Ryan Yin
212f45e2ca
security: restrict k3s kubeconfig file mode to 600
2026-08-26 18:14:43 +08:00
Ryan Yin
be6e2b4110
security: bind aquamarine metrics exporters to loopback
2026-08-26 18:14:43 +08:00
Ryan Yin
36c29a8371
security: enable AppArmor (complain) on all Linux hosts
2026-08-26 18:14:43 +08:00
Ryan Yin
b46bb471d8
test: fix security-firewall eval test to scalar per-host values
2026-08-26 18:14:43 +08:00
Ryan Yin
72a6e95cab
security: make firewall secure-by-default, disable explicitly on servers
...
Flip the base firewall default to ON so new hosts are protected by default. Servers keep the firewall off (trusted internal LAN, WAN protected at the router) via explicit overrides in modules/nixos/server/{server,server-aarch64}.nix. Behavior-preserving for all 18 current hosts; adds a security-firewall eval test guarding the per-host state.
2026-08-26 18:14:43 +08:00
Ryan Yin
3550c6af2a
feat(monitoring): collect homelab UPS metrics
2026-07-24 12:44:17 +08:00
Ryan Yin
0fe12bef5a
fix(nix): preserve default sandbox shell
...
Setting nix.settings.sandbox-paths replaces Nix compiled sandbox defaults. Keeping only /dev/net made local builds lose the sandbox shell that normally provides /bin/sh, which broke upstream scripts with /bin/sh shebangs in packages such as X11-fonts and openldap.
Use extra-sandbox-paths for /dev/net instead. This keeps Nix daemon defaults intact, including the configured sandbox shell, while still allowing builds that need /dev/net.
Add eval coverage for both Linux output sets so future changes keep /dev/net in extra-sandbox-paths and do not reintroduce an explicit sandbox-paths override.
2026-07-06 23:04:16 +08:00
Ryan Yin
8462d34ade
feat: NixOS tests using systemd-nspawn containers
2026-06-22 09:02:06 +08:00
Ryan Yin
400725b36c
chore: replace nixos-generators image outputs
2026-06-14 14:10:08 +08:00
Ryan Yin
8207ccbdff
refactor(home): consolidate host home modules under home/hosts
2026-03-23 12:38:55 +08:00
Ryan Yin
cf7b5a5be7
refactor(home): move host home-manager configs out of hosts
2026-03-23 10:57:09 +08:00
Ryan Yin
3dbc94c3de
feat: run ai agents on homelab ( #251 )
...
* feat: run ai agents on kana & ruby
* fix: upload vm
2026-03-17 10:31:18 +08:00
Ryan Yin
fb7a0cd178
feat: replace waybar/mako/anyrun/wlogout/swaylock with noctolia-shell, remove hyprland ( #240 )
2026-01-03 09:36:54 -06:00
Ryan Yin
29760ddb27
refactor: update niri, write config in kdl, remove niri-flake ( #237 )
...
• Updated input 'nixpkgs':
→ 'github:NixOS/nixpkgs/0254eab410b90ef2420c1059f908ae777e3b02f9?narHash=sha256-/US2Ei9JHXHVBAxV4FX49Q7H5s4UNBrIiOA6Xjzgq44%3D' (2025-12-06)
• Updated input 'home-manager':
'github:nix-community/home-manager/f4cb25928fafa9ae68660fe71f730fc820a59028?narHash=sha256-5xOuutXM7UPTUcn3uDAD8UlPQsXmqPrX81cXoDOAGcA%3D' (2025-11-26)
→ 'github:nix-community/home-manager/89c9508bbe9b40d36b3dc206c2483ef176f15173?narHash=sha256-rB45jv4uwC90vM9UZ70plfvY/2Kdygs%2BzlQ07dGQFk4%3D' (2025-12-17)
• Updated input 'nixpkgs-master':
'github:nixos/nixpkgs/6812bcfd614abedbdb3f68d7b6554eda6ca3e014?narHash=sha256-sNF/PZcuzYBHKRBkerEiPf5mkZM15A3fWD%2BlqpwKc60%3D' (2025-12-15)
→ 'github:nixos/nixpkgs/e50ab9bb181f9fb3ce00e7a6007c70ddaa007203?narHash=sha256-acPMRCAPgPykzkwATwD1EfF7xgmbraAvIJyCeR6bKxc%3D' (2025-12-18)
Signed-off-by: Ryan Yin <xiaoyin_c@qq.com >
2025-12-18 19:56:46 -06:00
Ryan Yin
070aeae8db
feat: gaming ( #223 )
...
* refactor: configure gaming suite via options, use pkgs-x64
* fix: gaming on apple silicon (not work yet)
2025-09-17 13:54:27 +08:00
Ryan Yin
ce4588d0c2
feat: niri - define configs via home-manager
2025-08-20 01:59:42 +08:00
Ryan Yin
69eee64e7e
feat: add new wayland compositor - niri
2025-08-20 00:03:25 +08:00
Ryan Yin
13bb77108c
feat: format via 'ls **/*.nix | each { |it| nixfmt $it.name }'
2025-07-30 12:17:24 +08:00
Ryan Yin
db82d2d8c5
feat: remove x86_64-darwin, add new nixos host on macbook pro m2
2025-07-12 23:30:52 +08:00
Ryan Yin
0c7e43a21b
feat: add sandboxed wechat ( #196 )
2025-07-12 16:49:45 +08:00
Ryan Yin
8690978d7e
feat: replace impermanence with preservation ( #198 )
...
* feat: replace impermanence with preservation
* fix: This module cannot be used with scripted initrd.
* fix: permission for /var/lib/private
* chore: boot.initrd.systemd.enable
* docs: boot.initrd.luks.devices.<name>.fallbackToPassword is implied by systemd stage 1
* fix: typo
2025-06-29 13:02:36 +08:00
Ryan Yin
4ec26c5e5f
refactor: fonts ( #194 )
2025-06-22 20:13:50 +08:00
Ryan Yin
cfdf12b356
fix: attribute 'nix-access-tokens' missing for homelab
2025-03-01 06:26:23 +08:00
Ryan Yin
46ed22565d
fix: kubevirt-shoryu - disable home-manager
2024-09-09 17:27:54 +08:00
Ryan Yin
df9ca7aefa
feat: hardening nixos desktops ( #160 )
...
* feat: hardening nixos desktops
* refactor: move hardening to the root folder
* feat: add nixpaks into nixpkgs via overlays
* feat: nixpak - add netease music
* docs: hardening
* fix: nvidia
* fix: disable apparmor & hardening profile to avoid neovim being killed
* fix: firefox cursor & fonts
2024-09-05 23:59:39 +08:00
Ryan Yin
a1789eebff
refactor: remove i3 ( #162 )
2024-09-03 00:06:34 +08:00
Ryan Yin
d853036fb1
feat: data-crypted
2024-08-17 02:26:39 +08:00
Ryan Yin
b671c05db9
feat: migrate services to aqua
2024-07-31 14:29:21 +08:00
Ryan Yin
f5f27bff96
feat: add home-manager for kubevirt-shoryu
2024-04-01 15:16:35 +08:00
Ryan Yin
c628eaa6c8
fix: run other k3s clusters as kubevirt quests, use the interface provided by kubevirt
2024-04-01 00:39:52 +08:00
Ryan Yin
7ef943a7b5
docs: hosts
2024-03-31 17:01:47 +08:00
Ryan Yin
d70eaa0b33
fix(tests): error: The option `fileSystems."/run/media/nixos_k3s".mountOptions' does not exist
2024-03-25 00:27:35 +08:00
Ryan Yin
55d0c4f87c
fix(outputs/x86-64_linux/tests): conflict filesystem definitions
2024-03-24 23:55:29 +08:00
Ryan Yin
7d577713bb
feat(outputs/*/tests): add kernel tests
2024-03-24 23:53:53 +08:00
Ryan Yin
2319300f48
feat: add a test k3s cluster running on kubevirt
2024-03-23 02:09:21 +08:00
Ryan Yin
84c21ccd34
refactor(vars,hosts): networking & k3s clusters
2024-03-23 01:52:32 +08:00
Ryan Yin
4d3a3750c1
feat: add develop environment for ruby
2024-03-14 00:33:38 +08:00
Ryan Yin
2b91d706b0
feat(WIP): add nixos tests - integration tests
2024-03-13 23:02:28 +08:00
Ryan Yin
6a9afbb9a2
fix: rename unitTests to evalTests
2024-03-13 21:48:09 +08:00
Ryan Yin
a79a64beaf
refactor: rename colmena-meta to colmenaMeta
2024-03-13 18:17:48 +08:00
Ryan Yin
fff6ad6bff
feat: unit tests
2024-03-13 16:44:41 +08:00
Ryan Yin
093866a2aa
refactor: home modules
2024-03-13 16:31:26 +08:00
Ryan Yin
5234fd7279
fix: typo
2024-03-13 16:04:19 +08:00
uy_sun
752c9070f4
fix: home-module typo
2024-03-13 13:22:39 +08:00
Ryan Yin
b382999a70
refactor: Use haumea for filesystem-based module system for flake outputs
...
refactor: Use hyphen(`-`) for variable names & folder names(except Python), replace all unserscore(`_`) with hyphen(`-`).
2024-03-10 20:12:02 +08:00
Ryan Yin