Merge pull request 'fix(nix): stop automatic rebuilds and nightly GC from tripping GitHub's rate limit' (#19) from fix/nix-gc-github-rate-limit into main

Reviewed-on: #19

flake.lock

@@ -21,11 +21,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1788450739,
+        "lastModified": 1790898470,
-        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
+        "narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
+        "rev": "024633cd702b10285db5cb19b40ad48d2399ba60",
         "type": "github"
       },
       "original": {
@@ -113,11 +113,11 @@
         "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1789999030,
+        "lastModified": 1791121781,
-        "narHash": "sha256-oqEWD3Ih/CDejvfWNXFhbwUxvU4RwQZQ9DrI5dD+P10=",
+        "narHash": "sha256-39vzOiYTAwECDMfJAv/b+OxpHPXHfJle0Gx5x+WjPW0=",
         "owner": "NousResearch",
         "repo": "hermes-agent",
-        "rev": "8f7b3b48fc61dc411cac6ebcb0aaaf451ba9c1cb",
+        "rev": "af90026aa09949579bd423d24def3d38f743cde0",
         "type": "github"
       },
       "original": {
@@ -157,11 +157,11 @@
         "nixpkgs-regression": "nixpkgs-regression"
       },
       "locked": {
-        "lastModified": 1789933661,
+        "lastModified": 1791067591,
-        "narHash": "sha256-GtfSaYgUPu91AafiBAQIVEwQiPfIOrgqwmxGtMNDtMI=",
+        "narHash": "sha256-SGcfVVSS3DLO+ES4J+SrLxKGP11yvTWXgiAqku1L+Sk=",
         "owner": "NixOS",
         "repo": "nix",
-        "rev": "5711f8fed2fcff91a52646e2e856648eca86c331",
+        "rev": "e8280775f307a94ca82cea193cfcc14c0d56232a",
         "type": "github"
       },
       "original": {
@@ -211,11 +211,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1789978172,
+        "lastModified": 1791128201,
-        "narHash": "sha256-FIRXajv1pPZ+l6On6ekkmcQ6le0Zi0ncRUoR3nB0vKA=",
+        "narHash": "sha256-rlsYY/Dg/LhbIj51Aa6TLvRpZeb3KZgUTd7llQ5XcJE=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9ebcb7766700d7e006d9505247bd7ce0426f4232",
+        "rev": "31cc5f4d9b9ba601071e8b8504601b9b176e2756",
         "type": "github"
       },
       "original": {
@@ -255,11 +255,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1788057806,
+        "lastModified": 1790477367,
-        "narHash": "sha256-DTQSMxzDWmT0zhguthvegnVkn7CFqGCv4IHCzk5ZUpM=",
+        "narHash": "sha256-oujbxmVKDhci2E4EM3KyAbRUgp5/IsCoiA/LfEF7OOk=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "596e2e3940e09b2abbeb03f75fa1828c57fcd72c",
+        "rev": "f7cd230690d9fc982d06129f9189b101fddcfa3b",
         "type": "github"
       },
       "original": {
@@ -286,11 +286,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1789921291,
+        "lastModified": 1791048980,
-        "narHash": "sha256-uLLUj+TLUmBc6KrUzx76KZdPi5ZkI1ORR9A6lJUIZlo=",
+        "narHash": "sha256-u3KCLxsnf1622GdFccg8hmkEIutOZ1h4pvia5ERjIuI=",
-        "rev": "44a91898084f46797b5fac650c7e8c9ac38c43d4",
+        "rev": "a7868a727837f3c09cee2ce0ca671c76b1589fed",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1077143.44a91898084f/nixexprs.tar.zst"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1084968.a7868a727837/nixexprs.tar.zst"
       },
       "original": {
         "id": "nixpkgs",
@@ -313,11 +313,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1789885152,
+        "lastModified": 1791031588,
-        "narHash": "sha256-lIL3uDaS4Q9Ks6klLrBlDr+XS71sbjMJFSipIp2yPjs=",
+        "narHash": "sha256-4XF6NXFWmQPM0xHuxTw+iQEA6mUtmDQNJoVd4u9GkLw=",
-        "rev": "6d663c0533ff269008fb84e45930151e37c99db9",
+        "rev": "825e2028c29b702a4a5f085f08095d12099784f2",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.10304.6d663c0533ff/nixexprs.tar.zst"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.11150.825e2028c29b/nixexprs.tar.zst"
       },
       "original": {
         "id": "nixpkgs",
@@ -415,11 +415,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789890976,
+        "lastModified": 1791103873,
-        "narHash": "sha256-GKwH3zpy7tartuJMG0Rv/xUsdetG1QLmTVv8UKgJLmA=",
+        "narHash": "sha256-nFxM+pKoZ8LJAEnUXARyCaOAloWgaW9kZQOSjWzKcTE=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "7214124c20c1542c90deb54af50e2f53ae02711f",
+        "rev": "dcd241ba97088c22569d1573286e1b9daad340c0",
         "type": "github"
       },
       "original": {

machines/core/nix.nix

@@ -12,6 +12,13 @@
 
     settings = {
       auto-optimise-store = true;
+      # Without these, gc sweeps away eval-time-only sources (flake inputs,
+      # their build deps) since they're not part of the runtime closure.
+      # The next evaluation then cold-refetches everything from GitHub,
+      # which is enough on its own to trip GitHub's unauthenticated rate
+      # limit for large dependency trees (e.g. hermes-agent's).
+      keep-outputs = true;
+      keep-derivations = true;
     };
 
     gc = {

machines/jupiter/configuration.nix

@@ -72,6 +72,9 @@
 
   system = {
     stateVersion = "23.05";
-    autoUpgrade.enable = true;
+    # Was silently failing daily (legacy channel path, no --flake set) without
+    # ever reaching the network. Disabled rather than fixed: rebuilds should
+    # only happen when triggered manually.
+    autoUpgrade.enable = false;
   };
 }

machines/jupiter/environments.nix

@@ -17,7 +17,7 @@ _: {
     readarr.enable = true;
     sonarr.enable = true;
     jellyfin.enable = true;
-    jellyseerr.enable = true;
+    seerr.enable = true;
     immich.enable = true;
     development.enable = true;
     home-assistant.enable = true;

machines/mibook/configuration.nix

@@ -61,6 +61,9 @@
 
   system = {
     stateVersion = "23.05";
-    autoUpgrade.enable = true;
+    # Was silently failing daily (legacy channel path, no --flake set) without
+    # ever reaching the network. Disabled rather than fixed: rebuilds should
+    # only happen when triggered manually.
+    autoUpgrade.enable = false;
   };
 }

machines/mibook/network.nix

@@ -4,5 +4,6 @@ _: {
   # firewall otherwise blocks inbound connections from other devices.
   networking.firewall.allowedTCPPorts = [
     9119 # athena hermes dashboard
+    47823 # hermes agent ad-hoc webpage server
   ];
 }

modules/environments/default.nix

@@ -18,7 +18,7 @@
     ./readarr
     ./sonarr
     ./jellyfin
-    ./jellyseerr
+    ./seerr
     ./immich
     ./hermes-agent
   ];

modules/environments/hermes-agent/default.nix

@@ -20,6 +20,9 @@ in
       enable = true;
       # Deliberate pin, matches the approved design — bump on purpose, not by drift.
       settings.model.default = "anthropic/claude-sonnet-4-5";
+      # The Nix flake input is the source of truth for hermes's version here; its
+      # built-in self-updater polling GitHub independently just burns API quota.
+      settings.updates.check = false;
       environmentFiles = [ config.sops.secrets."hermes-env".path ];
       addToSystemPackages = true;
 

modules/environments/seerr/default.nix

@@ -1,17 +1,17 @@
 # manages and downloads films
 { config, lib, ... }:
 let
-  cfg = config.my.profiles.jellyseerr;
+  cfg = config.my.profiles.seerr;
   hostName = config.networking.hostName;
   port = 5055;
 in
 {
-  options.my.profiles.jellyseerr = with lib; {
+  options.my.profiles.seerr = with lib; {
-    enable = mkEnableOption "JellySeerr Media Service";
+    enable = mkEnableOption "Seerr Media Service";
   };
 
   config = lib.mkIf cfg.enable {
-    services.jellyseerr = {
+    services.seerr = {
       enable = true;
       openFirewall = true;
     };
@@ -19,14 +19,14 @@ in
     my.homepage.services = [
       {
         group = "Media";
-        name = "Jellyseerr";
+        name = "Seerr";
         description = "Media requests";
         href = "http://${hostName}:${toString port}";
         icon = "mdi-television-guide";
       }
     ];
 
-    systemd.services.jellyseerr = {
+    systemd.services.seerr = {
       after = [ "network-online.target" ];
     };
   };