darman/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: condense comments across the repo

Browse Source 
Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21
This commit is contained in:
darman
2026-09-18 21:36:30 +02:00
co-authored by Claude Sonnet 5
parent 3899290c5b
commit 6f24ab69ad
47 changed files with 1051 additions and 1965 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/mercury/configuration.nix
+8 -9
View File
@@ -16,26 +16,25 @@
networking.hostName = "mercury";
# ---- Static networking ----
# A DNS/DHCP server must have a fixed address. Fill in the Pi's real values
# (from `ip -brief a` / `ip route` on the running Pi). eth0 = the Pi's NIC.
# A DNS/DHCP server needs a fixed address (values from `ip -brief a` / `ip
# route` on the running Pi; eth0 is its NIC).
networking.useDHCP = false;
networking.usePredictableInterfaceNames = false; # keep it named eth0
networking.interfaces.eth0.ipv4.addresses = [
{ address = "10.0.0.10"; prefixLength = 24; } # the Pi's current IP
];
# Stable IPv6 (FRITZ!Box ULA prefix) so mercury is a fixed IPv6 DNS target.
# SLAAC still provides the GUA + default route. Announce THIS address as the
# DNSv6 server in the FRITZ!Box so IPv6 clients resolve .sol via pihole.
# Stable IPv6 (FRITZ!Box ULA prefix) so mercury is a fixed IPv6 DNS target —
# SLAAC still handles the GUA + default route. Announce this address as the
# FRITZ!Box's DNSv6 server so IPv6 clients resolve .sol via pihole.
networking.interfaces.eth0.ipv6.addresses = [
{ address = "fd18:df17:9078:0::10"; prefixLength = 64; }
];
networking.defaultGateway = { address = "10.0.0.1"; interface = "eth0"; };
networking.nameservers = [ "1.1.1.1" "9.9.9.9" ];
# Never take the tailnet's DNS on THIS host: headscale points every node at
# pihole, which runs here — mercury would be resolving through itself. Keep
# the public resolvers above for the Pi's own lookups, exactly as the
# unbound resolveLocalQueries note in CLAUDE.md requires.
# Never take the tailnet's DNS here: headscale points every node at pihole,
# which runs on this host, so mercury would resolve through itself — keep
# the public resolvers above for its own lookups.
services.tailscale.extraUpFlags = [ "--accept-dns=false" ];
# ---- pihole web admin password (from sops) ----
hosts/mercury/secrets.nix
+4 -5
View File
@@ -2,11 +2,10 @@
# sops-nix wiring for mercury. Encrypted values in ../../secrets/mercury.yaml.
#
# SD images have no `--extra-files` step, so mercury uses a DEDICATED age key
# placed on the ROOT filesystem (the Pi's vfat partition isn't mounted at
# runtime — u-boot reads it pre-boot). `./deploy flash mercury <dev>` drops
# ~/.config/homelab/mercury/age.txt there automatically.
# The key never enters the repo, the nix store, or the image itself.
# SD images get no `--extra-files` step, so mercury uses a dedicated age key
# on the root filesystem instead of the admin key — the Pi's vfat boot
# partition isn't mounted at runtime (u-boot reads it pre-boot), so the key
# can't live there.
{
sops.defaultSopsFile = ../../secrets/mercury.yaml;
sops.age.keyFile = "/var/lib/sops-nix/age.txt";