darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
148 Commits 2 Branches 0 Tags
6116ec4e5a1c08a0fc19e6d216ffe10700a3e09e
Commit Graph
61 Commits
Author SHA1 Message Date
darman fe5b363b73 Added Jellyfin service to jupiter 2026-07-17 23:12:04 +02:00
erik ac05d948b6 refactor: rename vps host -> neptun (solar-system theme) 
git-mv hosts/vps->neptun, secrets/vps.yaml->neptun.yaml; update flake, .sops.yaml
rules, hostName, sops paths, README/CLAUDE. Off-repo host key dir renamed too.
 2026-07-14 13:32:44 +02:00
erik 19c65e1921 feat(pihole): wildcard *.jupiter.sol -> jupiter (VM-verified) 2026-07-14 13:24:22 +02:00
erik 20a16fda99 fix(pihole): pin image to 2026.07.2 (sed failed in prior commit) 2026-07-14 00:11:08 +02:00
erik fd3ccf5f07 feat(mercury): pihole via container (native FTL segfaults on aarch64) 
- services/pihole.nix: official pihole/pihole:2026.07.2 via podman, host net,
  caps NET_ADMIN/NET_RAW/SYS_NICE/CHOWN; FTLCONF_* env config (upstream unbound,
  DHCP 50-200, static lease jupiter, .sol domain, local records)
- unbound: resolveLocalQueries=false (was hijacking resolv.conf to :53 -> boot
  DNS deadlock; the real root cause of the earlier failures too)
- password via sops FTLCONF env file; /var/lib/pihole created via tmpfiles
- VM-verified: mercury.sol/jupiter.sol/external all resolve, 0 restarts
 2026-07-14 00:10:43 +02:00
erik c2ac7e3af4 fix(pihole): local DNS records for mercury.sol + jupiter.sol (dns.hosts) 
mercury is the DHCP server (no lease of its own) so its name wasn't resolvable.
Add explicit dns.hosts A records. VM-verified: both resolve, external unaffected.
 2026-07-13 22:58:41 +02:00
erik 70a851c71d feat(mercury): switch to pihole-ftl (declarative static leases) 
- services/pihole.nix: DNS adblock + DHCP, upstream unbound, .sol domain,
  jupiter static lease 00:e0:4c:3c:a3:1f -> 10.0.0.20 (declarative!)
- drop services/adguardhome.nix; mercury imports pihole
- admin password set via 'pihole setpassword' post-boot (not in repo)
 2026-07-13 21:56:08 +02:00
erik 1937d59b2c feat: per-host darman passwords via sops; mercury sops; AdGuard pw via UI 
- per-host darman_password (distinct hash) in secrets/{jupiter,vps,mercury}.yaml
  -> hashedPasswordFile; different console password per host (ssh still key-only)
- mercury: dedicated age key (on boot partition post-flash), sops-nix wired
- AdGuard: module has no secret hook + writable config -> mutableSettings=true,
  admin password set via web setup on first boot (never in repo/store)
 2026-07-13 20:52:06 +02:00
erik 5a23638f75 feat(mercury): AdGuard Home DNS adblock + DHCP, forwards to unbound 
- services/adguardhome.nix: upstream unbound, .sol local domain, DHCP 50-200
- nix-owned config (mutableSettings=false); adlists + dns declared
- mercury imports adguard + unbound; drop the pick-one placeholder block
- TODO: bcrypt admin password, jupiter static lease via UI (needs its MAC)
 2026-07-13 20:13:01 +02:00
erik 587fcbfa3d feat(mercury): set real IP 10.0.0.10; add services/unbound.nix recursive resolver 2026-07-13 20:01:55 +02:00
erik fb782cb9fe refactor: split services into reusable services/ modules 
- services/{samba,avahi,audiobookshelf,containers,caddy,tailscale}.nix
- common.nix grows firewall base + timezone; hosts import what they need
- jupiter/vm/vps import service modules; drop the jupiter/services.nix monolith
- each module opens its own firewall ports; caddy/tailscale shared by hosts
- verified: jupiter/vps/vbox eval + jupiter builds, config equivalent
 2026-07-13 19:13:11 +02:00