From a5edaab80dedf6bd5e5b94368acd0075b375f23e Mon Sep 17 00:00:00 2001 From: Erik Simon Date: Fri, 18 Sep 2026 23:03:08 +0200 Subject: [PATCH] Removed comments & mercury tailscale key --- hosts/terra/configuration.nix | 35 ----------------------------------- hosts/terra/home/hyprland.nix | 15 +-------------- secrets/mercury.yaml | 8 ++++---- services/vpn/headscale.nix | 2 +- 4 files changed, 6 insertions(+), 54 deletions(-) diff --git a/hosts/terra/configuration.nix b/hosts/terra/configuration.nix index 30f04b7..bcf40d3 100644 --- a/hosts/terra/configuration.nix +++ b/hosts/terra/configuration.nix @@ -63,9 +63,6 @@ in libxrandr libxinerama libxcb - - # CLion Nova's C++ backend is a .NET 10 app that needs ICU or reports - # "Couldn't find a valid ICU package installed on the system". icu ]; @@ -97,38 +94,6 @@ in # rootless podman GPU containers (Vulkan whisper.cpp/llama.cpp). users.users.darman.extraGroups = [ "render" "video" ]; - # ---- ollama (local LLM server, ROCm on the 6800 XT) ---- - # Navi 21 (gfx1030) is officially ROCm-supported, so no - # HSA_OVERRIDE_GFX_VERSION needed. Upstream module already runs under - # DynamicUser with render/kfd/drm access wired, unlike jellyfin's static user. - services.ollama = { - enable = true; - package = pkgs.ollama-rocm; - # keep default model in sync with services/desktop/librechat.nix's - # endpoints.custom default (its schema needs a non-empty value even - # though fetch=true overrides it). - # gemma4:12b: daily-driver chat/coding model, fits fully in 16G VRAM; also - # doubles as LibreChat's memory-extraction agent (librechat.nix) since a - # smaller model confused the user's stated facts with its own boilerplate. - # qwen3.6:35b-a3b: MoE (3B active/36B total, ~24GB Q4_K_M) — doesn't fit - # in VRAM alone, so ollama offloads inactive experts to CPU RAM; sparsity - # makes that less painful than for a dense model this size, but still slower. - # VladimirGav/qwen3.8-27B-14GB-IQ4: dense 27B at IQ4 (~14GB) — nominally - # fits the 16G card but leaves little headroom, so expect partial CPU - # offload as context grows. - loadModels = [ - "gemma4:12b" - "qwen3.6:35b-a3b" - "VladimirGav/qwen3.8-27B-14GB-IQ4" - ]; - # Ollama truncates context far below a model's real window unless told - # otherwise. 131072 is the practical ceiling from load-testing: VRAM stays - # 100% GPU with no CPU spillover up to here, but headroom and prefill - # throughput both degrade near the top — going higher risks CPU spillover - # under concurrent GPU load (compositor, jellyfin transcode) for little gain. - environmentVariables.OLLAMA_CONTEXT_LENGTH = "131072"; - }; - # ---- Dev-data disks — NOT in disko, mounted read-write, never wiped ---- fileSystems."/mnt/hdd_01" = { device = "/dev/disk/by-uuid/b8445126-ec6d-4f88-818a-d9e13031d9a4"; diff --git a/hosts/terra/home/hyprland.nix b/hosts/terra/home/hyprland.nix index ffe3ef2..cc28d9b 100644 --- a/hosts/terra/home/hyprland.nix +++ b/hosts/terra/home/hyprland.nix @@ -1,17 +1,5 @@ { lib, pkgs, config, inputs, ... }: -# Hyprland config migrated from github.com/darman96/hyprland-dotfiles into -# home-manager's lua-style `settings` (each attr becomes an `hl.(...)` -# call in hyprland.lua). Imported by home.nix; system-level enable lives in -# ../../services/desktop/desktop-hyprland.nix. -# -# Not migrated: hyprbars (unpackaged plugin; its successor hypr-chrome is -# wired in below instead), hyprqt6engine (conflicts with home.nix's qtct/ -# Dracula Qt theming), hyprlock (use programs.hyprlock), the old wob volume -# overlay (kept only wpctl/playerctl), and Arch-specific env vars. Several -# binds reference apps not yet packaged here (vivaldi-stable, dolphin, -# vicinae, grimblast, waypaper, discord, gitkraken, qbz). - let lua = lib.generators.mkLuaInline; @@ -24,7 +12,6 @@ let # Wallpapers aren't checked into this repo (binaries) — pulled from the # Wallhaven library on /mnt/hdd_01. Picked once here since hyprpaper has # no built-in "random" mode. - # wallpaper = "/mnt/hdd_01/data/Pictures/Wallhaven/wallhaven-ym81rl.png"; wallpaper = "/mnt/hdd_01/data/Pictures/Wallhaven/wallhaven-mlwz78.png"; # Dispatchers → the new hl.dsp.* API (signatures verified against hyprland @@ -106,7 +93,7 @@ in debug.disable_logs = false; general = { - border_size = 2; + border_size = 1; col = { inactive_border = lua "bg_accent"; active_border = { diff --git a/secrets/mercury.yaml b/secrets/mercury.yaml index 3de5f53..4ec6587 100644 --- a/secrets/mercury.yaml +++ b/secrets/mercury.yaml @@ -1,6 +1,6 @@ darman_password: ENC[AES256_GCM,data:iZQERcXtyH+91yUc3r7U6jnFYrGQPFeCPk/9ZDfxOhPLlGMX3/iEZ+SzZ7a7rDKUeUAaQUsrqANLDLclRYm4Ngo09EkbDxBx5x2GpQwlqSAS45LHnTen9LTzisWghdy79Xnilq322eaB3g==,iv:ozx/BPLR8nZTKHZroKrrh2z6ZlVCuLydQ3aNY4XvcIg=,tag:CSrq5ZipYxtXTT8RintuHQ==,type:str] pihole_webpassword: ENC[AES256_GCM,data:5iOTqD0CcbOCnM1b4+RbajMTyAU=,iv:2ZRW7dshnPzWkuudrn6n92y4Z2n/6fdnBB7BO5/ypS4=,tag:8UZSqJM6dVECQgrF6v5Fuw==,type:str] -tailscale_authkey: ENC[AES256_GCM,data:swWBS6icqidKMBC6Fo8IyOWIswWzGpRJGhFfA1JPlZsvqEo46J/kLjC6wfU4eOhSBsWTYiiqtHDaX05SKr8gwSxA/ERwj/Swf8bNHST4rbKrI4Cq5QDfzA==,iv:UUdVgkFATla6pmErn2oT06PuQ/kv9L8g0nX2CCPaJhI=,tag:97gAUSfxHzemVljl8FTULw==,type:str] +tailscale_authkey: ENC[AES256_GCM,data:h3jbN9SrPZwUlYJPEbydvcf9tP/qGQPegnY87AYKOj9AsqAgxeEKfLYwtNeksLgcNBvCoJ1ALk7gqfrMw6sCrW7S7IFlDYhSJDAPfFkR6iczInBDpSfISg==,iv:ML+l4nmPfmSoTGQnNWpdxGZkdaq5HKEHaUxKcblmR8w=,tag:BCAbJ6Iy5ziBNLiOuI/5PA==,type:str] sops: age: - enc: | @@ -21,7 +21,7 @@ sops: x6FfYadcRfqvSX60l6+TGdzq6xDpxLIZOJ8q19qZsAvB0in50HW5gg== -----END AGE ENCRYPTED FILE----- recipient: age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t - lastmodified: "2026-08-21T23:14:15Z" - mac: ENC[AES256_GCM,data:zxV+szKjxb+7EV/hSyFeHUs/V2wZgIz8NO78/RDZeGoGtCjwDGiSIFsO1VQI5LZPW+O+pTnT2s4W5P0QuEjYrkPU5LRunW+Tv87XrDBqoR62vPvhRmt0wZXOQZu4oAn7LGpn24xo5QYKc2JowJWIVlyQs03UL3jQtgwfkG9u8k4=,iv:IZpZlUVqaKjO0aokwtF2hFAqC2D9H5bVMO6HezmYQ+Y=,tag:ij6pu3b6CQzctrJ87ifp5Q==,type:str] + lastmodified: "2026-09-18T19:44:32Z" + mac: ENC[AES256_GCM,data:PYNiUnDjBTgTAvTOAMk+XQEgcFSXLXgkw/vQCw0GhZsVHfkvd7jzkpk33ER64JqU4aPw+PRWo937mVKVEGDKkYVY2pP6hl2EJeOtfgjOuL9QpTNh+BKxDhYige5KsxPeMTEvtL7Y6dSsgAneaNPBEeLfZ0wiTVq1v2RJNgdNAGU=,iv:WYbyNn3/0QWXR7X8CHBKPPdVf0tYv8E4F4CYLjnuhVo=,tag:7ABexc8r6WZfskABUsquHg==,type:str] unencrypted_suffix: _unencrypted - version: 3.13.2 + version: 3.13.3 diff --git a/services/vpn/headscale.nix b/services/vpn/headscale.nix index 31adad1..8053fa1 100644 --- a/services/vpn/headscale.nix +++ b/services/vpn/headscale.nix @@ -28,7 +28,7 @@ # single point of failure for tailnet DNS. # ⚠️ Hardcoded tailnet address — check `headscale nodes list` if it # changes (mercury re-enrolled) and DNS dies tailnet-wide. - nameservers.global = [ "100.64.0.7" ]; + nameservers.global = [ "100.64.0.4" ]; # Must be set here, not via the module's `dns.split` option — nixpkgs # renders that one level too high, but headscale (and headplane) read