Install ct from its flake, with its config, a tmux menu on prefix T and a user service for the web UI. Also keep Claude Code transcripts for ten years instead of 30 days, since threads are meant to be revisited.
Have logind ignore the lid switch and suspend/hibernate keys so the
machine stays reachable over SSH with the lid closed. SUPER + SHIFT + x
remains the way to suspend; closing the lid now only locks the screen.
With the default 6 icamerasrc buffers the camera HAL ran out of pending
requests and dropped every fourth sensor frame, capping output at ~22.5 fps.
Using 10 buffers keeps the request queue fed and restores 30 fps.
Pinwheel's sshd had no way to accept keys from other hosts. Give it the
same `authorizedKeysCommand` setup as backwards and manatee, and authorize
a new `alex.backwards-pinwheel` key that backwards uses for `ssh pinwheel`.
`hid_nintendo` claims the pad when it is in Nintendo Switch mode, which
leaves Steam unable to reach it through hidraw. Blacklist the module and
tag the device with `uaccess` so Steam can open it.
`nix.gc` run as root cannot prune generations under
`~/.local/state/nix/profiles` (NixOS/nix#8508), and `nix-gc-env` only
looks in `/nix/var/nix/profiles`. Home-manager generations therefore
accumulated since August 2024 and filled the disk.
`nh clean all` enumerates users and walks their per-user profiles too.
It replaces `nix.gc.automatic`, which cannot be enabled alongside it.
Only `pinwheel` set this. Elsewhere files in `/tmp` survived reboots,
and leftover `nh` build result symlinks there kept acting as GC roots,
pinning store paths that should have been collected.
Served at dagbok.ppp.pm through nginx from 127.0.0.1:8093, with its token
from agenix, a Hetzner DNS-01 certificate, a dynamic DNS record and a
state backup snapshot.
/var/lib/<name> is a symlink into /var/lib/private for those, so find
stopped at the link and the state dump never copied their databases
(schema, puppy-tracker, todo, …). Follow it with find -H.
The WHIB frontend module no longer runs a container or has a `port`
option. Forward host port 8081 to nginx in the VM instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The household weekly plan at schema.ppp.pm: its module, certificate,
DNS record, backup and secrets. The link to puppy-tracker is prepared
but commented out until puppy-tracker with the integration feed is
deployed.
tmpfiles re-applied root:root to /var/lib/romm/db on every switch. A
MariaDB running as uid 999 then could not delete tc.log on shutdown,
so the next start took it for a crash and failed recovery with "Bad
magic header in tc log".
lego v5 renamed --dns.propagation-wait to --dns.propagation.wait and
--dns-timeout to --dns.timeout, and exits on the old names, so ordering
or renewing any certificate failed. The six identical cert blocks are
now one definition applied to each domain.
systemd-tmpfiles now ensures ~/code and ~/code/work are owned by
alex, since agenix previously created ~/code/work as root when the
work secrets pointed there directly.
Also drop the custom path= on work-gitconfig, work-github-token, and
work-go-private so they use agenix's default secret path instead of
living under ~/code/work.
Adds hardware.ipu6 for the built-in MIPI camera, plus two overlay
fixes needed for it to actually work on this hardware:
- Pin icamerasrc-ipu6epmtl to the same release tag already used by
ipu6-camera-bins/ipu6-camera-hal (20250923_ov02e). The version
nixpkgs currently pulls is an Intel internal IoT/Panther-Lake
validation build whose device table only lists external USB
AR0234 test sensors, never the real ov08x40, so the camera never
gets selected.
- Patch ipu6-camera-hal's hardcoded IVSC/CVS entity name from
"Intel IVSC CSI" (the out-of-tree ivsc driver's name) to "Intel
CVS" (the mainlined intel_cvs driver's name). The mismatch broke
I2C bus address resolution for the sensor, which cascaded into
wrong stream configs and black/missing video.
viperML/nh was moved to nix-community/nh and the old repo deleted, so
the pinned URL 404s on any re-fetch. The pinned commit still exists in
the new repo, so keep the exact rev and only change the owner.
Bluetooth HID devices (e.g. a mouse) appearing as power_supply
entries in sysfs make waybar's Battery::refreshBatteries() throw
an uncaught exception and abort. Restricting to BAT0 avoids
enumerating those devices.
Hyprland's lua API only registers hl.bind; there is no separate
hl.bindm. The settings.bindm key rendered as a literal hl.bindm(...)
call, which errored with "attempt to call a nil value" at runtime.
Fold the mouse binds into settings.bind with { mouse = true }, per
the wiki's own example config.
Hyprland 0.56.x dropped the hyprlang (.conf) config backend in favor
of Lua-only config. Switch configType to "lua" and rewrite monitors,
workspace/window rules, binds, env vars, and autostart using the new
hl.* dispatcher API. Un-pin the hyprland flake input (back to current,
following root nixpkgs) now that the config no longer depends on the
old hyprlang backend.
Every module that injects Hyprland keybinds (foot, wezterm, bemenu,
music, light, sound, screenshot, physlock, hyprlock) is converted to
the same Lua bind syntax, since the config is all-or-nothing per
configType. hyprlock's swayidle dpms toggle and the hyprland-monitors
hotplug script's hyprctl dispatch calls are updated to the new
hl.dsp.* expression syntax the same way.
One behavior change: hl.workspace_rule keeps only the last monitor set
per workspace (unlike hyprlang's rule list), so workspaces that used
to declare two candidate monitors now declare one static default;
the hyprland-monitors service still re-dispatches the correct monitor
on startup and hotplug.
Hyprland 0.56.0 dropped the hyprlang (.conf) config backend entirely
in favor of a Lua-only config, breaking the deployed hyprland.conf on
pinwheel. Pin back to 79bc0ca (last hyprlang-supporting build) until
the config is migrated to Lua.
Also drop hyprland's nixpkgs.follows override: building the old
Hyprland rev against the current (newer) root nixpkgs caused a
libstdc++ ABI mismatch between the cached hyprtoolkit binary and a
freshly-compiled hyprland-guiutils.
Wire the offline-first todo app (github: local /home/alex/code/todo) into
manatee, following the app-module convention:
- flake input `todo` (local git checkout for now; gitea URL commented) with
nixpkgs following.
- hosts/manatee/modules/todo: mod.todo option importing the app's NixOS module;
runs on 127.0.0.1:8091, secureCookies, token from agenix; the host owns the
nginx vhost (todo.ppp.pm, forceSSL + useACMEHost) and homepage card.
- mod.todo.enable = true.
- certs: todo.ppp.pm DNS-01 cert via hetzner.
- home-assistant DNS updater: add `todo` to the Hetzner subdomain list.
- secrets: todo-token.age (encrypted access token) + recipients in secrets.nix.
Add a start-limit (5 restarts / 5 min) to the romm, romm-db, romm-redis
and homeassistant podman services so a failing container enters a
`failed` state instead of retrying forever. A slow crash-loop (~5s per
attempt) stays under systemd's default 5-starts-per-10s limit, so a
longer window is needed to catch it.
And don't force the async path, wait at least 0.1sec for terminal to
answer with capabilities. Using the async path broke the answer and
inserted 4 spaces in the beginning of the buffer
Alexander Heldt