nix-config

0 Fork 0

mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-15 21:12:04 +01:00

Files

T

ryan4yin | 二花 6259359945 security(monitoring): bind exporters to static LAN addresses (#373 )

node_exporter listened on 0.0.0.0, so access control rested entirely on
the nftables allowlist. Bind node/smartctl exporters to the host static
LAN IPv4 (the same address VictoriaMetrics scrapes), keeping the socket
off tailscale/bridge interfaces even if the firewall regresses.

Hosts without a static LAN address (shoukei, akane) now run no exporters
at all instead of loopback-bound ones nobody scrapes; akane, a UTM VM,
previously ran a loopback smartctl exporter with no physical disks.

LAN-bound exporters also get the boot-race treatment from #372
(network-online ordering plus patient restart); loopback-bound hosts
must not pull in network-online because NM wait-online would stall
their offline boots.

2026-10-03 19:07:21 +08:00

networking

feat(security): add balanced kernel and exporter baseline (#365 )

2026-10-03 16:33:50 +08:00

btop.nix

feat(monitoring): GPU-aware btop variants and GPU metrics (#330 )

2026-09-30 00:16:50 +08:00

btrbk.nix

docs: refresh stale docs after the VM and backup refactors

2026-09-21 22:03:21 +08:00

core.nix

chore: power management