darmanandClaude Sonnet 5
6f24ab69ad
Comments had drifted into multi-paragraph narrative (git commit lineage, debugging stories, restated code) in several hot spots (scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix). Trim every comment to its load-bearing "why" — gotchas, safety warnings, and non-obvious rationale survive verbatim in substance, just tightened to 1-2 sentences; historical narrative and anything already covered in CLAUDE.md is cut. No code/logic changed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21
55 lines
2.2 KiB
Nix
55 lines
2.2 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
# mars — on-site x86_64 box for Hermes Agent (luna), plus the web apps she
|
|
# hosts herself. See hermes-agent.nix for what Hermes is and why it moved here
|
|
# from jupiter, and luna-sites.nix for the app hosting.
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
./disk-config.nix # disko: OS-disk partitions + filesystems
|
|
./secrets.nix # sops-nix: samba/tailscale/hermes secrets
|
|
./hermes-agent.nix
|
|
./livesync-bridge.nix
|
|
./luna-sites.nix # luna's LAN web apps: http://mars.sol/<name>/
|
|
../../common.nix # shared base: user / ssh / nix / firewall
|
|
../../services/containers.nix
|
|
../../services/vpn/tailscale.nix
|
|
../../services/monitoring/node-exporter.nix
|
|
];
|
|
|
|
networking.hostName = "mars";
|
|
networking.networkmanager.enable = true; # DHCP on-site, same as jupiter
|
|
users.users.darman.extraGroups = [ "docker" ]; # merges with common.nix; podman debug access
|
|
|
|
# ---- Boot (UEFI, confirmed) ----
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
# jupiter's samba share (services/network/samba.nix), mounted on demand so
|
|
# mars doesn't stall when jupiter is off — also where Hermes's shared
|
|
# dropbox lives (hermes-agent.nix). Tighter modes than terra's equivalent
|
|
# mount (0770/gid=hermes, not 0755/gid=users) since the hermes-agent
|
|
# container (uid 986/gid 983, no podman userns remapping) needs group
|
|
# write here, not just darman.
|
|
fileSystems."/mnt/jupiter" = {
|
|
device = "//jupiter/data";
|
|
fsType = "cifs";
|
|
options = [
|
|
"credentials=${config.sops.templates."jupiter-smb.credentials".path}"
|
|
"uid=1000"
|
|
"gid=983"
|
|
"file_mode=0770"
|
|
"dir_mode=0770"
|
|
"nofail"
|
|
"x-systemd.automount" # lazy-mount so boot doesn't stall if jupiter's down
|
|
# NO idle-timeout here (unlike terra's): podman-hermes-agent.service
|
|
# RequiresMountsFor this path, so an idle auto-unmount silently kills
|
|
# the container with it — confirmed the hard way (~60-70s per start).
|
|
"x-systemd.mount-timeout=10s"
|
|
"_netdev"
|
|
];
|
|
};
|
|
|
|
system.stateVersion = "26.05"; # set at install time; do NOT bump on upgrades
|
|
}
|