules/environments/hermes-agent/default.nix b/modules/environments/hermes-agent/default.nix index 82a2386..0547df8 100644 --- a/modules/environments/hermes-agent/default.nix +++ b/modules/environments/hermes-agent/default.nix @@ -20,6 +20,9 @@ in enable = true; # Deliberate pin, matches the approved design — bump on purpose, not by drift. settings.model.default = "anthropic/claude-sonnet-4-5"; + # The Nix flake input is the source of truth for hermes's version here; its + # built-in self-updater polling GitHub independently just burns API quota. + settings.updates.check = false; environmentFiles = [ config.sops.secrets."hermes-env".path ]; addToSystemPackages = true;