Rex's Trixie images use [pi5] for the CM5 display overlays
(clockworkpi-uconsole-cm5, vc4-kms-v3d-pi5). The nixos-uconsole
module generates [cm5] which the firmware may not apply on
some CM5 EEPROM configurations. Adding explicit [pi5] section
ensures the display overlays are always loaded.
The ter-v24n Terminus font renders garbled on CM5 DSI 720x1280
panel (green stretched line across screen). Switching to the
kernel's built-in Lat2-Terminus16 font for correct text rendering.
GPIO 23 service used gpioset 0 23=1 on BCM2712 chip 0 instead
of the RP1 chip (base 512), writing to a critical pin and
freezing the system. Commented out until correct chip is confirmed.
SSH opened with PasswordAuthentication + PermitRootLogin for
first deployment. Lock down after initial boot.
sysfs node is read-only (0444), even root cannot write.
The AXP228 PMU manages power path in hardware.
Practical fix: disconnect batteries during heavy builds.
The nixpkgs attribute for userspace GPIO tools is 'libgpiod',
not 'gpiod'. This provides the gpioset binary used by the
GPIO 23 internal USB hub service.
Disko auto-generates fileSystems with by-partlabel paths, but
for manual install via loop devices we need by-label paths.
mkForce ensures our paths win during evaluation.
disko module defines options under `disko.devices.disk.*`, not
`disk.*`. This was causing evaluation error:
"The option 'disk' does not exist. Did you mean 'disko'?"
- Add disko flake input + partition config (/boot/firmware, /, /home)
- Add cm5-backlight-fix service as display fallback
- Add enable-gpio23-usb-hub service for internal USB hub
- Add mt7921u kernel module for MediaTek AC1200 WiFi
- Add gpiod package for GPIO userspace control
- Add wg0 interface config with agenix-managed secrets
- Revert compose submodule to remove NET_ADMIN from Hermes
- WireGuard runs at host level, all containers inherit the tunnel
wg-easy needs iptable_nat and iptable_filter to set up
masquerading for VPN traffic. These modules must be loaded
at boot for the container to access iptables.
- Refactor all 12 compose stacks to use isolated networks with Traefik as the hub
- Add openclaw-ssh sidecar to ai stack for reverse tunneling (port 2425)
- Add sshnode entrypoint to Traefik configuration
- Add cyt-pi host configuration for Pi Zero 2 W (headless)
- Include kismet and target_detector_cli services for remote Wi-Fi monitoring
- Add reverse SSH tunnel service via autossh
- Add headless openclaw node systemd service for host execution
- Migrate from nix to lix package manager
- Permit openclaw-2026.3.12 (insecure package warning)
- Use ai-worker user for node service
