From e3f7d18d8e1a67625c4436e4243386212b4fac98 Mon Sep 17 00:00:00 2001 From: Robert Date: Thu, 11 Jun 2026 15:02:16 -0400 Subject: [PATCH 1/9] Added paperclip and honcho secrets --- secrets/containers.env.age | 74 ++++++++++++++++++++------------------ 1 file changed, 40 insertions(+), 34 deletions(-) diff --git a/secrets/containers.env.age b/secrets/containers.env.age index 90b91ed..140b93f 100644 --- a/secrets/containers.env.age +++ b/secrets/containers.env.age @@ -1,36 +1,42 @@ -----BEGIN AGE ENCRYPTED FILE----- -YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBWNEpt -cGFNeVBBaDRqb3pLSEZGQW0wb3VmVnBoZCswUFkzbnBLUnJ0QTNrClRqVkk4RUVO -d29KYjd5YUcwankvaTFmVHUxQVpDT2ZYWHRaY3JXTUtQMU0KLT4gKXBtQ3UsXi1n -cmVhc2UgNnwxYCBXVyA/KCQmIHt9NAo3OTZVUHR2UXkvaEFwY0ZBdEJsaFpsbHJ0 -cklKcDVHcEdWMEdPSkpnN0FiRU43RW5hUWFMdjR3WFRRSFBLSGlmClM3cTNJWlNM -TExkdHdXUHJISkNIaE1TTUxUc1NUWkV1a09HeFU3bVZwQXMKLS0tIGhOcXFTUElS -azJJNnEreUhMWTJBaVZGSTJPRUFqQkVYS01KRENUVVpZSDgK8+8onFejroBo7MeO -dW+so4lOsq4zJKn3f0cxmCFg1f0X8zt6h4Uc3A5Cvr1uU+6yw1FWmJ7xa3jJz3lO -EEaKQJXYC+xIIKGcA7qILa0SFp4a/4OuYjcg27HrlPhg7u5wDhQrd0LdVEe1Xngp -ZivX7P7HwIna3X8C+TL+K2v/AG2N/z86cdKfRvxyMKNbHhYw+CfHEnWgh8tJ++4h -G9evNniuNqte6cQaRe7jODfPNW4FuY/Sb7barlJ/M9iAQdYAdyLAzU1LABeHeUfD -wtHjxy9DUZ55Vg8bB8M2JJU9MkoRT4ewiVd9LeC1GWeVmKsm93wsmrov714i7U2j -wHtDkjqEF2MmzuQc18sjNaAHiwz8j6o5xU2L/Q4+Q707yISWG7RGZYh389Cr1rnw -siUq/Vunqw2wk13+J/4vu9nqt5mMktBaCtp+QiWIurjwB5LUAyChrSm+dg5lb0Mt -UhSc0lq1+E3vxAXM2Hmk+vP86VD+6WJvAU82VFApF1s6zG2FU1/AcOVVf54nan/q -f+rgSFfASHQCYSblUJHyEtwLNsWEmTGmOEn1buUKD/H0zatPQnc0rYpjlx2V0Sjd -6yB5+wPrZ0AkN1pjcsPKOv8Kaog2DzqIjib+SaSTaRxWHQEb9uzvaReAcYI5HOpE -gkC040HN33BItATbo4+hz70Im8Ni/VXD+g6yzM6Hj1hJL+PinTKeg5keQRFIZjMx -grzievB2wVBBgLgN3qMdTFmpplaL7iL702JjXZUTTK9Izp+9wiCsV1fTa53FWDht -ylFL5SWElqXjK+QBXxAe+Jk6VQov5HI21YDXL67S554ABeRok23wxrQ31TCI4xq9 -PQV7VtNRjyVud7S29m3OwpWOsgTZhn+JclHj2v4bNJzJkJnZRTmcvGPktzRI5+R4 -e5vxVhGnJDzI71txaHl8+xS1lu9VzCQUrxX6TXyTRV4KjIOz0g06JOBgmBRBvJca -7MZbC65xpisl/gyLRbgkVga3t94dPV+dpZsn8eq6427IyRbKslJefatggR9//c6I -5N5fl0fR3gJQMB+HRbipBH2YsdbdWJyb4Nn6STZxIfrqoG/xC6C1raF0xK7hUx6i -4DUDSPohM8fOIswQPfE+FH3eygfzu/Ln5+ghsgHTEhgFvmgMvyxaAt6kHIzIUhMX -M3dASr4VPDpIXuXsRWwYLEifhzxsuvwVxfwtsnCaR6XKijsYECWGDdYOWHdleeqx -wDPhxEesfFVhKxhrKY9Ir8k9/FFBKQU/3GjW4+SMAg5Al1YEzxshP9vKuVcsei7W -JDwAwotNXaCm6NBckiyZJE53ou6+gckPY7V9cOfnuH74Z9ywkFzB3HW3ZlonaGyM -oGmLGcccavFtyhg5s/As4i6X8ARIpDiwe59Pn3GNXMctySqIrrr2ogUoXgrfFCie -6GOTdeMW7GeOSdJUxCofghlspS/nq01Og77VI/beWYrIwLubSka6Zaltww9zgObk -/FGEMgFkEpq7iyCvYSPA8F46pJKvnMP3S84AWCPmcTcHeg4lwGPvs6btexXBGdoz -nkCyq7wdH5Nngm7jUbl88LtaLZPAQkuqXphBVTnrF9Ofbnb4iRZ2Op4xpx9rGyvx -mO6UEhL6V1i2YZFNkNMg/W8aoMiUgBdqbkxaxblT9L0aNdlFU9+LbWYolURVEadd -Qjv0Z1gMA+tsuBbVszwsMfneZ5+B9Q== +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBhT2N1 +ZkN0TXUyQStDM21mS2RKdVpkdzJBZUtzYXZCdXpHbmdxcjQ3bVM4CkRXT0o3SUxn +citoamZvN1FCdjRIelBjK0FmVGVaWEU1UGF5RnRYbjlmc2MKLT4gY0ljOz0tZ3Jl +YXNlIFBDZEcgZyBZL0B+NCcrIGVUZktYClovYUx0WmZMdFFNRHNSaXFtdFFsNW13 +cU81WnBuZk42WlMrRkdQMHhUd2d2SzFHYkFRU1YyS3hWVHpYSzRrTm8KVHlCZ2Jp +YXJIV2daREo5NTFlczlQWE5EdkNKWjBBbUl6Mm1BbUtPM3VaeEMyRGpYWFlselh4 +YVpDV3MKLS0tIFd5dnBRNnhDUXo0aTNXR01zQVpvcWU2YlFwWkpnQlBJblpDZlRl +STZRT3cKp/XOxSw22xKAqGarUpJ5ITzQu627cXSJv6kd8AVH6F3ogD35vJjyba3f +3e3H6d+qgHDBPi0fkrhs4dOCavvutzgJ1atlPAeC1MmPOKypnG/WRnYfNAQphBTj +QlBjZQEf6g1l9WY4GVSbVaBYSFhL2xndXFv8O5g0AwehkuLlh0cmbQ6IXuRhmjKy +0a99hOwBUWxj7pTWILf+kONIQpOc1xs4OE0LcWAHjXyQabZSHCEwIomjHmAW/Eyz +JKOj1YYcOFXtigmAlzfNJKM4oG3fvWy578Mu0DfgJ9JoRMwb5oaC0AZbwQtetkMD +kF6rQfXnjDcu2PbaSckGVociC19CqfK3KmZEGgPdf3LNU17pzgxab7gywzVUhxBv +u1UnB66+utxiE1Id/hLWDNqK6W0QI1hsA4XHrZ32wOl/DzL9B3rs+mMgrvaitPFX +ixx3U7IwHNs31X7iMmtgEJiaV16C8N5kQ6/8ACdOoY71GdyAFJOl3mf5rxkbhZTf +EF3LbCQpKVrrkR1HPEVzzH2cCD4HwBsJwGv2JiKh9JTzA6R8xojmNzMhQqoXiD3+ +OT98yOxl/czQ9PZWUTtnco9CYYAU4VPLTvytqqpDfQlC7X1thykyAl5tdE86ys6U +KsYT19cVP8FoDyowrq82H3CuvMt5an8u1gtq7BHksjqd7tgV/ntwvcc+xiWJkUn1 +m7hZXtD8sC3XiNlTuF9HYJqele9ucYFbkxBo9PfPWCdhgIwC+ZdoKbk2C/EGRMFg +HE4wfLQktOgfex+RE1Q94aMtn7eWkNH3C0+q1m5Mb7Zxx6hrOJ7M+7EKT0gDpqcB +3mawSXPndzs8tCFeW838sfjhJzeMU6qFQdx0wem+UKgdXjdajWrMaPA8jlbhioUl +hjwR6hkdd91P4cwpfj7E9gjAC0rPmypCWh9ZvpuLhlpsGDiWMz5duJxNUbzql29f +8B05k37HIkCWB3GCDYDxCd8KAL3SBwXQlwn/jCo23oUQtz2c4vPj3FdziGNSTpQC +4qcQCORReE+E6bwEdctALxDiotZue/DqMLzIY6zf2ZPaJ/eFR9oQghKLero15lV+ +97C18Lv6grXJ0wMFI5wmx+p1BNNdB/IV8dn0p8dofiOqn5xppFcXTnPi32In5oxi +hKpYVYC0wfPdtHBewMhF7jC89n90TqKHTij5Jz2ongH26lJnIc2K5a5PqaOAVdA4 +RLHs8a/JWHf1Fe3SmvnGNthAmyF7o/8DFQj5qQYhwAtHETds+73bLAEOcfmH4103 +OSQ+BZ7eFw7AU7P32+tBP9xKgIo3qaNaOopt/OiAU9HuzkbwDHic409pwiGzofwD +943rvA8k6L50JiM5708UlE89jg4VaG43J9QJZa+mji/s4JX1Gdkn9HieUM4bf+/o +ZIF71CQxmzJ/oHurHOVanwvCGf73Je/zQCBoE4niO66ke0YuyiRnUBcahF/xXklu +Nl/2/Xzkms23aRq+mPmo39jy5D+44W3EPWakvN51ZQgXWLKLUiATca8XEoNYg8vM +hgskVaVLXSMUwC8rF9v3ZDVC1QZRGD7TwTt4Tam4jdiZ1vIlkAVsqEIdfGZLOGFX +yctLx3HiT5ASATvttXlQ1FbU4HI2VUeSWsl37glKm/CoExLzvWgLzA1APUerEP9F +JFZmVQvxAufShmrGZTFDSfA6d/4gnfW4SYROgIIsbxWI8yOnAYXfs8tjBtrwNGt0 +dtny2T9X/PFLOyjH6aCz6ONJ8+MII9LaOjZ2OcEKMrQVfjkWa4Cv7b6WoXkdaqBk +Bk8XPlBBhny1RfXIkkR+OmggIcq1Xat1JjG/TdpC4dfIUg2Lt2m+tlGn8Ir2wNMa +Xrz/IfgU/NY3d7IoiVxSpkbq60H9flYdrzuOd29abno6B0Hg68GfNJrQEPt4E8Pu +bo14knYrfSgi2gG8hUlT5m4uz2MFJo2RSu2hC+ZlbPMgrrPDUfnq6vIftH/2HRkE +1DxUAfxzxT02nhsaKrthoFtB8JZEN+rIL1a5lqYgePFQZZtRf6nRknYPdgKPTXjI +hNJgx1zP2mgSLSCjr8oS9PIKpPDo0bo= -----END AGE ENCRYPTED FILE----- From ab7da926262146edfc908f4356fc2cf83568bc4b Mon Sep 17 00:00:00 2001 From: Robert Date: Thu, 11 Jun 2026 15:27:08 -0400 Subject: [PATCH 2/9] Added tmux, removed opencode, openclaw node --- hosts/lazyworkhorse/configuration.nix | 17 +---------------- 1 file changed, 1 insertion(+), 16 deletions(-) diff --git a/hosts/lazyworkhorse/configuration.nix b/hosts/lazyworkhorse/configuration.nix index 6f02a2b..91dc793 100644 --- a/hosts/lazyworkhorse/configuration.nix +++ b/hosts/lazyworkhorse/configuration.nix @@ -144,6 +144,7 @@ # You can use https://Search.nixos.org/ to find more packages (and options). environment.systemPackages = with pkgs; [ neovim + tmux docker-compose wget age @@ -256,12 +257,6 @@ # }; }; - services.opencode = { - enable = true; - port = 4099; - ollamaUrl = "http://127.0.0.1:11434/v1"; - }; - # Private host ssh key managed by agenix age = { identityPaths = paths.identities; @@ -311,16 +306,6 @@ }; }; - # OpenClaw Node service (host-side execution for Docker gateway) - services.openclaw-node = { - enable = true; - user = "ai-worker"; - gatewayHost = "127.0.0.1"; - gatewayPort = 18789; - gatewayTokenFile = "/run/secrets/openclaw_gateway_token"; - displayName = "lazyworkhorse-host"; - }; - # Public host ssh key (kept in sync with the private one) environment.etc."ssh/ssh_host_ed25519_key.pub".text = "${keys.hosts.lazyworkhorse.main}"; From 78ab440727efe977681cd849ef7351ba4afe11de Mon Sep 17 00:00:00 2001 From: Robert Date: Mon, 15 Jun 2026 13:12:39 -0400 Subject: [PATCH 3/9] Split container secret in preparation to switching seperated env --- secrets/ai.age | 19 +++++++++++++++++++ secrets/cloudstorage.age | 10 ++++++++++ secrets/homeautomation.age | 19 +++++++++++++++++++ secrets/network.age | 12 ++++++++++++ secrets/secrets.nix | 4 ++++ secrets/tak.age | 12 ++++++++++++ 6 files changed, 76 insertions(+) create mode 100644 secrets/ai.age create mode 100644 secrets/cloudstorage.age create mode 100644 secrets/homeautomation.age create mode 100644 secrets/network.age create mode 100644 secrets/tak.age diff --git a/secrets/ai.age b/secrets/ai.age new file mode 100644 index 0000000..5d4e687 --- /dev/null +++ b/secrets/ai.age @@ -0,0 +1,19 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSA2QUFR +RmlnY2pYUFBHZGN3dzNpNVc0UW14V2NaVWZHWDJmcU1iWStsSHpJCnRYQUtEalNt +SzFYWUF6VWRyYWF5VCtsSGduRU96MHA0WlI0b0lpUGFram8KLT4gM0stZ3JlYXNl +IC5DPExhJQpCMlZRR0E1NGdsYlhNRXZUTVJqTTNHZUZQVUJoYkhheWd3TktvVEFp +WnFqbS9xWUxJSmI0U0hqQkdzQU1EVy9BCkhWc3A0Mk45YVBxcnJFWU5qa01LRTVw +WlNoWm40cjgyb1RXS3hGdlpRSEs5V0x0cHNvcVBOek0KLS0tIFhiOFExNnRSbEgz +M3FmS1owQUdHSXpiWVhLQ0R6emtuK2hZSkkrSTFtTTAKi2hXxTslGLlneDJlvHUm +OFsvgsHmiADRaiwDC/iCfWyEFzHyupXKX79B6rjt4Up2yUWHLHy4pyCvJiezAh1J +uxvtVmUYrqYOUoUHCEMLjjVydh5tt+22yXezV0ecU2ePiAgb0gv9EwH8t+70An6Z +fgvtZZqJ1hK6dTyTf4oROUjPD8RgfjDnRTTvTM1COMvwgpK+cboYAvJ4BhUsn70V +B3Gveg7++1U2ECF8YHKZGfSuWn0ajT5RzdgRXTveGAINiW4G98oyXnOVhRHmXo9i +8T/41afy4xhUbNCRsaAApFjS6y8xrpGtrOcpw0u3y3T/bjYHq8VDi4ttYWIF8hJD +HPo44+SDj0g9lr/UPQDWXaiZjdD6xdioUqnHnaAdyOPPf5D6C5I7WIQPPIjnJ1yc +PmQkIV4rtb+e7cWrGbnd9stCBZ2F+HcORfjgnJzKI5asy9rmdWPIIHkcZoPFZ/K8 +2ZWXUVgAZvwzcFxSjh5uXKvkOgYixdVLRfa88+KM++vwz0y3O5naq3d1SaLxV4dk +mRifLNhF9y2MKjX0bZ86Wm74NlhGGQSnUuUHpPLSA6McVOfleN/yJ9gMsosxUc9U +xIsKHYn8gN0lPVtyTSBTomK6kxoKJXxia50x/XAhJwI9X3ydLg== +-----END AGE ENCRYPTED FILE----- diff --git a/secrets/cloudstorage.age b/secrets/cloudstorage.age new file mode 100644 index 0000000..bd73efb --- /dev/null +++ b/secrets/cloudstorage.age @@ -0,0 +1,10 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBaT3h1 +K28zWlE3N3BMdHRFaldkZ0F2YVZjT3kxK2dpV1RxZUVOSElsbkdJCnF2M1ZkUWky +cGtPaXdzMmU1cllsWWtQK3R4Z0xhUExxSW9xUVh3eUo5RjQKLT4geHEtZ3JlYXNl +IEQ5JWBWM0QKS1N5WlpnbEtLTFNxQVFvbkVEa1BOTDhQRDV0SDhsdWFEdE5xMDRa +b3loMDZEeGZTZ1NzaFM5UlZYT0NjMHVvWAordjh4cFhnb2pOc3JPZlFLbFU0eC9O +WWFFVlUKLS0tIEJnMm9LM09KQ3VXNXpNNU1kS3V5VDNOTGozdDdGdWQxcFc3Mk5j +R0p0WVkKIX6p7MGDZOxS5qVgYs5K5sKC31IPIEMaWAqA5Gygegj5rVnKtN/jn7+9 +L5CBbzaSXzNwRce0WPVi0mQp56lL12mRlXXamOx/E9Q+r2rznFYdQA== +-----END AGE ENCRYPTED FILE----- diff --git a/secrets/homeautomation.age b/secrets/homeautomation.age new file mode 100644 index 0000000..21de798 --- /dev/null +++ b/secrets/homeautomation.age @@ -0,0 +1,19 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBOSk9J +RDF0bk4zNmdWRXhFTU1xUlVKeDJkTU51UDRiNjcvWlVKT3cxNzBvCk00ZEtMdlI2 +L2xiS3BnT1g0aEd3VmgydCtSVERrTjNraHNmSHZicENLODAKLT4gI0crX0A0Zmst +Z3JlYXNlIE8wNCBfPz5uSy4KSGxzcnJlM1FRamI0VWlZbTJvRnRuanlwSjN0eisy +bnlHSDZZbHpIbGNZUngvS1Fqb2dzd1p6UjZKZGowOUhONgoKLS0tIE1NMUV3QlpV +dEFXMUVOTFBGSlpVSjFzRlpjVTk2dkx1VURUaFl3R014a2cKTnWIRQg4txvZZ4A5 +XdwnXZqmYzOX7l2UrjmP/TJA++EURZzYtTS+q3FV9QTIj+7k0DOLf9nKq7XHlGM8 +Ptkaf/s1Ly7ke+v9l9C2uf9oNI6b+m3d7QqZC5WWvRXWvl9ImaJ3xVi9AM5f5NWH +Likn6GZDir4ihAec8pAi3H2SCCjkhqF/TlLe99tp+7AAUiOjNuNlej1OUOmJNxEr +GnHePwZZqa6/F9YnYQ0tKKRsZH5whxUPYUwhHSuWa/NidBK7lqKqdaPBevfdqWLg +59gkaL9BeGG5FUXg1cPEWAvOQ5Ajae/kVH6aRi5LXJPZfA/DetWgm9mmxJ2qPpFD +/n/JCsQUOnpk66j38bWMW5uok51s61oG1OZWGpPYstoLtivKOlVpG7xgioGqIIuc +c2ZsKK/iCauwX3sGQtpX9DbILrtOnzxU2B/dclcXe2EDfSJH0u2RrefxcqPG87pI +BAosRdq7GUUISSCTccaswwG555a7/Z5gzXOwXeQYNlK1HRnkF9oBsKTUoAI2b+VO +Hdv1uw9u5JLcZt+5qSB6AxJuk8yDF0KXIqkaCiwl2fV3bBkehPru7oCJFTtVMFVZ +u0A0h+n8KJCvyRKe/Tl+lT+JHM6Mk7SkFrmsaepZPnAtfLht+bP6b0oHrUsVx/iI +r7o= +-----END AGE ENCRYPTED FILE----- diff --git a/secrets/network.age b/secrets/network.age new file mode 100644 index 0000000..e4bb1ce --- /dev/null +++ b/secrets/network.age @@ -0,0 +1,12 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBVMEhO +RWdybFg4VWJaMjRWYm1ac2pzZ3R5aFZEM1o4dUtFZ0M4QnVKRzIwCnNGRFRjb01X +QU5mQTRSb21MV3lMMERIMGI1RHFQVFFZNlVlMnk4aTdna1kKLT4gM24xLWdyZWFz +ZSA/bVhubQplcXNVN3kxOEpqY2hUbkV3MG5PNVJtRGhORVVLdFVCRnFFVjRneEFI +VWFyZTRNS280RXlnckJpdFR4V1NBSTUzCjlxZkZ3UllpZXUwczR0T3JGRzUzMEhV +U1hobC84eWtEWWZOYyt6M2c3OUZIUTlKTm41dVp5UEZVSmVwWHBmR00KCi0tLSBF +ZnJ5QzN2VXpsY3JQQ3lmbklxcldydm1MSlFlejJ2S3hVVUtka0hTM044CvqhtnFn +pZsgP6w5uKh9CtVQpcyST8hA9P24e1opfu1JN3m/8g9XiJrMT5qVYtUXkV+pr4s6 +pVGsp9KScaS0T8TpLxvZoUAAdvVtdHh6GSbbszR6gZbStbWXmb6THYKHOghpK9HD +cDEoRmzcmFdwi3m26Xppmi2R6NmeKI4S6pbY95bfh2E6jn+7 +-----END AGE ENCRYPTED FILE----- diff --git a/secrets/secrets.nix b/secrets/secrets.nix index d5c44d6..c91d02d 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -11,4 +11,8 @@ in "lazyworkhorse_host_ssh_key.age".publicKeys = authorizedKeys; "n8n_ssh_key.age".publicKeys = authorizedKeys; "openclaw_gateway_token.age".publicKeys = authorizedKeys; + "ai.age".publicKeys = authorizedKeys; + "cloudstorege.age".publicKeys = authorizedKeys; + "homeautomation.age".age".publicKeys = authorizedKeys; + "network.age".age".publicKeys = authorizedKeys; } diff --git a/secrets/tak.age b/secrets/tak.age new file mode 100644 index 0000000..560a5df --- /dev/null +++ b/secrets/tak.age @@ -0,0 +1,12 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBsYXVu +Sk5CSjNsbHBRZkNXUGZVeGNva3FKMUdHV0RiQzJLNHVvSHZzd0dRClNnbzZvUFFR +Ty96OXZ4R2lCMHpnclpVaEZ1TEYvb0tTSVRwdWV1amdIL0UKLT4gYTtvOmAtZ3Jl +YXNlICk5WkE7USUgSyRLCjBmTWRTdEJJV2lNbVRlL3VidmZza1NTTWhIcG1vVFY5 +OUUxcG4ycTMraUUKLS0tIEVlaUdlcUFPMkZSMUpJVEFzTksrVC9lZGlMNEJ1SFBv +SFNtc0wwQ05nQ0EKYlRGYGeKlfW0lTPdpCtcTfh2NWUuyZnDFe6VAWLYL3PW42od +a+bhlgxTi9KF5FLjVA3IIdQSsKiMya+PI0VfOLWkA24ZN+4uilsQkicxnnRR1z8o +hv9G8N3eYqBsLylg8rW2Xkn4RzT/S5TyJZPFG4HsUYWtHS+iomg4HbQrgIrpIde9 +Th3V8WQB1HfKs9ilg8Q/DvDckFjevWYz2OXMYx4ZHWS53huQfE/oWPZfQid6Dd06 +NXcvCHPVDUszhWvcoOsSpK6vaOnuY1B32/qExw== +-----END AGE ENCRYPTED FILE----- From 1c806e6390ecb1d7838673d7ab5eadf5f6eab6bd Mon Sep 17 00:00:00 2001 From: Robert Date: Mon, 15 Jun 2026 13:15:12 -0400 Subject: [PATCH 4/9] Updated the compose pin --- assets/compose | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/assets/compose b/assets/compose index d3f2e3b..e525145 160000 --- a/assets/compose +++ b/assets/compose @@ -1 +1 @@ -Subproject commit d3f2e3b7b9dcb03b0bd7df0278faca6b64ea9272 +Subproject commit e52514505721c0cdd3eaf64e5fa70a4df9a39a46 From 2b1df578acb3b0ee427177d2b17dccc41daf5126 Mon Sep 17 00:00:00 2001 From: Robert Date: Mon, 15 Jun 2026 13:16:58 -0400 Subject: [PATCH 5/9] Deleted wrongly created file... --- assets/ollama/Dockerfile | 106 --------------------------------------- 1 file changed, 106 deletions(-) delete mode 100644 assets/ollama/Dockerfile diff --git a/assets/ollama/Dockerfile b/assets/ollama/Dockerfile deleted file mode 100644 index 438e607..0000000 --- a/assets/ollama/Dockerfile +++ /dev/null @@ -1,106 +0,0 @@ -# ollama-gfx906/Dockerfile -# -# Custom ollama image with ROCm 6.1 + gfx906 (MI50) support. -# The official ollama/rocm image ships ROCm 7.2 which dropped gfx906. -# This uses v0.23.2's native CMake build system with AMDGPU_TARGETS including gfx906. -# -# Build: docker build -t ollama/ollama:rocm-gfx906 ai/ollama - -FROM rocm/dev-ubuntu-22.04:6.1.2-complete AS builder - -# Build dependencies (CMake, Ninja, Go) -ARG CMAKEVERSION=3.31.2 -ARG NINJAVERSION=1.12.1 -ARG GOLANG_VERSION=1.22.0 - -RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \ - curl git ccache build-essential pkg-config unzip \ - && rm -rf /var/lib/apt/lists/* - -# Install CMake from official binaries -RUN curl -fsSL https://github.com/Kitware/CMake/releases/download/v${CMAKEVERSION}/cmake-${CMAKEVERSION}-linux-x86_64.tar.gz \ - | tar xz -C /usr/local --strip-components 1 - -# Install Ninja -RUN curl -fsSL -o /tmp/ninja.zip \ - https://github.com/ninja-build/ninja/releases/download/v${NINJAVERSION}/ninja-linux.zip \ - && unzip /tmp/ninja.zip -d /usr/local/bin && rm /tmp/ninja.zip - -# Install Go -RUN curl -fsSL https://go.dev/dl/go${GOLANG_VERSION}.linux-amd64.tar.gz \ - | tar xz -C /usr/local -ENV PATH=/usr/local/go/bin:$PATH - -ARG OLLAMA_VERSION=v0.23.2 -RUN git clone --depth 1 --branch ${OLLAMA_VERSION} https://github.com/ollama/ollama.git /build -WORKDIR /build - -# ROCm paths -ENV HIP_PATH=/opt/rocm -ENV ROCM_PATH=/opt/rocm -ENV CMAKE_GENERATOR=Ninja -ENV LDFLAGS=-s - -# Step 1: Build CPU backends with GCC (no ROCm preset) -# Pre-set CMAKE_HIP_COMPILER="" to prevent check_language(HIP) from -# finding a HIP compiler (it searches /opt/rocm even without PATH). -# Remove /opt/rocm from PATH to prevent find_program from finding hipcc. -RUN mkdir -p build-cpu && \ - PATH=/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \ - cmake -B build-cpu -DCMAKE_BUILD_TYPE=Release \ - -DCMAKE_HIP_COMPILER="" \ - -DCMAKE_INSTALL_PREFIX=/build/dist && \ - cmake --build build-cpu --target ggml-cpu -- -l $(nproc) && \ - cmake --install build-cpu --component CPU --strip && \ - echo "=== CPU install ===" && \ - (find /build/dist/lib/ollama -type f -o -type l 2>&1 | head -20 || echo "empty") - -# Step 2: Build HIP backend with ROCm preset + gfx906 target only -# The ROCm 6 preset enables HIP language detection (enable_language(HIP)) -# which ensures GPU kernels are properly compiled for gfx906. -# OLLAMA_RUNNER_DIR=rocm from the preset, so HIP goes to lib/ollama/rocm/ -# Need CMAKE_PREFIX_PATH so find_package(hip) finds hip-config.cmake -# at /opt/rocm/lib/cmake/hip/hip-config.cmake. -RUN mkdir -p build-hip && \ - cmake -B build-hip \ - --preset 'ROCm 6' \ - -DAMDGPU_TARGETS="gfx906:xnack-" \ - -DCMAKE_BUILD_TYPE=Release \ - -DCMAKE_PREFIX_PATH="/opt/rocm" && \ - cmake --build build-hip --target ggml-hip -- -l $(nproc) && \ - cmake --install build-hip --component HIP --strip && \ - echo "=== HIP install ===" && \ - find /build/dist/lib/ollama -type f -o -type l | head -20 - -# Step 3: Build Go binary (GCC for CGo linking) -ENV CGO_ENABLED=1 -RUN go build -trimpath -ldflags="-X=github.com/ollama/ollama/version.Version=${OLLAMA_VERSION}" -o /build/dist/ollama . - -# ---------- Runtime image ---------- -FROM ubuntu:24.04 - -RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \ - ca-certificates curl libstdc++6 libgomp1 libvulkan1 libopenblas0 \ - && rm -rf /var/lib/apt/lists/* - -# Copy ROCm 6.1 runtime libraries -# These are needed at runtime by ggml-hip via LD_LIBRARY_PATH -COPY --from=builder /opt/rocm/lib/ /opt/rocm/lib/ -COPY --from=builder /opt/rocm/share/ /opt/rocm/share/ - -# Copy ollama binary + all backends (CPU + HIP) -# CPU install: /build/dist/lib/ollama/libggml-*.so -# HIP install: /build/dist/lib/ollama/rocm/libggml-hip.so -COPY --from=builder /build/dist/ollama /usr/bin/ollama -COPY --from=builder /build/dist/lib/ollama/ /usr/lib/ollama/ - -RUN ldconfig - -ENV LD_LIBRARY_PATH=/opt/rocm/lib:/usr/lib/ollama/rocm:/usr/lib/ollama -ENV HSA_OVERRIDE_GFX_VERSION=9.0.6 -ENV HCC_AMDGPU_TARGET=gfx906 -ENV HSA_ENABLE_SDMA=0 - -EXPOSE 11434 -ENTRYPOINT ["/bin/ollama"] -CMD ["serve"] From 65587809aa4833a5f9dec9aa4a2e1cd5ea81acbf Mon Sep 17 00:00:00 2001 From: Robert Date: Mon, 15 Jun 2026 13:17:49 -0400 Subject: [PATCH 6/9] Added opencode api key --- secrets/containers.env.age | 80 +++++++++++++++++++------------------- 1 file changed, 40 insertions(+), 40 deletions(-) diff --git a/secrets/containers.env.age b/secrets/containers.env.age index 140b93f..0eaf7de 100644 --- a/secrets/containers.env.age +++ b/secrets/containers.env.age @@ -1,42 +1,42 @@ -----BEGIN AGE ENCRYPTED FILE----- -YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBhT2N1 -ZkN0TXUyQStDM21mS2RKdVpkdzJBZUtzYXZCdXpHbmdxcjQ3bVM4CkRXT0o3SUxn -citoamZvN1FCdjRIelBjK0FmVGVaWEU1UGF5RnRYbjlmc2MKLT4gY0ljOz0tZ3Jl -YXNlIFBDZEcgZyBZL0B+NCcrIGVUZktYClovYUx0WmZMdFFNRHNSaXFtdFFsNW13 -cU81WnBuZk42WlMrRkdQMHhUd2d2SzFHYkFRU1YyS3hWVHpYSzRrTm8KVHlCZ2Jp -YXJIV2daREo5NTFlczlQWE5EdkNKWjBBbUl6Mm1BbUtPM3VaeEMyRGpYWFlselh4 -YVpDV3MKLS0tIFd5dnBRNnhDUXo0aTNXR01zQVpvcWU2YlFwWkpnQlBJblpDZlRl -STZRT3cKp/XOxSw22xKAqGarUpJ5ITzQu627cXSJv6kd8AVH6F3ogD35vJjyba3f -3e3H6d+qgHDBPi0fkrhs4dOCavvutzgJ1atlPAeC1MmPOKypnG/WRnYfNAQphBTj -QlBjZQEf6g1l9WY4GVSbVaBYSFhL2xndXFv8O5g0AwehkuLlh0cmbQ6IXuRhmjKy -0a99hOwBUWxj7pTWILf+kONIQpOc1xs4OE0LcWAHjXyQabZSHCEwIomjHmAW/Eyz -JKOj1YYcOFXtigmAlzfNJKM4oG3fvWy578Mu0DfgJ9JoRMwb5oaC0AZbwQtetkMD -kF6rQfXnjDcu2PbaSckGVociC19CqfK3KmZEGgPdf3LNU17pzgxab7gywzVUhxBv -u1UnB66+utxiE1Id/hLWDNqK6W0QI1hsA4XHrZ32wOl/DzL9B3rs+mMgrvaitPFX -ixx3U7IwHNs31X7iMmtgEJiaV16C8N5kQ6/8ACdOoY71GdyAFJOl3mf5rxkbhZTf -EF3LbCQpKVrrkR1HPEVzzH2cCD4HwBsJwGv2JiKh9JTzA6R8xojmNzMhQqoXiD3+ -OT98yOxl/czQ9PZWUTtnco9CYYAU4VPLTvytqqpDfQlC7X1thykyAl5tdE86ys6U -KsYT19cVP8FoDyowrq82H3CuvMt5an8u1gtq7BHksjqd7tgV/ntwvcc+xiWJkUn1 -m7hZXtD8sC3XiNlTuF9HYJqele9ucYFbkxBo9PfPWCdhgIwC+ZdoKbk2C/EGRMFg -HE4wfLQktOgfex+RE1Q94aMtn7eWkNH3C0+q1m5Mb7Zxx6hrOJ7M+7EKT0gDpqcB -3mawSXPndzs8tCFeW838sfjhJzeMU6qFQdx0wem+UKgdXjdajWrMaPA8jlbhioUl -hjwR6hkdd91P4cwpfj7E9gjAC0rPmypCWh9ZvpuLhlpsGDiWMz5duJxNUbzql29f -8B05k37HIkCWB3GCDYDxCd8KAL3SBwXQlwn/jCo23oUQtz2c4vPj3FdziGNSTpQC -4qcQCORReE+E6bwEdctALxDiotZue/DqMLzIY6zf2ZPaJ/eFR9oQghKLero15lV+ -97C18Lv6grXJ0wMFI5wmx+p1BNNdB/IV8dn0p8dofiOqn5xppFcXTnPi32In5oxi -hKpYVYC0wfPdtHBewMhF7jC89n90TqKHTij5Jz2ongH26lJnIc2K5a5PqaOAVdA4 -RLHs8a/JWHf1Fe3SmvnGNthAmyF7o/8DFQj5qQYhwAtHETds+73bLAEOcfmH4103 -OSQ+BZ7eFw7AU7P32+tBP9xKgIo3qaNaOopt/OiAU9HuzkbwDHic409pwiGzofwD -943rvA8k6L50JiM5708UlE89jg4VaG43J9QJZa+mji/s4JX1Gdkn9HieUM4bf+/o -ZIF71CQxmzJ/oHurHOVanwvCGf73Je/zQCBoE4niO66ke0YuyiRnUBcahF/xXklu -Nl/2/Xzkms23aRq+mPmo39jy5D+44W3EPWakvN51ZQgXWLKLUiATca8XEoNYg8vM -hgskVaVLXSMUwC8rF9v3ZDVC1QZRGD7TwTt4Tam4jdiZ1vIlkAVsqEIdfGZLOGFX -yctLx3HiT5ASATvttXlQ1FbU4HI2VUeSWsl37glKm/CoExLzvWgLzA1APUerEP9F -JFZmVQvxAufShmrGZTFDSfA6d/4gnfW4SYROgIIsbxWI8yOnAYXfs8tjBtrwNGt0 -dtny2T9X/PFLOyjH6aCz6ONJ8+MII9LaOjZ2OcEKMrQVfjkWa4Cv7b6WoXkdaqBk -Bk8XPlBBhny1RfXIkkR+OmggIcq1Xat1JjG/TdpC4dfIUg2Lt2m+tlGn8Ir2wNMa -Xrz/IfgU/NY3d7IoiVxSpkbq60H9flYdrzuOd29abno6B0Hg68GfNJrQEPt4E8Pu -bo14knYrfSgi2gG8hUlT5m4uz2MFJo2RSu2hC+ZlbPMgrrPDUfnq6vIftH/2HRkE -1DxUAfxzxT02nhsaKrthoFtB8JZEN+rIL1a5lqYgePFQZZtRf6nRknYPdgKPTXjI -hNJgx1zP2mgSLSCjr8oS9PIKpPDo0bo= +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBMNTFJ +N1Q3eXhyZFliWXRhbStOQW1SZTR5UWlIcFVtS3FEUWFLWlpnbGwwCkoxUzZhckNV +aUlpYUZTYU1wd0dtMy9Malo1ZmxvTXFMeU4yemYydmtNKzAKLT4gJn53LDswXzQt +Z3JlYXNlIG4oRW0gPE5cWiBaaVpkWSUgO1xTSGkKenhuUGpxV0xpUTFZNlRqeWlF +N1JaSUd5a0hWVgotLS0gQnZ6U2RjZHcvWTRTYklYd0tjNEJjc2xUYXNOMEFodm9t +NmZFcXhLQmxmZwp99f6PvpVh5VdcZvY56M0W/wCT9yWAGwV5kAJo625aFKUEDiDL +gybuE9ycCJ6Yk708YMRuCo8wlUF5Gd8uJuaXl2BX4450yVG7CQQbfK+zMpawvvmN +5caZW+s3SjtlxR76qQP4UbrAmnrUnXSR3HGqwNSoYjWRg7vdLuUFam+un+B/auew +g26RbsTC3CtBu3m7ELj61atZ2xBmx8KNrBFyzpy2HN/gZcys9IYxd8dU+M98yK1s +BvavfZqr2nH30iYZ68RsCpO6Tu0Si8OIXFIOVF4EYZukZMkpfVlm8dwDgDF/qh9v +cOJ3DE4SS+/iweu7/3KmsaSf+1Pz1J2g517foisJsEJ2AeSdSCeLFBa+hPM1nJmr +uBuTzFv4UrCsT+WszLkrQwktyOGKMDD7EOmhqGZyB3qu9/Tt0uQAAOG8voXYxaIM +CtxcyUSTfv+D3scporNYtRsF1wt/kIiqnTKWD4x4rUvaA1ik74Dk8VRGd/vesPDM +MkaUadb8NhNbZRUcbaqWrM7Op/WhcwwnmL05FznAkjFf0ub9k1idbHRuLrtYq0eZ +m/GMINkKnrwkx3A0tYOSHZBpCg70p6U1uzXHUdatZ56K+0OrQMWRwqsMzosQGEpS +Yjw4Kta4iDkgI6lqNnpFWm8E0lfA2SOP3LL6R0MIj0Jj3MrEzOspXyJHjlfJapNN +3kV4iWpXfbsEYDSVMuk5K2BUCV+fXQ9Ns9XaCu3uySzFeIIFZ0YKJ1guGZ/hInPn +HRbyB2dIC6Nkrh2BozJxiS8Z5/hnWOPGP3EYP5U4DoKlNynUISZSDlUs9Be06Oc0 +MATCFCt5SjfbfMOrZwvl8HQTHJVuF4r48pUS9XrkWD0JxYIpMJk+jicCRk6VJf2K +QbbMxOKgU3Dvl+OdIo8DogwITVI0kyDsWsmmFPs9UWMi5z+aq+FEwEN8BBXUCtKa +0IEmuO/kWBf8qMfo9CxUL6AgBxRKAw691IYgF+vTsBtneyKwJdUiYEOu6AVe87SY +gCEDxGct762aVE+ZDDEYkL4WBiKpT+JJTXvTe2S9T1lObU/25vX4FiWGOUDcBxT9 +VgoByZ2Ld+FueUgSZ1VMWxd+zkA6IrQetcL/Puumx7kBIiS+1hjxc/DMOAUy/lA5 +JmjjulYAOL0K8HbE/oEYP9JM9YyR2eIMJGocsEmonzECPPENqmQZV6vT1zjxegay +xrkjXXbGMun28z9CrLuE2Tv5VNiGJkdB2SQbk0n2MV8Pmt7CsvQS0pT+mYsvejV+ +K+9U3+YnHXiVMK0YbRJWVpnSyEQAAjASb85N5yi8ygN+V4JfTMxZDGvDUF8d4HtT +TXaXlQ4FoIRtbsN90SZCkYYIKIiZDQiZiK5yZ/Tw4slyZgZvG+zEG7kjMkWmqY2j +lirzxRoRAc1tSFmb4KNST5ZEzZMdUVkoOZqBTXCxCPfhcJhMedtQP/cGJSz6kDBS +2Mpd9oZDeL0SiJMWKB28Qvb/OnZzmfRG/8iWP5P1Tv9NzMg3nvc8w4WzjVeSFz7j +J59wd+4BJFmHITNfklrgxTx6ODHBvJX61+6098DzBjIJetxd+Vtpgypp2lazh2b2 +TUH0BeTO7qtS7tbunXk4fVGm/LfeoPvlNf+LP8Jof0v5BPoQWkG2xS1Yvzbiz4/q +kkm1NF8kYW4ldi16rCCeAfBr7md5jDtP7YJxykey882aCe4CZunhRaDDgnySg82g +4hiWRmXPeuonGIHhtDPSb5CEzF9Bq6/lpDCPb2hu1mtZW2wvJv5Zf8WyopEPvBKy +YrOzh2HNvp0e2/fKkYi7LwnPNn3Wrevp4+3aK+BztaJ7JWFFVdx8C30rt0hIMfDu +2uc08RLuGBlcbPgLFzj+60OG+M+P+Ib8uCcPGfPnovft2Y2OSUf6yS1GylPSORDP +wsNEwCMd/q1cUKy263SBqypPOwViFBItT8fkpXrm+aBhjse9NDQ3r0LLwaLtN0r+ ++PCvnVa2pjx4EBudYdkahWlCBEHVYFpgR9It/rXyRxJbL3lB6UvrMv+CQeu78MYW +Mk1M0uPchpXvLG3AHVF5hReYOjsi//76Fw9Mvl9uRJwja3swKw3sjFlovnnREGbm +Lj0KqyiJ7rh0rDNywYyq2PsVk7LjyQXwFq5J/8azo06oXG8FvNGkJ5R5n2hiEshM +dBBnVsOXpRqK/EZnKjb/Rfg= -----END AGE ENCRYPTED FILE----- From 2e236581f079ec626c2da6c3ac72c774761bef94 Mon Sep 17 00:00:00 2001 From: Robert Date: Mon, 15 Jun 2026 13:20:15 -0400 Subject: [PATCH 7/9] update lock --- flake.lock | 188 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 188 insertions(+) diff --git a/flake.lock b/flake.lock index e78ed64..78eb564 100644 --- a/flake.lock +++ b/flake.lock @@ -23,6 +23,38 @@ "type": "github" } }, + "argononed": { + "flake": false, + "locked": { + "lastModified": 1729566243, + "narHash": "sha256-DPNI0Dpk5aym3Baf5UbEe5GENDrSmmXVdriRSWE+rgk=", + "owner": "nvmd", + "repo": "argononed", + "rev": "16dbee54d49b66d5654d228d1061246b440ef7cf", + "type": "github" + }, + "original": { + "owner": "nvmd", + "repo": "argononed", + "type": "github" + } + }, + "argononed_2": { + "flake": false, + "locked": { + "lastModified": 1729566243, + "narHash": "sha256-DPNI0Dpk5aym3Baf5UbEe5GENDrSmmXVdriRSWE+rgk=", + "owner": "nvmd", + "repo": "argononed", + "rev": "16dbee54d49b66d5654d228d1061246b440ef7cf", + "type": "github" + }, + "original": { + "owner": "nvmd", + "repo": "argononed", + "type": "github" + } + }, "flake-compat": { "flake": false, "locked": { @@ -37,6 +69,36 @@ "url": "https://git.lix.systems/lix-project/flake-compat/archive/main.tar.gz" } }, + "flake-compat_2": { + "locked": { + "lastModified": 1767039857, + "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_3": { + "locked": { + "lastModified": 1767039857, + "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, "home-manager": { "inputs": { "nixpkgs": [ @@ -144,6 +206,130 @@ "type": "github" } }, + "nixos-images": { + "inputs": { + "nixos-stable": [ + "nixos-raspberrypi", + "nixpkgs" + ], + "nixos-unstable": [ + "nixos-raspberrypi", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1747747741, + "narHash": "sha256-LUOH27unNWbGTvZFitHonraNx0JF/55h30r9WxqrznM=", + "owner": "nvmd", + "repo": "nixos-images", + "rev": "cbbd6db325775096680b65e2a32fb6187c09bbb4", + "type": "github" + }, + "original": { + "owner": "nvmd", + "ref": "sdimage-installer", + "repo": "nixos-images", + "type": "github" + } + }, + "nixos-images_2": { + "inputs": { + "nixos-stable": [ + "nixos-uconsole", + "nixos-raspberrypi", + "nixpkgs" + ], + "nixos-unstable": [ + "nixos-uconsole", + "nixos-raspberrypi", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1747747741, + "narHash": "sha256-LUOH27unNWbGTvZFitHonraNx0JF/55h30r9WxqrznM=", + "owner": "nvmd", + "repo": "nixos-images", + "rev": "cbbd6db325775096680b65e2a32fb6187c09bbb4", + "type": "github" + }, + "original": { + "owner": "nvmd", + "ref": "sdimage-installer", + "repo": "nixos-images", + "type": "github" + } + }, + "nixos-raspberrypi": { + "inputs": { + "argononed": "argononed", + "flake-compat": "flake-compat_2", + "nixos-images": "nixos-images", + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1779023229, + "narHash": "sha256-MInilg7B/06c34SwOuGSBho4l0H1EZcmvxTkSWCs5pE=", + "owner": "nvmd", + "repo": "nixos-raspberrypi", + "rev": "06c6e3513e1ee64b651913193fc6ac38aa4963f5", + "type": "github" + }, + "original": { + "owner": "nvmd", + "ref": "v1.20260517.0", + "repo": "nixos-raspberrypi", + "type": "github" + } + }, + "nixos-raspberrypi_2": { + "inputs": { + "argononed": "argononed_2", + "flake-compat": "flake-compat_3", + "nixos-images": "nixos-images_2", + "nixpkgs": [ + "nixos-uconsole", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1779023229, + "narHash": "sha256-MInilg7B/06c34SwOuGSBho4l0H1EZcmvxTkSWCs5pE=", + "owner": "nvmd", + "repo": "nixos-raspberrypi", + "rev": "06c6e3513e1ee64b651913193fc6ac38aa4963f5", + "type": "github" + }, + "original": { + "owner": "nvmd", + "ref": "v1.20260517.0", + "repo": "nixos-raspberrypi", + "type": "github" + } + }, + "nixos-uconsole": { + "inputs": { + "nixos-raspberrypi": "nixos-raspberrypi_2", + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1780333979, + "narHash": "sha256-yjp/gWRqWCxalYLe2+27gbxhttL+46Ozm7qvccpFbv4=", + "owner": "nixos-uconsole", + "repo": "nixos-uconsole", + "rev": "1e6a8dc51c7b26e15850688a0b01121c3fea4b30", + "type": "github" + }, + "original": { + "owner": "nixos-uconsole", + "repo": "nixos-uconsole", + "type": "github" + } + }, "nixpkgs": { "locked": { "lastModified": 1705033721, @@ -212,6 +398,8 @@ "inputs": { "agenix": "agenix", "lix": "lix", + "nixos-raspberrypi": "nixos-raspberrypi", + "nixos-uconsole": "nixos-uconsole", "nixpkgs": "nixpkgs_2" } }, From df91a909b6692499e404f052be2ac50133e09b0e Mon Sep 17 00:00:00 2001 From: Robert Date: Tue, 7 Jul 2026 14:15:26 -0400 Subject: [PATCH 8/9] More local changes, mostly compose update and nixmate --- assets/compose | 2 +- flake.lock | 93 ++++++++++++++++++++++++++- flake.nix | 9 ++- hosts/lazyworkhorse/configuration.nix | 1 + overlays/nixmate.nix | 6 ++ secrets/containers.env.age | 81 +++++++++++------------ 6 files changed, 148 insertions(+), 44 deletions(-) create mode 100644 overlays/nixmate.nix diff --git a/assets/compose b/assets/compose index e525145..2571930 160000 --- a/assets/compose +++ b/assets/compose @@ -1 +1 @@ -Subproject commit e52514505721c0cdd3eaf64e5fa70a4df9a39a46 +Subproject commit 2571930efab1ba464a61a72653b2a31e325db6b9 diff --git a/flake.lock b/flake.lock index 78eb564..04c299b 100644 --- a/flake.lock +++ b/flake.lock @@ -99,6 +99,24 @@ "type": "github" } }, + "flake-utils": { + "inputs": { + "systems": "systems_2" + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, "home-manager": { "inputs": { "nixpkgs": [ @@ -206,6 +224,26 @@ "type": "github" } }, + "nixmate": { + "inputs": { + "flake-utils": "flake-utils", + "nixpkgs": "nixpkgs_2", + "rust-overlay": "rust-overlay" + }, + "locked": { + "lastModified": 1771085058, + "narHash": "sha256-w9qE5zZ8mEHPbR84OuJoFWFvmMuKpvq/ANwyDUEvbPo=", + "owner": "daskladas", + "repo": "nixmate", + "rev": "9030841d4c3ec72359643d7af68bfdac428f1636", + "type": "github" + }, + "original": { + "owner": "daskladas", + "repo": "nixmate", + "type": "github" + } + }, "nixos-images": { "inputs": { "nixos-stable": [ @@ -363,6 +401,22 @@ } }, "nixpkgs_2": { + "locked": { + "lastModified": 1770562336, + "narHash": "sha256-ub1gpAONMFsT/GU2hV6ZWJjur8rJ6kKxdm9IlCT0j84=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "d6c71932130818840fc8fe9509cf50be8c64634f", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_3": { "locked": { "lastModified": 1774386573, "narHash": "sha256-4hAV26quOxdC6iyG7kYaZcM3VOskcPUrdCQd/nx8obc=", @@ -398,9 +452,31 @@ "inputs": { "agenix": "agenix", "lix": "lix", + "nixmate": "nixmate", "nixos-raspberrypi": "nixos-raspberrypi", "nixos-uconsole": "nixos-uconsole", - "nixpkgs": "nixpkgs_2" + "nixpkgs": "nixpkgs_3" + } + }, + "rust-overlay": { + "inputs": { + "nixpkgs": [ + "nixmate", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1770606655, + "narHash": "sha256-rpJf+kxvLWv32ivcgu8d+JeJooog3boJCT8J3joJvvM=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "11a396520bf911e4ed01e78e11633d3fc63b350e", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" } }, "systems": { @@ -417,6 +493,21 @@ "repo": "default", "type": "github" } + }, + "systems_2": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } } }, "root": "root", diff --git a/flake.nix b/flake.nix index ea2a6b6..ea37f80 100644 --- a/flake.nix +++ b/flake.nix @@ -2,6 +2,7 @@ description = "Gortium infra flake"; inputs = { + nixmate.url = "github:daskladas/nixmate"; nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable"; agenix = { url = "github:ryantm/agenix"; @@ -23,7 +24,7 @@ self.submodules = true; }; - outputs = { self, nixpkgs, agenix, lix, nixos-uconsole, nixos-raspberrypi, ... }@inputs: + outputs = { self, nixmate, nixpkgs, agenix, lix, nixos-uconsole, nixos-raspberrypi, ... }@inputs: let system = "x86_64-linux"; keys = import ./lib/keys.nix; @@ -34,7 +35,11 @@ "/etc/ssh/ssh_host_ed25519_key" "/root/.age/bootstrap.key" ]; }; - overlays = [ agenix.overlays.default (import ./overlays/reticulum.nix) ]; + overlays = [ + agenix.overlays.default + (import ./overlays/reticulum.nix) + (import ./overlays/nixmate.nix inputs) + ]; pkgs = import nixpkgs { inherit system overlays; config.allowUnfree = true; diff --git a/hosts/lazyworkhorse/configuration.nix b/hosts/lazyworkhorse/configuration.nix index 91dc793..9c40214 100644 --- a/hosts/lazyworkhorse/configuration.nix +++ b/hosts/lazyworkhorse/configuration.nix @@ -151,6 +151,7 @@ agenix git nh + nixmate lm_sensors rocmPackages.rocminfo rocmPackages.rocm-smi diff --git a/overlays/nixmate.nix b/overlays/nixmate.nix new file mode 100644 index 0000000..c4e6c97 --- /dev/null +++ b/overlays/nixmate.nix @@ -0,0 +1,6 @@ +# ./overlays/nixmate.nix +inputs: # We pass inputs here so the overlay can see the nixmate flake + +final: prev: { + nixmate = inputs.nixmate.packages.${prev.system}.default; +} diff --git a/secrets/containers.env.age b/secrets/containers.env.age index 0eaf7de..a02308b 100644 --- a/secrets/containers.env.age +++ b/secrets/containers.env.age @@ -1,42 +1,43 @@ -----BEGIN AGE ENCRYPTED FILE----- -YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBMNTFJ -N1Q3eXhyZFliWXRhbStOQW1SZTR5UWlIcFVtS3FEUWFLWlpnbGwwCkoxUzZhckNV -aUlpYUZTYU1wd0dtMy9Malo1ZmxvTXFMeU4yemYydmtNKzAKLT4gJn53LDswXzQt -Z3JlYXNlIG4oRW0gPE5cWiBaaVpkWSUgO1xTSGkKenhuUGpxV0xpUTFZNlRqeWlF -N1JaSUd5a0hWVgotLS0gQnZ6U2RjZHcvWTRTYklYd0tjNEJjc2xUYXNOMEFodm9t -NmZFcXhLQmxmZwp99f6PvpVh5VdcZvY56M0W/wCT9yWAGwV5kAJo625aFKUEDiDL -gybuE9ycCJ6Yk708YMRuCo8wlUF5Gd8uJuaXl2BX4450yVG7CQQbfK+zMpawvvmN -5caZW+s3SjtlxR76qQP4UbrAmnrUnXSR3HGqwNSoYjWRg7vdLuUFam+un+B/auew -g26RbsTC3CtBu3m7ELj61atZ2xBmx8KNrBFyzpy2HN/gZcys9IYxd8dU+M98yK1s -BvavfZqr2nH30iYZ68RsCpO6Tu0Si8OIXFIOVF4EYZukZMkpfVlm8dwDgDF/qh9v -cOJ3DE4SS+/iweu7/3KmsaSf+1Pz1J2g517foisJsEJ2AeSdSCeLFBa+hPM1nJmr -uBuTzFv4UrCsT+WszLkrQwktyOGKMDD7EOmhqGZyB3qu9/Tt0uQAAOG8voXYxaIM -CtxcyUSTfv+D3scporNYtRsF1wt/kIiqnTKWD4x4rUvaA1ik74Dk8VRGd/vesPDM -MkaUadb8NhNbZRUcbaqWrM7Op/WhcwwnmL05FznAkjFf0ub9k1idbHRuLrtYq0eZ -m/GMINkKnrwkx3A0tYOSHZBpCg70p6U1uzXHUdatZ56K+0OrQMWRwqsMzosQGEpS -Yjw4Kta4iDkgI6lqNnpFWm8E0lfA2SOP3LL6R0MIj0Jj3MrEzOspXyJHjlfJapNN -3kV4iWpXfbsEYDSVMuk5K2BUCV+fXQ9Ns9XaCu3uySzFeIIFZ0YKJ1guGZ/hInPn -HRbyB2dIC6Nkrh2BozJxiS8Z5/hnWOPGP3EYP5U4DoKlNynUISZSDlUs9Be06Oc0 -MATCFCt5SjfbfMOrZwvl8HQTHJVuF4r48pUS9XrkWD0JxYIpMJk+jicCRk6VJf2K -QbbMxOKgU3Dvl+OdIo8DogwITVI0kyDsWsmmFPs9UWMi5z+aq+FEwEN8BBXUCtKa -0IEmuO/kWBf8qMfo9CxUL6AgBxRKAw691IYgF+vTsBtneyKwJdUiYEOu6AVe87SY -gCEDxGct762aVE+ZDDEYkL4WBiKpT+JJTXvTe2S9T1lObU/25vX4FiWGOUDcBxT9 -VgoByZ2Ld+FueUgSZ1VMWxd+zkA6IrQetcL/Puumx7kBIiS+1hjxc/DMOAUy/lA5 -JmjjulYAOL0K8HbE/oEYP9JM9YyR2eIMJGocsEmonzECPPENqmQZV6vT1zjxegay -xrkjXXbGMun28z9CrLuE2Tv5VNiGJkdB2SQbk0n2MV8Pmt7CsvQS0pT+mYsvejV+ -K+9U3+YnHXiVMK0YbRJWVpnSyEQAAjASb85N5yi8ygN+V4JfTMxZDGvDUF8d4HtT -TXaXlQ4FoIRtbsN90SZCkYYIKIiZDQiZiK5yZ/Tw4slyZgZvG+zEG7kjMkWmqY2j -lirzxRoRAc1tSFmb4KNST5ZEzZMdUVkoOZqBTXCxCPfhcJhMedtQP/cGJSz6kDBS -2Mpd9oZDeL0SiJMWKB28Qvb/OnZzmfRG/8iWP5P1Tv9NzMg3nvc8w4WzjVeSFz7j -J59wd+4BJFmHITNfklrgxTx6ODHBvJX61+6098DzBjIJetxd+Vtpgypp2lazh2b2 -TUH0BeTO7qtS7tbunXk4fVGm/LfeoPvlNf+LP8Jof0v5BPoQWkG2xS1Yvzbiz4/q -kkm1NF8kYW4ldi16rCCeAfBr7md5jDtP7YJxykey882aCe4CZunhRaDDgnySg82g -4hiWRmXPeuonGIHhtDPSb5CEzF9Bq6/lpDCPb2hu1mtZW2wvJv5Zf8WyopEPvBKy -YrOzh2HNvp0e2/fKkYi7LwnPNn3Wrevp4+3aK+BztaJ7JWFFVdx8C30rt0hIMfDu -2uc08RLuGBlcbPgLFzj+60OG+M+P+Ib8uCcPGfPnovft2Y2OSUf6yS1GylPSORDP -wsNEwCMd/q1cUKy263SBqypPOwViFBItT8fkpXrm+aBhjse9NDQ3r0LLwaLtN0r+ -+PCvnVa2pjx4EBudYdkahWlCBEHVYFpgR9It/rXyRxJbL3lB6UvrMv+CQeu78MYW -Mk1M0uPchpXvLG3AHVF5hReYOjsi//76Fw9Mvl9uRJwja3swKw3sjFlovnnREGbm -Lj0KqyiJ7rh0rDNywYyq2PsVk7LjyQXwFq5J/8azo06oXG8FvNGkJ5R5n2hiEshM -dBBnVsOXpRqK/EZnKjb/Rfg= +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBVYWFV +U1dWcVVoZVJ2a1Bmd00zbnRvYnNTb0RvUlhJSVZheVlZcGlKRFgwCmVNTVNzVk8z +ZSszVUN2enhIV09UMkpGNG9vZlhTTVZrd1U1QnB6OVpnOU0KLT4gSCgtZ3JlYXNl +IFtVXTlQIGl6YXRHCjdqNS9oa3p5dGZseWV5NDNadjN2VDVheCtkRm1jRWpuY0Y3 +Sk1aWHhyQQotLS0gaFo5TjM1bFdKOEJVenZHK3RXOHExeXV0dFIrTUNMc0pnTXBM +YWIrNHdHNAqkUzENsQawFRPRh6K13pJN9pkDGpvpx07kTPkUWbocUQoJMxeXdAlh +Syw6Ca2X2Xb2QGnO6EIoMsfs6Tg78cEiDH4DEcdcNdHoSZlaNGLrUHnvE/Ygc/G0 +vz0D3uxTTvRBFYPNSONt+uN9j2p3JEZK5Hllt1GRmo6c8xnktDQpkwYLgegPYYxW +5Ge/ywwPlKp1WzqVVBQv2FH1/qm0QcBUhtjrkTTPFOjk3vlrXqbSM7n4cMZJYWRi +kMK51q2H49anwT8gkaeJ7hwlJpmzNIocDpD5sxxXj1NGc+uogEfaZrP7IRsACSTa +ggub/LYjPyajj4CLjt+6O3KNepNsOTEiGH11TZ6cyjipDerIcZx1rO/6cnOPpN40 +TZQc1IW+oGrbJk7WNNX4gjX2t0+ElVeDVQ2wEe862Yh4OxyMVUkCyh9DGFu5RxL4 +veKJfvs6VSjS4GtaOOXAxYra5GXGaNAx9w53MRSWXd7T9eh4VnYr0pvdRPMYyQAe +H/aNl9lqtQt1r4DtfF/RMOuqIiKFlnnhKlVfp5uCAn5Bgn4nCBMvQrAlghXWzI+N +rou2kBuzI3yKDO+8VJlacEVXM9vwv/O15XYpY/Mn1TYzbsOQi7FgnFatAWr6Uinh +gmay4WDxikIlKdhV1CqOJek5AAC1ptVCDgDcOpERDdZ+whBHUDTJ4NjMEPPcmlyw +9sejEf7mjuqKY5VGAVy2CRqV0wIMJ3nIo8Um2NNQE2BKCVyucmxhPVA6NieRgG8F +NvqIE3Iji1xFiUC+twjOkTcVAl7hKk2yLjZxF6KqoP7rWr787qr3qNA3cXhxgSUN +ZX9kzepy7pTyHADqK4j1Hum8o6/OjKaGQy/HIiywMjfk7zl3+Cs0PhjKG9HBReIQ +MqbJqa2fyAqOuHk/44Lpja1CI7LGWxOrctTixG3+Gy3JmTrZh8pDqzzNmPrByrHO ++nN3HzUZ/4sw5ONUz/GQ89WcSjez1TNr+lwRsYMf8tUCRHgdxUT9HRXUeOd8eD4d +CDyoAYpab01ZFkHzRhBOWJlqjqhDNIDEzMjImU4ieBsgCh9ZyIZF2HetLov6xESo +FYCDb7UqIXsw7n04wSTbwcYV2iPQ0EowPrADcSvqq+9YVr8Tsw6pmTaxC18Wi+zY +7R9ALANy9qgxLnBAAXIbp2iyJayFQDNONkOlp4NV2RiVN/UrHcZNsZsSfM0DFzqh +spuqt3czmAdvUzWpnghjMRUC49kkW2XNJxS9dREHmEPVZnzQo457CCCFsAqmrRB6 +c/wvyKD86Z89l/tkrLVz+sLQJMYfc5zED+EjyZyghHprkqZ6iDjFaEQUO8Fk2FwX +wCDqJhJGXs3MT7tJnfIrwy4AvJv9FgUnMYYpQiyv+ToDqgAWGVDfxGieQo6r59El +ZpTx+qt3jT+jI5Z6v4OVRODU2FFlee+YcF3ooF3yiwNdvuRhIgOVCNXkD/9QBOyq +MiOcCcGNxWx3COGIdshg/HVjGfxm+zZUYW0ktn3/YNkUHPIPxIWPNRdlQ9xbu3kD +vd1Ivx8wsUfo7soMffjdYKoAbAWS/3Ce/Sgpk15uo7CzGoO7Egzj+cb4GtvgojDD +BwG3CSzUJcXV2zbRwxfHRanko0RN/Qpskc/P1DiSMduxP8nZT+/r2HCykX+CRkM7 +PtnG0moKD3i5u3X/jQAAPA1X9BPbbwgTE/nmHpgMxG1BD5GlLmeY1hkBRwEUlnSr +UsN8FaWGBKyPMtMhK8EcjzmH259NJYguDgpBgMiIpO3sXst4yK5RuxR22+S8AI6X +VucMZWa+BzyHc3Oej/T5UrCIZ/tDzktD0Xp76EZxPD7ADw2z0+7TQ5YSYFal3+X1 +fcdKTphts2YRvtXLQuv+8SCIcf8VKMVjIkRCtE5ez1Isk+ZHEtprKsp9ZFsj9cFV +R6c2d1YqoW7IGWfcZL4snG09DaifPtwiwJBdYxRfGXgOq1fxtszzAxdlIoT3HRVo +pBHZp+7zcAXFyjgPDGOP5fcfGbMD41Vr9W9DVzioBIZDDQLRs4M6DZDgqgWv32tO +P7s2TivIEoAnirtic+tQZe5lXwndPUou0qYTO28diLSCTj29S+Vw9/ftah7qOqy6 +iDdf2rhbMNSRoywZOwQer6aLHePkSq7yDRRnQburIaUyy4FWjSYumx3O/2++JrkW +uFhLRIOu4M3gkgyqb4xOscxl/aEGZADR8tLIeqn/Bnt/Bub8vTph1H/ZCYEvjZA5 +afmShsiIKw== -----END AGE ENCRYPTED FILE----- From 2338eaf74c1bdfd740527d8e52b4da4eae2ca110 Mon Sep 17 00:00:00 2001 From: Hermes Date: Tue, 7 Jul 2026 14:59:26 -0400 Subject: [PATCH 9/9] fix: update compose submodule to include USER hermes fix The compose submodule now points to commit 54e0661 which adds the missing USER hermes at the end of the Hermes Dockerfile. This ensures all container processes run as uid 10000 instead of root, fixing the privilege leak where background subprocesses escaped the gosu drop and created root-owned files in ExoKortex that broke Syncthing sync. --- assets/compose | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/assets/compose b/assets/compose index 2571930..54e0661 160000 --- a/assets/compose +++ b/assets/compose @@ -1 +1 @@ -Subproject commit 2571930efab1ba464a61a72653b2a31e325db6b9 +Subproject commit 54e06613960446e593c170581cc263d3999538bc