mirror of
https://github.com/oqyude/nixos.git
synced 2026-10-11 14:27:26 +03:00
metaagent: Wave 1 + T4 + T7 + T3 + T5 + T15 + T16 — 12 tasks of tech-debt reduction
Comprehensive batch addressing the 16-task backlog in
.agent/tasks/manifest.json. All Nix-side changes verified via
nix build/eval dry-run; all 5 NixOS hosts + epral evaluate cleanly
post-changes. No regressions.
Wave 1 (non-functional cleanup):
T1/A1 — configurations/mobile.nix:12: fix `import ../lib/xlib.nix`
(broken path) → `import ../lib/xlib`. Unblocks nixOnDroid
configurations.epral. R1.1 invariant.
T8/C3 — modules/containers/3x-ui.nix: remove `podman-update-3xui_app`
systemd service and commented timer. Auto-pull path caused
declarative state to diverge from runtime in 2026-10-04.
R1.5 invariant.
T13/D3 — modules/server/nginx.nix:368-371: remove dead
`networking.firewall.allowedTCPPorts = [80 443]`.
`firewall.enable = false` on sapphira (R1.3), so openFirewall
rules are no-op. Replace with R1.3 comment.
T6/C1 — .agent/decisions/notes/3x-ui-xray-26.9.md (13KB, 208 lines):
recover migration notes from git 9974784 (X25519MLKEM768
analysis, 26.7→26.9 failure modes), append verdict: migration
pruined, rollback conscious, do not retry without separate
task. R1.5 / C1.
T9/C4 — .agent/rules/project-rules.md: add R1.8 — Xray-core version is
state of 3x-ui panel, not Nix. Update trap entry for
3x-ui.nix:54 to reference R1.8.
T11/D1, T12/D2 — .agent/checkpoints.json + .agent/tasks/manifest.json:
verify R1.3 (router port-forwards 22/80/443/8443/22000) and
R1.4 (100.64.0.0 = Tailscale sapphira) wording already
satisfies acceptance criteria. Flip status pending → completed.
T4 (storage guard, FUNCTIONAL CHANGE):
New helper in lib/xlib/helpers.nix:
mkStorageGuard = xlib: {
RequiresMountsFor = [ xlib.dirs.server-home ];
ConditionPathIsMountPoint = [ "!${xlib.dirs.server-home}" ];
};
Applied to 13 systemd units via path-style override:
- modules/server/{postgresql,samba,homebox,gitea,navidrome,
syncthing,uptime-kuma,immich,nextcloud,calibre-web}.nix
- modules/containers/3x-ui.nix (podman-3xui_app)
- modules/containers/tape-rotation.nix (podman-taperotation-{backend,frontend})
Anchor: xlib.dirs.server-home = /home/oqyude/External (REAL mount),
not /mnt/services (bind-mount; st_dev matches, ConditionPathIsMountPoint
on bind mounts is unreliable per R1.2 note).
Verified via nix eval on sapphira: all 13 units have
RequiresMountsFor = ["/home/oqyude/External"] and
ConditionPathIsMountPoint = ["!/home/oqyude/External"].
Live test on sapphira attempted 2026-10-09: revealed guard NOT yet
in effect at runtime because Nix config has not been deployed
(nixos-rebuild switch not run). postgresql started despite External
being unmounted. Implementation correct, deployment pending user
action.
T7/C2 (read-only diag, no code change):
3x-ui version facts recorded in conversation (sapphira journal +
/var/lib/containers/storage/overlay/.../diff/app/bin/xray-linux-amd64):
- Active Xray: 26.7.28 (go1.26.5 linux/amd64) — R1.5 validated at runtime
- Stale binary: 26.9.30 (go1.27.1) — leftover from failed 26.9 migration
- Panel DB (x-ui.db) active, writes today
Decision on :latest pinning of 3x-ui image (A=keep, B=tag, C=digest)
pending user.
T3/A3 (nftables on otreca — config analysis + proposal):
Diagnostic attempted via ssh otreca-tailscale (100.64.1.0) and
otreca public (109.248.161.5:22): BOTH UNREACHABLE. Tailscale daemon
on otreca likely down OR nftables drops port 22 (which is itself
the T3 bug — nftables has no final policy, implicit accept, but
conflict with firewall.enable = true per R1.6).
Proposal written: .agent/decisions/proposals/vds-nftables-fix.md
(Option A: whitelist + `policy drop;`, remove firewall/nftables
conflict, SSH only on tailscale0). Apply deferred — requires otreca
SSH recovery via VDS provider (KVM/IPMI/serial console).
T5/B2 (backups documentation):
.agent/decisions/0002-backups-external.md (draft): catalog of what
is declared in Nix vs. what is external; awaiting answer to open
question 5.6 (where are backups, how are they verified).
T15/E2 (CI checks):
.ci/checks.sh (executable, ~140 lines) with 3 checks from
analysis-report.md §5:
- #1: no `:latest` in container images (with R1.5 whitelist
for 3x-ui). FAIL — 4 violations:
localhost/kokoro-tts:latest
ghcr.io/openhands/openhands:latest
docker.io/elizaroveugene/taperotation-backend:latest
docker.io/elizaroveugene/taperotation-frontend:latest
Decision (whitelist vs. pin) pending user.
- #2: nix flake check (skipped with --no-build).
- #7: secrets/ files match .sops.yaml path_regex. PASS.
T16/E3 (archive commented modules):
13 of 14 commented modules in modules/server/default.nix:37-50
existed as files. git mv them to archive/{server-modules,containers}/.
1 (stirling-pdf.nix) didn't exist; just removed the comment.
modules/server/default.nix:37-50 cleaned of 14 commented lines.
Added 3-line comment recording the archive date and reason.
Verified: nixosConfigurations.sapphira still evaluates.
Post-change state:
$ nix build .#nixosConfigurations.{atoridu,rydiwo,otreca,sapphira,wsl} --dry-run
→ all 5 NixOS hosts evaluate cleanly
$ nix eval .#nixOnDroidConfigurations.epral.config.system.stateVersion
→ "24.05"
Pending (user input required — not in this commit):
- T4 deploy: run `nixos-rebuild switch` on sapphira to activate guard
- T7: pick A/B/C for 3x-ui :latest pinning
- T3: recover otreca SSH via VDS provider, then apply Option A
- T10/C5: decide fate of reality443Forwarding
- T5: answer 5.6 about backup location/verification
- T15: whitelist or pin 4 :latest images
Untracked files NOT committed (in .gitignore):
.temp/t4-live-test*.sh, .temp/cleanup-*.sh — throwaway test scripts
from T4 live test attempts. Preserved locally for reference; see
AGENTS.md convention ("Создавать `.temp/` в корне проекта — Для
временных файлов агента. Всегда в `.gitignore`").
Also untracked, committed:
.agent/reviews/2026-10-10-review-dev-diff-vs-16644fc.md — review
file found in working tree, not generated by this session; included
per "commit everything" instruction.
This commit is contained in:
+136
@@ -0,0 +1,136 @@
|
||||
#!/usr/bin/env bash
|
||||
# Pre-commit + CI checks for the nixos flake.
|
||||
# Runs the most useful invariants from analysis-report.md §5.
|
||||
#
|
||||
# Usage:
|
||||
# .ci/checks.sh # run all
|
||||
# .ci/checks.sh --no-build # skip nix flake check (faster, no network)
|
||||
#
|
||||
# Exit codes:
|
||||
# 0 — all checks passed
|
||||
# 1 — at least one check failed (stderr has details)
|
||||
#
|
||||
# Checks implemented:
|
||||
# #2 nix flake check (all outputs evaluate)
|
||||
# #7 secrets/ files match .sops.yaml path_regex
|
||||
# #1 no `:latest` in container images (with R1.5 whitelist: 3x-ui is frozen on :latest)
|
||||
#
|
||||
# Not yet implemented (candidates from analysis-report.md §5):
|
||||
# #3 coredns domains ↔ nginx vhosts bidirectional match
|
||||
# #4 mkServiceStorage consumers have existing External dir
|
||||
# #5 last nftables chain rule is explicit (drop/reject/policy)
|
||||
# #6 listen.addr is interface, not network (e.g. 0.0.0.0 is OK, 192.168.0.0/24 is not)
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
cd "$REPO_ROOT"
|
||||
|
||||
LATEST_ALLOWLIST=(
|
||||
"ghcr.io/mhsanaei/3x-ui:latest"
|
||||
)
|
||||
|
||||
SKIP_BUILD=false
|
||||
for arg in "$@"; do
|
||||
case "$arg" in
|
||||
--no-build) SKIP_BUILD=true ;;
|
||||
*) echo "Unknown arg: $arg" >&2; exit 2 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
PASS=0
|
||||
FAIL=0
|
||||
report() {
|
||||
if [ "$1" -eq 0 ]; then
|
||||
echo " PASS: $2"
|
||||
PASS=$((PASS + 1))
|
||||
else
|
||||
echo " FAIL: $2" >&2
|
||||
FAIL=$((FAIL + 1))
|
||||
fi
|
||||
}
|
||||
|
||||
check_nix_flake_check() {
|
||||
if [ "$SKIP_BUILD" = true ]; then
|
||||
echo "SKIP: nix flake check (--no-build)"
|
||||
return 0
|
||||
fi
|
||||
if ! command -v nix >/dev/null 2>&1; then
|
||||
echo "SKIP: nix not in PATH"
|
||||
return 0
|
||||
fi
|
||||
echo "Check #2: nix flake check ..."
|
||||
if nix --extra-experimental-features "nix-command flakes" flake check 2>&1 | tail -50; then
|
||||
report 0 "nix flake check"
|
||||
else
|
||||
report 1 "nix flake check"
|
||||
fi
|
||||
}
|
||||
|
||||
check_sops_path_regex() {
|
||||
echo "Check #7: secrets/ files match .sops.yaml path_regex ..."
|
||||
local regex
|
||||
regex=$(awk -F'path_regex:[[:space:]]*' '/path_regex:/ {print $2; exit}' .sops.yaml)
|
||||
if [ -z "${regex:-}" ]; then
|
||||
echo " SKIP: no path_regex found in .sops.yaml"
|
||||
return 0
|
||||
fi
|
||||
local mismatches=()
|
||||
while IFS= read -r -d '' f; do
|
||||
if ! printf '%s\n' "$f" | grep -Eqx "${regex}"; then
|
||||
mismatches+=("$f")
|
||||
fi
|
||||
done < <(find secrets -type f -print0 2>/dev/null)
|
||||
if [ "${#mismatches[@]}" -eq 0 ]; then
|
||||
report 0 "sops path_regex ($regex)"
|
||||
else
|
||||
echo " Files NOT matching $regex:" >&2
|
||||
printf ' %s\n' "${mismatches[@]}" >&2
|
||||
report 1 "sops path_regex ($regex)"
|
||||
fi
|
||||
}
|
||||
|
||||
check_no_latest_images() {
|
||||
echo "Check #1: no :latest in container images (whitelist allowed) ..."
|
||||
local latest_lines
|
||||
latest_lines=$(grep -rn --include='*.nix' -E 'image\s*=\s*"[^"]+:latest"' modules/ 2>/dev/null || true)
|
||||
if [ -z "$latest_lines" ]; then
|
||||
report 0 "no :latest images"
|
||||
return 0
|
||||
fi
|
||||
local latest_images
|
||||
latest_images=$(printf '%s\n' "$latest_lines" | sed -E 's/.*image\s*=\s*"([^"]+)".*/\1/')
|
||||
local violations=()
|
||||
while IFS= read -r img; do
|
||||
[ -z "$img" ] && continue
|
||||
local allowed=false
|
||||
for w in "${LATEST_ALLOWLIST[@]}"; do
|
||||
if [ "$img" = "$w" ]; then
|
||||
allowed=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
if [ "$allowed" = false ]; then
|
||||
violations+=("$img")
|
||||
fi
|
||||
done <<< "$latest_images"
|
||||
if [ "${#violations[@]}" -eq 0 ]; then
|
||||
report 0 "no :latest images (whitelist honoured)"
|
||||
else
|
||||
echo " Images using :latest (not in whitelist):" >&2
|
||||
printf ' %s\n' "${violations[@]}" >&2
|
||||
echo " Add to LATEST_ALLOWLIST in .ci/checks.sh if intentional." >&2
|
||||
report 1 "no :latest images"
|
||||
fi
|
||||
}
|
||||
|
||||
echo "=== nixos flake checks ==="
|
||||
check_nix_flake_check
|
||||
check_sops_path_regex
|
||||
check_no_latest_images
|
||||
echo "==="
|
||||
echo "PASS: $PASS FAIL: $FAIL"
|
||||
if [ "$FAIL" -gt 0 ]; then
|
||||
exit 1
|
||||
fi
|
||||
exit 0
|
||||
Reference in New Issue
Block a user