autoUpgrade was silently failing daily on both hosts (legacy channel path,
no --flake set) without reaching the network — disabled outright since
rebuilds should only happen manually. Separately, nix-gc.timer's nightly
sweep was deleting eval-time-only flake input sources (not part of the
runtime closure), forcing the next evaluation to cold-refetch hermes-agent's
entire dependency tree from GitHub in one burst, which alone was enough to
hit the unauthenticated codeload rate limit. keep-outputs/keep-derivations
stop GC from evicting those sources.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TJS8qsYPXSUm5mdWGdaHjF
Jellyseerr was rebranded upstream to Seerr (seerr-team/seerr), and
nixpkgs now aliases services.jellyseerr to services.seerr with an
identical state directory, so this is a same-data rename. Also fixes
systemd.services.jellyseerr.after, which was a silent no-op since the
underlying unit has always been named seerr.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019MLWL7mWHCV6UGfzmhnfqN
Proves the sops-nix pipeline end to end on mibook: encrypts a
throwaway secret to the operator + mibook host keys, declares it in
machines/mibook/secrets.nix, and verifies it decrypts to
/run/secrets/placeholder (root:root, 0400) on nixos-rebuild switch.
Also removes the dead `let secrets = config.sops.secrets;` binding
from both environments.nix files — leftover from an earlier abandoned
plan, never referenced.
HDR HEVC transcodes were failing with "Failed to get number of OpenCL
platforms: -1001" (CL_PLATFORM_NOT_FOUND_KHR). The tonemap_opencl
filter jellyfin-ffmpeg uses for HDR-to-SDR tone-mapping needs an OpenCL
ICD, which intel-media-driver/vpl-gpu-rt don't provide on their own.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
HEVC HDR transcodes were failing with "Error creating a MFX session: -9"
because intel-media-driver only provides VAAPI, not the separate
oneVPL/MFX runtime QSV needs to create a hardware session.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
finn.markwitzandClaude Sonnet 5