darmanandClaude Sonnet 5
7904433d34
Local LLM server on the 6800 XT (ollama-rocm, gfx1030 needs no HSA_OVERRIDE_GFX_VERSION) fronted by a LibreChat web UI, talking to it over the OpenAI-compatible /v1 route. Also wires up LibreChat's persistent-memory feature, which needed its own agent+model plus a custom extraction prompt: the default 3b model couldn't reliably tell the user's stated facts apart from its own boilerplate, and even a tuned prompt didn't fix that — so memory extraction now reuses gemma4:12b, the same model as the daily-driver chat endpoint. flake.lock bump pulls in the ollama and librechat NixOS modules. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
35 lines
1.6 KiB
Nix
35 lines
1.6 KiB
Nix
{ config, ... }:
|
|
|
|
# sops-nix wiring for terra (desktop). Encrypted values in ../../secrets/terra.yaml,
|
|
# decrypted with terra's own SSH host key (recipient in ../../.sops.yaml).
|
|
# The host key is pre-generated on the laptop and shipped at install
|
|
# (nixos-anywhere --extra-files -> /etc/ssh/ssh_host_ed25519_key).
|
|
{
|
|
sops.defaultSopsFile = ../../secrets/terra.yaml;
|
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
|
|
sops.secrets.tailscale_authkey = { };
|
|
|
|
sops.secrets.darman_password.neededForUsers = true;
|
|
users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
|
|
|
|
# Credentials file for the //jupiter/data cifs mount (see configuration.nix).
|
|
# samba_password mirrors jupiter's own samba_password secret (services/network/samba.nix) —
|
|
# same value, just also encrypted to terra so it can authenticate as the same smb user.
|
|
sops.secrets.samba_password = { };
|
|
sops.templates."jupiter-smb.credentials".content = ''
|
|
username=darman
|
|
password=${config.sops.placeholder.samba_password}
|
|
'';
|
|
|
|
# LibreChat's CREDS_KEY/IV encrypt stored user credentials (linked 3rd-party
|
|
# API keys etc) at rest in mongo; JWT_SECRET/JWT_REFRESH_SECRET sign session
|
|
# tokens. All four are random, generated once with `sops --set` (see
|
|
# CLAUDE.md) — losing/rotating them just invalidates existing sessions and
|
|
# any saved per-user API keys, nothing else depends on their value.
|
|
sops.secrets.librechat_creds_key = { };
|
|
sops.secrets.librechat_creds_iv = { };
|
|
sops.secrets.librechat_jwt_secret = { };
|
|
sops.secrets.librechat_jwt_refresh_secret = { };
|
|
}
|