autoUpgrade was silently failing daily on both hosts (legacy channel path,
no --flake set) without reaching the network — disabled outright since
rebuilds should only happen manually. Separately, nix-gc.timer's nightly
sweep was deleting eval-time-only flake input sources (not part of the
runtime closure), forcing the next evaluation to cold-refetch hermes-agent's
entire dependency tree from GitHub in one burst, which alone was enough to
hit the unauthenticated codeload rate limit. keep-outputs/keep-derivations
stop GC from evicting those sources.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TJS8qsYPXSUm5mdWGdaHjF
Jellyseerr was rebranded upstream to Seerr (seerr-team/seerr), and
nixpkgs now aliases services.jellyseerr to services.seerr with an
identical state directory, so this is a same-data rename. Also fixes
systemd.services.jellyseerr.after, which was a silent no-op since the
underlying unit has always been named seerr.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019MLWL7mWHCV6UGfzmhnfqN
Add an 8G swapfile for headroom during nix builds (7.7G RAM, no prior
swap) and bring nodejs (bundles npm) into the development profile.
Also picks up latest flake.lock input updates.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5fRUDLRzDhoKhEqa69cyR
machines/configuration.nix wired hermes-agent.nixosModules.default into
mibook's mibook-only modules list. modules/environments/default.nix is
machine-agnostic, so jupiter still evaluated a
services.hermes-agent = lib.mkIf false { ... } definition for an option it
never declared as existing — NixOS errors on that regardless of mkIf's
condition, breaking nixosConfigurations.jupiter (and the repo's sole CI
job) entirely.
Fix: import the upstream module unconditionally from inside
modules/environments/hermes-agent/default.nix itself, so the option is
declared everywhere modules/environments/default.nix loads, and only ever
turned on where my.profiles.hermes-agent.enable = true (mibook). Also adds
users.users.finn.extraGroups = [ "hermes" ], required for the hermes CLI to
be usable per the corrected design. machines/configuration.nix no longer
mentions hermes-agent.
Deviates from the reconciled spec/plan text in one respect: uses `self`
(from specialArgs) instead of `inputs` (from _module.args) to reach the
flake input inside `imports`. Using `inputs` there reproduced infinite
recursion — NixOS resolves a module's imports before _module.args
assignments are merged, so an import list cannot depend on an arg that
itself comes from config. `self` is available at import-time via
specialArgs, `inputs` is not, in this repo's wiring. See report for detail.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S
Proves the sops-nix pipeline end to end on mibook: encrypts a
throwaway secret to the operator + mibook host keys, declares it in
machines/mibook/secrets.nix, and verifies it decrypts to
/run/secrets/placeholder (root:root, 0400) on nixos-rebuild switch.
Also removes the dead `let secrets = config.sops.secrets;` binding
from both environments.nix files — leftover from an earlier abandoned
plan, never referenced.
Wires sops-nix into every machine via machines/core/sops.nix so hosts
decrypt with their existing SSH host key. Adds a devShell exposing
sops/age/ssh-to-age for the operator workflow, which also fixes .envrc's
previously no-op `use flake`.
Back out the entire "choose terminal-only vs KDE at boot" work. The first
attempt (default multi-user.target + on-demand desktop) locked mibook out —
it is WiFi-only with credentials in KWallet, so a headless boot has no
network and no SSH. The follow-up specialisation redesign is no longer
wanted either.
mibook returns to plain always-KDE boot (the pre-feature baseline):
- machines/mibook/configuration.nix: drop specialisation.terminal and the
NetworkManager-wait-online override.
- machines/mibook/environments.nix: drop kde-desktop.startOnBoot.
- modules/environments/kde-desktop/default.nix: drop the startOnBoot option.
- remove the boot-desktop-choice design spec.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S1wvPy5kbGp8pUQX61WBCY
Add my.profiles.kde-desktop.startOnBoot (default true, no change for
existing consumers). When false, boot to multi-user.target, keep SDDM
out of any boot target's wants, and provide a 'desktop' command that
starts the display manager on demand. Enable this on mibook.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CfozKLQdUh5TzqyjSigLUx
HDR HEVC transcodes were failing with "Failed to get number of OpenCL
platforms: -1001" (CL_PLATFORM_NOT_FOUND_KHR). The tonemap_opencl
filter jellyfin-ffmpeg uses for HDR-to-SDR tone-mapping needs an OpenCL
ICD, which intel-media-driver/vpl-gpu-rt don't provide on their own.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
HEVC HDR transcodes were failing with "Error creating a MFX session: -9"
because intel-media-driver only provides VAAPI, not the separate
oneVPL/MFX runtime QSV needs to create a hardware session.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Installs claude-code (stable), ripgrep, fd, gh, and jq for user finn.
Includes annotation for future headless service upgrade path.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Pulls the services.openthread-border-router NixOS module directly from
nixpkgs-unstable since it isn't in 25.11 yet. Service stays disabled
in this commit; configuration follows.
Also promotes `self` from `_module.args` to `specialArgs` in
machines/configuration.nix, since `imports` are evaluated before
`config` and so can't reach `_module.args.self`.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
finn.markwitz
marthsincemelee