darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
54 Commits 2 Branches 0 Tags
d7a66f3e3be842a074e4bdb798e0348c468edb50
Commit Graph
10 Commits
Author SHA1 Message Date
darmanandClaude Sonnet 5 d7a66f3e3b Reorganize services/ into category subfolders 
Group service modules by category (media, network, vpn, identity,
dev, desktop) to make the growing services/ dir easier to navigate.
containers.nix stays at the top level since it's a shared backend,
not a single-category service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-20 06:08:43 +02:00
darmanandClaude Sonnet 5 4679afa505 Trim comments across configs and services 
Shorten verbose multi-paragraph comments to essentials, and drop a
stale claim in common.nix that jupiter kept its own copy of the base
config (it now imports common.nix directly).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-20 06:04:27 +02:00
erik a6e6f0d5d4 feat(mercury): static IPv6 (fd18:df17:9078:0::10) for IPv6 DNS 2026-07-14 13:07:37 +02:00
erik fd3ccf5f07 feat(mercury): pihole via container (native FTL segfaults on aarch64) 
- services/pihole.nix: official pihole/pihole:2026.07.2 via podman, host net,
  caps NET_ADMIN/NET_RAW/SYS_NICE/CHOWN; FTLCONF_* env config (upstream unbound,
  DHCP 50-200, static lease jupiter, .sol domain, local records)
- unbound: resolveLocalQueries=false (was hijacking resolv.conf to :53 -> boot
  DNS deadlock; the real root cause of the earlier failures too)
- password via sops FTLCONF env file; /var/lib/pihole created via tmpfiles
- VM-verified: mercury.sol/jupiter.sol/external all resolve, 0 restarts
 2026-07-14 00:10:43 +02:00
erik 22a3eee85b feat(mercury): pihole web password from sops via FTLCONF env override 
pihole.toml is nix-managed read-only so 'pihole setpassword' fails. pihole-FTL
reads FTLCONF_* env vars (override the toml) — render an env file from the sops
secret pihole_webpassword and feed it via EnvironmentFile. Password stays out of
repo/store. VERIFIED in VM: FTLCONF_webserver_api_password -> API login works.
 2026-07-13 22:40:12 +02:00
erik 70a851c71d feat(mercury): switch to pihole-ftl (declarative static leases) 
- services/pihole.nix: DNS adblock + DHCP, upstream unbound, .sol domain,
  jupiter static lease 00:e0:4c:3c:a3:1f -> 10.0.0.20 (declarative!)
- drop services/adguardhome.nix; mercury imports pihole
- admin password set via 'pihole setpassword' post-boot (not in repo)
 2026-07-13 21:56:08 +02:00
erik 1937d59b2c feat: per-host darman passwords via sops; mercury sops; AdGuard pw via UI 
- per-host darman_password (distinct hash) in secrets/{jupiter,vps,mercury}.yaml
  -> hashedPasswordFile; different console password per host (ssh still key-only)
- mercury: dedicated age key (on boot partition post-flash), sops-nix wired
- AdGuard: module has no secret hook + writable config -> mutableSettings=true,
  admin password set via web setup on first boot (never in repo/store)
 2026-07-13 20:52:06 +02:00
erik 5a23638f75 feat(mercury): AdGuard Home DNS adblock + DHCP, forwards to unbound 
- services/adguardhome.nix: upstream unbound, .sol local domain, DHCP 50-200
- nix-owned config (mutableSettings=false); adlists + dns declared
- mercury imports adguard + unbound; drop the pick-one placeholder block
- TODO: bcrypt admin password, jupiter static lease via UI (needs its MAC)
 2026-07-13 20:13:01 +02:00
erik 587fcbfa3d feat(mercury): set real IP 10.0.0.10; add services/unbound.nix recursive resolver 2026-07-13 20:01:55 +02:00
erik 894f88c71e feat: scaffold mercury (rpi 3b+ aarch64 SD image) for DNS/DHCP 
- nixosConfigurations.mercury: aarch64, sd-image-aarch64, imports common.nix
- static net placeholders (CHANGE-ME), hostname mercury
- DNS service left undecided: commented pihole (services.pihole-ftl) + adguardhome
- no sops yet (add with the service if it needs a secret)
 2026-07-13 19:49:45 +02:00