Ryan Yin a97400df69 fix(systemd): sandbox privileged hardware oneshots ...

Assisted-by: DeepSeek Harness (deepseek-flash)

2026-11-01 20:49:51 +08:00

..

btrbk

feat(btrbk): make snapshots explicit, guarded, and stored in @snapshots (#271)

2026-09-19 11:43:11 +08:00

colmena-parity

fix(colmena): deploy the systems nixosConfigurations evaluates

2026-10-21 20:59:07 +08:00

computer-use-headless

fix(desktop): tie ai's link DNS takeover to mihomo's lifecycle (#380)

2026-10-05 00:07:32 +08:00

cpu-power

fix(power): drop TuneD for native CPU scaling (#461)

2026-10-16 16:45:08 +08:00

home-manager

fix(k3s): drop Home Manager from test masters

2026-09-24 13:35:33 +08:00

home-manager-xdg

refactor: retire the aquamarine VM host

2026-09-21 15:45:02 +08:00

hostname

feat: replace waybar/mako/anyrun/wlogout/swaylock with noctolia-shell, remove hyprland (#240)

2026-01-03 09:36:54 -06:00

idols-ai-gpu

refactor(ai): return ai to the MSI MAG B760M MORTAR and the RTX 4090

2026-10-14 20:15:01 +08:00

idols-ai-net

fix(ai): match the wired NIC by prefix, not by name

2026-10-14 20:15:01 +08:00

idols-ai-voice-input

feat(vinput): drop NPU/OpenVINO support (#384)

2026-10-05 15:42:48 +08:00

idols-aquamarine

feat(aquamarine): track linuxPackages_latest (#478)

2026-10-20 23:12:37 +08:00

k3s-api-endpoint

docs(security): document homelab architecture and agent-first audits

2026-10-03 16:26:32 +08:00

k3s-node-home-manager

fix(k3s): drop Home Manager from the test workers (#432)

2026-10-11 19:48:14 +08:00

kernel

feat: format via 'ls **/*.nix | each { |it| nixfmt $it.name }'

2025-07-30 12:17:24 +08:00

microvm-guest-parity

fix(outputs): keep microvm-guest-parity from forcing guest config (#484)

2026-10-21 21:49:07 +08:00

nix-system-features

fix(nix): preserve default sandbox shell

2026-07-06 23:04:16 +08:00

nixpak-policy

refactor(nixpak): split policy checks into per-app suites (#493)

2026-11-01 10:05:15 +08:00

remote-builders

feat(builders): enable aquamarine on remaining physical hosts (#500)

2026-11-01 04:44:43 -06:00

security-apparmor

security: hardening pass 1 (AppArmor, firewall default, loopback metrics, k3s perms, SSH X11) (#266)

2026-08-27 00:13:01 +08:00

security-audit

feat(security): harden homelab SSH, services and audit trail

2026-10-31 01:09:15 +08:00

security-container-groups

security: scope privileges and stop a world-readable secret copy (#335)

2026-10-01 21:18:34 +08:00

security-exporters

fix(ai): bind the nvidia GPU exporter to the static LAN IPv4

2026-10-24 14:16:14 +08:00

security-firewall

feat(nixos): default-deny host inbound, trust the LAN/tailnet (#325)

2026-09-26 14:02:03 +08:00

security-k3s-kubeconfig

security: hardening pass 1 (AppArmor, firewall default, loopback metrics, k3s perms, SSH X11) (#266)

2026-08-27 00:13:01 +08:00

security-k3s-pod-firewall

fix(k3s): deny pod sources the etcd client port 2379

2026-10-24 14:16:14 +08:00

security-kernel

feat(security): add balanced kernel and exporter baseline (#365)

2026-10-03 16:33:50 +08:00

security-postgres-auth

fix(postgres,darwin): close the loopback superuser path and scope agenix ownership (#401)

2026-10-07 15:22:03 +08:00

security-service-hardening

fix(systemd): sandbox privileged hardware oneshots

2026-11-01 20:49:51 +08:00

security-ssh-auth

feat(security): harden homelab SSH, services and audit trail

2026-10-31 01:09:15 +08:00

security-ssh-x11

fix(security): tighten desktop remote access

2026-09-01 20:20:51 +08:00

ups-metrics

fix(hosts): move UPS/nut metrics to youko after the swap

2026-09-29 21:36:47 +08:00

youko-metrics

fix(colmena): expose colmenaHive for the nix-community evaluator (#361)

2026-10-03 12:14:13 +08:00

youko-nix-cache-proxy

feat(youko): add pull-through cache for two Nix upstreams (#499)

2026-11-01 18:27:43 +08:00

youko-tmpfiles

fix(youko): wait for data mounts before tmpfiles setup (#498)

2026-11-01 16:36:00 +08:00