mirror of
https://github.com/oqyude/nixos.git
synced 2026-10-11 14:27:26 +03:00
Comprehensive batch addressing the 16-task backlog in
.agent/tasks/manifest.json. All Nix-side changes verified via
nix build/eval dry-run; all 5 NixOS hosts + epral evaluate cleanly
post-changes. No regressions.
Wave 1 (non-functional cleanup):
T1/A1 — configurations/mobile.nix:12: fix `import ../lib/xlib.nix`
(broken path) → `import ../lib/xlib`. Unblocks nixOnDroid
configurations.epral. R1.1 invariant.
T8/C3 — modules/containers/3x-ui.nix: remove `podman-update-3xui_app`
systemd service and commented timer. Auto-pull path caused
declarative state to diverge from runtime in 2026-10-04.
R1.5 invariant.
T13/D3 — modules/server/nginx.nix:368-371: remove dead
`networking.firewall.allowedTCPPorts = [80 443]`.
`firewall.enable = false` on sapphira (R1.3), so openFirewall
rules are no-op. Replace with R1.3 comment.
T6/C1 — .agent/decisions/notes/3x-ui-xray-26.9.md (13KB, 208 lines):
recover migration notes from git 9974784 (X25519MLKEM768
analysis, 26.7→26.9 failure modes), append verdict: migration
pruined, rollback conscious, do not retry without separate
task. R1.5 / C1.
T9/C4 — .agent/rules/project-rules.md: add R1.8 — Xray-core version is
state of 3x-ui panel, not Nix. Update trap entry for
3x-ui.nix:54 to reference R1.8.
T11/D1, T12/D2 — .agent/checkpoints.json + .agent/tasks/manifest.json:
verify R1.3 (router port-forwards 22/80/443/8443/22000) and
R1.4 (100.64.0.0 = Tailscale sapphira) wording already
satisfies acceptance criteria. Flip status pending → completed.
T4 (storage guard, FUNCTIONAL CHANGE):
New helper in lib/xlib/helpers.nix:
mkStorageGuard = xlib: {
RequiresMountsFor = [ xlib.dirs.server-home ];
ConditionPathIsMountPoint = [ "!${xlib.dirs.server-home}" ];
};
Applied to 13 systemd units via path-style override:
- modules/server/{postgresql,samba,homebox,gitea,navidrome,
syncthing,uptime-kuma,immich,nextcloud,calibre-web}.nix
- modules/containers/3x-ui.nix (podman-3xui_app)
- modules/containers/tape-rotation.nix (podman-taperotation-{backend,frontend})
Anchor: xlib.dirs.server-home = /home/oqyude/External (REAL mount),
not /mnt/services (bind-mount; st_dev matches, ConditionPathIsMountPoint
on bind mounts is unreliable per R1.2 note).
Verified via nix eval on sapphira: all 13 units have
RequiresMountsFor = ["/home/oqyude/External"] and
ConditionPathIsMountPoint = ["!/home/oqyude/External"].
Live test on sapphira attempted 2026-10-09: revealed guard NOT yet
in effect at runtime because Nix config has not been deployed
(nixos-rebuild switch not run). postgresql started despite External
being unmounted. Implementation correct, deployment pending user
action.
T7/C2 (read-only diag, no code change):
3x-ui version facts recorded in conversation (sapphira journal +
/var/lib/containers/storage/overlay/.../diff/app/bin/xray-linux-amd64):
- Active Xray: 26.7.28 (go1.26.5 linux/amd64) — R1.5 validated at runtime
- Stale binary: 26.9.30 (go1.27.1) — leftover from failed 26.9 migration
- Panel DB (x-ui.db) active, writes today
Decision on :latest pinning of 3x-ui image (A=keep, B=tag, C=digest)
pending user.
T3/A3 (nftables on otreca — config analysis + proposal):
Diagnostic attempted via ssh otreca-tailscale (100.64.1.0) and
otreca public (109.248.161.5:22): BOTH UNREACHABLE. Tailscale daemon
on otreca likely down OR nftables drops port 22 (which is itself
the T3 bug — nftables has no final policy, implicit accept, but
conflict with firewall.enable = true per R1.6).
Proposal written: .agent/decisions/proposals/vds-nftables-fix.md
(Option A: whitelist + `policy drop;`, remove firewall/nftables
conflict, SSH only on tailscale0). Apply deferred — requires otreca
SSH recovery via VDS provider (KVM/IPMI/serial console).
T5/B2 (backups documentation):
.agent/decisions/0002-backups-external.md (draft): catalog of what
is declared in Nix vs. what is external; awaiting answer to open
question 5.6 (where are backups, how are they verified).
T15/E2 (CI checks):
.ci/checks.sh (executable, ~140 lines) with 3 checks from
analysis-report.md §5:
- #1: no `:latest` in container images (with R1.5 whitelist
for 3x-ui). FAIL — 4 violations:
localhost/kokoro-tts:latest
ghcr.io/openhands/openhands:latest
docker.io/elizaroveugene/taperotation-backend:latest
docker.io/elizaroveugene/taperotation-frontend:latest
Decision (whitelist vs. pin) pending user.
- #2: nix flake check (skipped with --no-build).
- #7: secrets/ files match .sops.yaml path_regex. PASS.
T16/E3 (archive commented modules):
13 of 14 commented modules in modules/server/default.nix:37-50
existed as files. git mv them to archive/{server-modules,containers}/.
1 (stirling-pdf.nix) didn't exist; just removed the comment.
modules/server/default.nix:37-50 cleaned of 14 commented lines.
Added 3-line comment recording the archive date and reason.
Verified: nixosConfigurations.sapphira still evaluates.
Post-change state:
$ nix build .#nixosConfigurations.{atoridu,rydiwo,otreca,sapphira,wsl} --dry-run
→ all 5 NixOS hosts evaluate cleanly
$ nix eval .#nixOnDroidConfigurations.epral.config.system.stateVersion
→ "24.05"
Pending (user input required — not in this commit):
- T4 deploy: run `nixos-rebuild switch` on sapphira to activate guard
- T7: pick A/B/C for 3x-ui :latest pinning
- T3: recover otreca SSH via VDS provider, then apply Option A
- T10/C5: decide fate of reality443Forwarding
- T5: answer 5.6 about backup location/verification
- T15: whitelist or pin 4 :latest images
Untracked files NOT committed (in .gitignore):
.temp/t4-live-test*.sh, .temp/cleanup-*.sh — throwaway test scripts
from T4 live test attempts. Preserved locally for reference; see
AGENTS.md convention ("Создавать `.temp/` в корне проекта — Для
временных файлов агента. Всегда в `.gitignore`").
Also untracked, committed:
.agent/reviews/2026-10-10-review-dev-diff-vs-16644fc.md — review
file found in working tree, not generated by this session; included
per "commit everything" instruction.
129 lines
3.8 KiB
Nix
129 lines
3.8 KiB
Nix
{
|
|
inputs,
|
|
...
|
|
}@flakeContext:
|
|
let
|
|
# Host: epral (Android device via nix-on-droid, aarch64-linux)
|
|
# Integrates with the base defaultModule (imports.self.nixosModules.default),
|
|
# which is trimmed for the "termux" device type: NixOS-only modules
|
|
# (essentials, users.nix, home-manager, sops-nix, disko, grub2-themes)
|
|
# and nixpkgs.overlays are skipped so it evaluates under nix-on-droid's
|
|
# module system (class = "nixOnDroid").
|
|
xlib = import ../lib/xlib { lib = inputs.nixpkgs.lib; };
|
|
nixOnDroidModule =
|
|
{
|
|
lib,
|
|
pkgs,
|
|
xlib,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
inputs.self.nixosModules.strict
|
|
];
|
|
|
|
# Login shell. nix-on-droid writes /etc/passwd from user.shell on every
|
|
# activation, so `chsh` is useless here — set it in nix instead.
|
|
# (default is bashInteractive)
|
|
user.shell = "${pkgs.zsh}/bin/zsh";
|
|
|
|
# SSH user (matches the `User` entries in the client's ~/.ssh/config).
|
|
# Default is "nix-on-droid"; home stays at the read-only
|
|
# /data/data/com.termux.nix/files/home either way.
|
|
user.userName = xlib.device.username;
|
|
|
|
# Minimal termux settings (nix-on-droid options only:
|
|
# environment.*, nix.*, time.*, user.*, system.*, android-integration.*)
|
|
|
|
# user.userName defaults to "nix-on-droid"; set it to override.
|
|
# user.home is read-only: /data/data/com.termux.nix/files/home
|
|
|
|
# Simply install just the packages
|
|
environment.packages = with pkgs; [
|
|
# User-facing stuff that you really really want to have
|
|
vim # or some other editor, e.g. nano or neovim
|
|
nano
|
|
|
|
# Some common stuff that people expect to have
|
|
bzip2
|
|
diffutils
|
|
findutils
|
|
git
|
|
gnugrep
|
|
gnupg
|
|
gnused
|
|
gnutar
|
|
gzip
|
|
hostname
|
|
man
|
|
ncurses
|
|
openssh
|
|
procps
|
|
psmisc # provides killall (attr `killall` was removed from nixpkgs)
|
|
treefmt
|
|
tzdata
|
|
unzip
|
|
util-linux # renamed from utillinux
|
|
zip
|
|
];
|
|
|
|
# Backup etc files instead of failing to activate generation if a file already exists in /etc
|
|
environment.etcBackupExtension = ".bak";
|
|
|
|
# Shared userspace home-manager config (same cozy shell as on NixOS hosts).
|
|
# nix-on-droid forces home.username / home.homeDirectory from user.*,
|
|
# so the strict module must not set them.
|
|
# xlib is injected via home-manager.extraSpecialArgs (the HM submodule
|
|
# does not inherit the nix-on-droid module args).
|
|
home-manager = {
|
|
useGlobalPkgs = true;
|
|
backupFileExtension = "hm-bak";
|
|
extraSpecialArgs = {
|
|
inherit xlib;
|
|
};
|
|
config =
|
|
{ ... }:
|
|
{
|
|
imports = [
|
|
../home/termux.nix
|
|
];
|
|
home.stateVersion = "24.05";
|
|
};
|
|
};
|
|
|
|
# Read the changelog before changing this value
|
|
system.stateVersion = "24.05";
|
|
|
|
# Set up nix for flakes
|
|
nix.extraOptions = ''
|
|
experimental-features = nix-command flakes
|
|
'';
|
|
|
|
# Set your time zone
|
|
time.timeZone = "Europe/Moscow";
|
|
|
|
android-integration.termux-setup-storage.enable = true;
|
|
|
|
# Provides `am` (termux-am) — required by termux-api's broadcast backend.
|
|
android-integration.am.enable = true;
|
|
};
|
|
in
|
|
inputs.nix-on-droid.lib.nixOnDroidConfiguration {
|
|
pkgs = import inputs.nixpkgs {
|
|
system = "aarch64-linux";
|
|
};
|
|
modules = [
|
|
nixOnDroidModule
|
|
];
|
|
extraSpecialArgs = {
|
|
# `xlib` is the same value shape NixOS hosts get (lib/mkSystem.nix);
|
|
# the hostname lives here because nixOnDroidConfigurations is keyed by
|
|
# both "epral" and the "default" alias, so it cannot come from the
|
|
# attribute name.
|
|
xlib = xlib.mkXlib {
|
|
hostname = "epral";
|
|
type = "termux";
|
|
};
|
|
};
|
|
}
|