starred/nix-config-ryan4yin
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-08-08 04:38:39 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity
2,236 Commits 5 Branches 35 Tags
58e056486d74f2d18d50603a2a6d88db79a8f2e1
Commit Graph
2236 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ryan Yin 58e056486d docs(agents): allow scoped secret authentication 2026-08-05 10:13:16 +08:00
Ryan Yin 6f837b8718 docs(agents): clarify cleanup safety boundaries 2026-08-05 10:06:04 +08:00
Ryan Yin c0f50a7d4a fix(bambu-studio): adjust HiDPI text scaling 2026-08-05 09:14:33 +08:00
Ryan Yin 6f100d94a9 feat(gh): persist user-managed configuration 2026-08-04 17:45:24 +08:00
Ryan Yin cce15300d6 feat(niri): reorganize workspaces 2026-08-03 22:42:37 +08:00
Ryan Yin 20dac3bb84 docs(zoom-us): screen capture mode 2026-08-01 10:28:01 +08:00
Ryan Yin 6264190c49 fix(idols-ai): reset camera after resume 2026-08-01 10:04:22 +08:00
Ryan Yin 7826934b23 fix(nixpak): allow document portal saves 2026-08-01 09:37:43 +08:00
Ryan Yin 3aadd65a36 fix(telegram): preserve Wayland app ID in nixpak 2026-07-31 17:35:31 +08:00
Ryan Yin 41512097e5 feat(grafana): add kubernetes service and storage dashboards 2026-07-31 17:34:52 +08:00
Ryan Yin 071212e40f feat(niri): reorganize workspace layout 2026-07-31 12:06:27 +08:00
Ryan Yin ac96c62cbe fix(niri): position Zoom toolbar at bottom 2026-07-31 11:07:07 +08:00
Ryan Yin e43ae1625c fix(niri): handle Zoom auxiliary windows 2026-07-31 11:01:38 +08:00
Ryan Yin 5c5bbe3210 docs: agents - add secres access policy 2026-07-28 18:28:12 +08:00
Ryan Yin 64ecc1cf66 fix(grafana): scope hwmon joins to selected node 2026-07-27 20:57:10 +08:00
Ryan Yin 095dc5dee8 feat(desktop): enable the firewall on desktop machines 
Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-26 22:26:01 +08:00
Ryan Yin 74598b6f6b chore(monitoring): stop scraping offline hosts, mute noisy alert levels 
- Add an offlineHosts list to VictoriaMetrics scrape generation: SBCs
  and the whole k3s-prod-1 cluster are powered off, shoukei's exporter
  is disabled on the machine; also comment out the dnsmasq-exporter
  job (runs on suzi).
- Disable node-exporter on shoukei: a laptop on untrusted networks
  should not expose :9100 (the firewall is off repo-wide).
- Route severity none|info alerts to the null receiver; meta alerts
  and info noise should never page.

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-26 22:19:56 +08:00
Ryan Yin ec208ab4d1 fix(monitoring): exclude shm from HostFilesystemDeviceError 
node-exporter always reports device_error=1 for containerd sandbox shm
bind mounts (tmpfs), producing ~50 bogus critical alerts on the
kubevirt hosts. Verified against live metrics that no non-shm device
errors exist, so nothing real is filtered out.

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-26 15:28:41 +08:00
Ryan Yin 21c6d9b7bc fix(monitoring): drop $vars from telegram template to survive envsubst 
The NixOS alertmanager module pipes the generated config through
envsubst to inject secrets, which silently replaced the template's
$i/$a variables with empty strings, so every telegram notification
failed with a template parse error since Friday's deploy.

Rewrite the template without variables: range + dot, define/template
for the per-alert block, and an if/else split to cap a group at 5
alerts (slice errors when fewer than 5). Verified with amtool template
render against post-envsubst content for both branches.

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-26 15:16:46 +08:00
Ryan Yin 8bb2adc436 feat(home): enable easyeffects for loudness normalization 
Fix inconsistent volume across bilibili videos at the PipeWire level:
the easyeffects daemon auto-starts at login; an autogain + limiter
chain can be applied per-app (e.g. only to the browser).

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-26 11:29:09 +08:00
Ryan Yin b6a7a8f49b feat(monitoring): restructure telegram alert template for readability 
- Show group-level labels (alertgroup/cluster/env/namespace) once in
  the header instead of repeating them per alert.
- Use each rule's summary annotation as the per-alert headline (it
  already carries the distinguishing resource name), falling back to
  the instance label; show nodename on its own line when present.
- Drop the noisy per-alert label dump and the always-N/A value line.

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-24 22:57:13 +08:00
Ryan Yin 35d41a4391 fix(monitoring): bound telegram message length and mute meta alerts 
- Trim the telegram template: drop the full label dump, render at
  most 5 alerts per group, and note how many were omitted, so
  messages stay within Telegram's 4096-char limit.
- Route severity=none meta alerts (Watchdog, InfoInhibitor) to a new
  null receiver so they no longer notify.

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-24 20:57:54 +08:00
Ryan Yin 149d8bc137 feat(monitoring): add UPS reference lines and alerts 
fix(grafana): clarify UPS voltage references

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-24 20:13:11 +08:00
Ryan Yin 8a0e1a648f feat(grafana): add UPS monitoring dashboard 2026-07-24 16:25:25 +08:00
Ryan Yin 83d919815b feat(deployment): add configurable NixOS deployment modes 2026-07-24 15:44:40 +08:00
Ryan Yin bae7e05a9a fix(aquamarine): remove insecure MinIO service 2026-07-24 15:07:49 +08:00
Ryan Yin f80580772a feat(blender): build 5.2 LTS with CUDA and OptiX 2026-07-24 14:34:25 +08:00
Ryan Yin 3550c6af2a feat(monitoring): collect homelab UPS metrics 2026-07-24 12:44:17 +08:00
Ryan Yin 45f15ec1a0 feat(darwin): add codex & claude desktop app 2026-07-24 10:28:18 +08:00
Ryan Yin 9ee947dc0a fix: clash-verge-rev ui by upgrade 2026-07-23 11:22:06 +08:00
Ryan Yin 56e0e4f0c6 flake.lock: Update 
Flake lock file updates:

• Updated input 'llm-agents':
    'github:numtide/llm-agents.nix/b384352cb2f0bfd8ec2ce984f87ec2ad0a293e2c?narHash=sha256-U02S4TzJ0OUyAF60dtzWaCtfKsjj0Vjywqt1aj9Fegc%3D' (2026-07-16)
  → 'github:numtide/llm-agents.nix/6c650f7597e3f212395e4fdba754bf6537cc2298?narHash=sha256-cS5Rv01brbs95/a5NrNCxKLqMZWkFnRRZXdmz2NZnQs%3D' (2026-07-22)
• Updated input 'llm-agents/nixpkgs':
    'github:NixOS/nixpkgs/35d3407a3816f3b341d8cf1d60abaf2b7b8166ac?narHash=sha256-BoYPdqk6jlKXy%2BDyUzyGV/CtRGfAhk2MmIgBhsemTGI%3D' (2026-07-15)
  → 'github:NixOS/nixpkgs/421eebfd0ec7bccd4abe826ce62d7e6e83129493?narHash=sha256-/FCliTPgiuV1owejZFNx3Ch9irdvkOfOFl%2BHHZ%2BDrtM%3D' (2026-07-20)
• Updated input 'llm-agents/treefmt-nix':
    'github:numtide/treefmt-nix/db947814a175b7ca6ded66e21383d938df01c227?narHash=sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM%3D' (2026-05-31)
  → 'github:numtide/treefmt-nix/df3c0640565d04a0261253cdd89fce78ec50168a?narHash=sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0%3D' (2026-07-18)
 2026-07-22 22:00:00 +08:00
Ryan Yin 2506b88080 flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/a55048a53c27e59309d0c641d8acd72b5651920e?narHash=sha256-cw4ccmTWfdhNd6ATsgXgXsJEDhAY615qJCYgomchX60%3D' (2026-07-10)
  → 'github:nixos/nixpkgs/a3eff1e98209f4c27139b231521a886df64fcaab?narHash=sha256-3ZsD71dKOmllzulAwsWXUgnzQzUZt8n91kDPTKxKebY%3D' (2026-07-22)
 2026-07-22 09:38:12 +08:00
Ryan Yin b1e2bb7e09 docs: agents - add kimi-code 2026-07-17 11:15:09 +08:00
Ryan Yin dda800f65d chore: preserve kimi-code data 2026-07-17 10:45:55 +08:00
Ryan Yin c2ce266511 flake.lock: Update 
Flake lock file updates:

• Updated input 'llm-agents':
    'github:numtide/llm-agents.nix/d17493b6a6d08cc1846a17175df67cd603c80c7d?narHash=sha256-M30foxi%2B2JXQ8KEIeWIKpB2uVpDYOw0XGI/gOaTb38I%3D' (2026-07-10)
  → 'github:numtide/llm-agents.nix/b384352cb2f0bfd8ec2ce984f87ec2ad0a293e2c?narHash=sha256-U02S4TzJ0OUyAF60dtzWaCtfKsjj0Vjywqt1aj9Fegc%3D' (2026-07-16)
• Removed input 'llm-agents/blueprint'
• Removed input 'llm-agents/blueprint/nixpkgs'
• Removed input 'llm-agents/blueprint/systems'
• Updated input 'llm-agents/nixpkgs':
    'github:NixOS/nixpkgs/f205b5574fd0cb7da5b702a2da51507b7f4fdd1b?narHash=sha256-/NAkDSsve%2BGNM0Bt6tleJdCGfsTlK89nPjkVOzZMo0s%3D' (2026-07-05)
  → 'github:NixOS/nixpkgs/35d3407a3816f3b341d8cf1d60abaf2b7b8166ac?narHash=sha256-BoYPdqk6jlKXy%2BDyUzyGV/CtRGfAhk2MmIgBhsemTGI%3D' (2026-07-15)
 2026-07-17 10:40:13 +08:00
Ryan Yin ac7755e5ee chore: add kimi-code 2026-07-17 10:39:53 +08:00
Ryan Yin c44aa91e96 chore: preserve bambu studio's data 2026-07-10 13:07:05 +08:00
Ryan Yin 2868b72019 fix(home): move nix.package fallback to darwin module 2026-07-10 12:54:25 +08:00
Ryan Yin 0bba489dbc flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/173d0ad7a974f8543a9ab01d2271b2e290341b33?narHash=sha256-ORvqDbb/LYxiJljGIejapjkc/kJbVote2N1WSb9W45I%3D' (2026-06-12)
  → 'github:nixos/nixpkgs/a55048a53c27e59309d0c641d8acd72b5651920e?narHash=sha256-cw4ccmTWfdhNd6ATsgXgXsJEDhAY615qJCYgomchX60%3D' (2026-07-10)
 2026-07-10 12:48:54 +08:00
Ryan Yin e22af008bf chore: upgrade slicer app 2026-07-10 12:40:12 +08:00
Ryan Yin 831c64407b flake.lock: Update 
Flake lock file updates:

• Updated input 'llm-agents':
    'github:numtide/llm-agents.nix/76948750034d89409ac9224173f52ffc05afe946?narHash=sha256-X1xqgUNcYI/UWxDW8W1DC7OEMOjOhTtwWc8v%2BMGMasY%3D' (2026-06-29)
  → 'github:numtide/llm-agents.nix/d17493b6a6d08cc1846a17175df67cd603c80c7d?narHash=sha256-M30foxi%2B2JXQ8KEIeWIKpB2uVpDYOw0XGI/gOaTb38I%3D' (2026-07-10)
• Updated input 'llm-agents/bun2nix':
    'github:nix-community/bun2nix/f2bc12af1a6369648aac41041ceeaa0b866599c6?narHash=sha256-oQvcadh2BCkrog%2BSGrG6YffKJrveYpjj3TdQJWaKhaM%3D' (2026-05-10)
  → 'github:nix-community/bun2nix/5a39d717029e94163ac223aee8d5c9946cafed1c?narHash=sha256-s9BuFv0mRuZx9C1MF8qPHRdcAK14ONi0A5m6E2wqOoM%3D' (2026-06-29)
• Updated input 'llm-agents/flake-parts':
    'github:hercules-ci/flake-parts/f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb?narHash=sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4%3D' (2026-05-13)
  → 'github:hercules-ci/flake-parts/17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e?narHash=sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w%2B6NWK9yA%3D' (2026-07-01)
• Updated input 'llm-agents/nixpkgs':
    'github:NixOS/nixpkgs/89570f24e97e614aa34aa9ab1c927b6578a43775?narHash=sha256-EMzXKmnOtBQ2MnvpiNOm7E%2BkOMvdPrIKaeg52Tip2Uk%3D' (2026-06-23)
  → 'github:NixOS/nixpkgs/f205b5574fd0cb7da5b702a2da51507b7f4fdd1b?narHash=sha256-/NAkDSsve%2BGNM0Bt6tleJdCGfsTlK89nPjkVOzZMo0s%3D' (2026-07-05)
 2026-07-10 12:40:12 +08:00
Ryan Yin ab7136e58e flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/173d0ad7a974f8543a9ab01d2271b2e290341b33?narHash=sha256-ORvqDbb/LYxiJljGIejapjkc/kJbVote2N1WSb9W45I%3D' (2026-06-12)
  → 'github:nixos/nixpkgs/a55048a53c27e59309d0c641d8acd72b5651920e?narHash=sha256-cw4ccmTWfdhNd6ATsgXgXsJEDhAY615qJCYgomchX60%3D' (2026-07-10)
 2026-07-10 12:40:12 +08:00
Ryan Yin 9315055bac fix(darwin): unblock home-manager activation 2026-07-10 12:28:47 +08:00
Ryan Yin 6c84c9e85b feat: add bambu studio 2026-07-10 10:04:18 +08:00
Ryan Yin ca6d584684 fix(nixos): accept flake config during switch 2026-07-09 17:02:28 +08:00
Ryan Yin d5822550b4 fix(catppuccin): use cache for themed ports 2026-07-09 17:02:28 +08:00
Ryan Yin 8d8cdab300 chore: symlink CLAUDE.md 2026-07-08 10:51:45 +08:00
Ryan Yin 410b3c5312 chore: remove useless comments 2026-07-06 23:04:16 +08:00
Ryan Yin f0126c69d0 flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/3d46470bb3030020f7e1361f33514854f5bfa86d?narHash=sha256-PkBPmP5ofNtunCU7/tfn6wi9OLlzFGcHAqqmY%2B/mwUI%3D' (2026-06-27)
  → 'github:NixOS/nixpkgs/d407951447dcd00442e97087bf374aad70c04cea?narHash=sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU%2BK27sk%3D' (2026-07-05)
 2026-07-06 23:04:16 +08:00
Ryan Yin 0fe12bef5a fix(nix): preserve default sandbox shell 
Setting nix.settings.sandbox-paths replaces Nix compiled sandbox defaults. Keeping only /dev/net made local builds lose the sandbox shell that normally provides /bin/sh, which broke upstream scripts with /bin/sh shebangs in packages such as X11-fonts and openldap.

Use extra-sandbox-paths for /dev/net instead. This keeps Nix daemon defaults intact, including the configured sandbox shell, while still allowing builds that need /dev/net.

Add eval coverage for both Linux output sets so future changes keep /dev/net in extra-sandbox-paths and do not reintroduce an explicit sandbox-paths override.
 2026-07-06 23:04:16 +08:00