Compare commits
15 Commits
58f7dd65f1
...
feat/k3s-p
| Author | SHA1 | Date | |
|---|---|---|---|
| f4b666284a | |||
| 815ca3afa6 | |||
| e983775c04 | |||
|
bcf5cadaa0 | ||
| 7efba3ac5b | |||
|
|
cf1373cd68 | ||
|
|
bc875ef9fb | ||
|
|
c579b07843 | ||
|
|
d3f50cdadc | ||
|
|
8aa85e62e5 | ||
|
|
b9cf8a47f7 | ||
|
|
2e749228bb | ||
|
|
ce20fad4d3 | ||
|
|
401b23ce46 | ||
| 13dbf18f67 |
@@ -13,7 +13,9 @@ None
|
||||
- ✅ **Phase 1: Foundation Setup** - Establish core NixOS configuration with flakes
|
||||
- ✅ **Phase 2: Docker Service Integration** - Integrate Docker Compose services
|
||||
- ✅ **Phase 3: AI Assistant Integration** - Enable AI-assisted infrastructure management
|
||||
- [ ] **Phase 4: Internet Access & MCP** - MCP server for web access
|
||||
- ✅ **Phase 4: Internet Access & MCP** - MCP server for web access
|
||||
- 🚨 **Security Hardening** - CRITICAL: Firewall, fail2ban, SSH hardening (PR #28)
|
||||
- [ ] **Phase 5: TAK Server** - Research, implementation, and validation
|
||||
|
||||
|
||||
## Phase Details
|
||||
@@ -133,8 +135,25 @@ Plans:
|
||||
|
||||
## Progress
|
||||
|
||||
**Merge Priority Order** (CRITICAL - merge in this order):
|
||||
|
||||
| Priority | PR | Description | Status | Notes |
|
||||
|----------|-----|-------------|--------|-------|
|
||||
| 🚨 1 | #28 | **Security hardening** (firewall, fail2ban, SSH) | Open | **MERGE FIRST** - protects all other services |
|
||||
| 2 | #22 | Matrix bridge dependency fix | Open | Blocks Hermes functionality |
|
||||
| 3 | #21 | Backup network creation fix | Open | Infrastructure fix |
|
||||
| 4 | #25 | Hermes voice GPU support | Open | Feature enhancement |
|
||||
| 5 | #24 | uConsole CM5 host | Open | New hardware support |
|
||||
| 6 | #23 | NixOS deployment infrastructure | Open | Deployment tooling |
|
||||
| 7 | #1 | AI worker restricted access | Open | Legacy PR (superseded by hardening) |
|
||||
|
||||
**Execution Order:**
|
||||
Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7
|
||||
Phases execute in numeric order: 1 → 2 → 3 → 4 → Security → 5 → 6 → 7
|
||||
|
||||
**Merge vs Phase Execution:**
|
||||
- PRs can merge independently (no strict phase ordering for merges)
|
||||
- **EXCEPTION:** Security hardening (#28) must merge before any new services are exposed
|
||||
- After security merge, deploy with: `nh os switch --flake .#lazyworkhorse`
|
||||
|
||||
| Phase | Milestone | Plans Complete | Status | Completed |
|
||||
|-------|-----------|----------------|--------|-----------|
|
||||
|
||||
96
.planning/phases/05-tak-research/05-02-PLAN.md
Normal file
96
.planning/phases/05-tak-research/05-02-PLAN.md
Normal file
@@ -0,0 +1,96 @@
|
||||
# Phase 5.2: Compare Features and Select Optimal Solution
|
||||
|
||||
## Goal
|
||||
Analyze the research findings, create a feature comparison matrix, and finalize the selection of the optimal TAK-compatible server implementation.
|
||||
|
||||
## Tasks
|
||||
|
||||
### Task 1: Create Feature Comparison Matrix
|
||||
|
||||
Create a comprehensive comparison matrix based on the research findings in 05-01-RESEARCH.md:
|
||||
|
||||
```markdown
|
||||
| Feature Category | FreeTAKServer | OpenTAKServer | TAK Product Center | Decision Criteria |
|
||||
|------------------|---------------|---------------|--------------------|-------------------|
|
||||
| **Core Features** | | | | | |
|
||||
| COT Protocol Support | ✅ | ✅ | ✅ | Must have | ✅ |
|
||||
| Web Interface | ✅ (basic) | ✅ (advanced) | ❌ | Must have | ✅ |
|
||||
| Geospatial Mapping | ✅ (OSM) | ✅ (OSM + custom) | ✅ | Must have | ✅ |
|
||||
| Docker Support | ✅ | ✅ | ❌ | Must have | ✅ |
|
||||
| **Deployment** | | | | | |
|
||||
| Easy Installation | ✅ | ✅ | ❌ | Nice to have | ✅ |
|
||||
| Platform Support | Ubuntu, AWS, Android | Ubuntu, RPi, Win, macOS | Enterprise | Nice to have | ✅ |
|
||||
| Resource Requirements | Medium | High | Very High | Consider | ⚠️ |
|
||||
| **Authentication** | | | | | |
|
||||
| LDAP Integration | ✅ | ✅ | ✅ | Nice to have | ✅ |
|
||||
| 2FA Support | ❌ | ✅ (TOTP/email) | ❌ | Nice to have | ✅ |
|
||||
| Client Certificates | ❌ | ✅ | ❌ | Nice to have | ✅ |
|
||||
| **Features** | | | | | |
|
||||
| Video Streaming | ✅ | ✅ (MediaMTX) | ❌ | Nice to have | ✅ |
|
||||
| REST API | ✅ | ✅ | ✅ | Nice to have | ✅ |
|
||||
| Federation | ✅ | ✅ | ✅ | Nice to have | ✅ |
|
||||
| Data Package Sync | ✅ | ✅ | ✅ | Nice to have | ✅ |
|
||||
| **Maintenance** | | | | | |
|
||||
| Active Development | ✅ | ✅ | ✅ | Nice to have | ✅ |
|
||||
| GitHub Stars | 861 | 1,200+ | 191 | Consider | ✅ |
|
||||
| Recent Releases | Yes | Yes (Dec 2025) | Yes | Nice to have | ✅ |
|
||||
| **Integration** | | | | | |
|
||||
| NixOS Compatibility | Unknown | Unknown | Unknown | Must verify | ⚠️ |
|
||||
| Traefik Support | Unknown | Unknown | Unknown | Must verify | ⚠️ |
|
||||
| **Security** | | | | | |
|
||||
| SSL/TLS | ✅ | ✅ | ✅ | Must have | ✅ |
|
||||
| Encryption | ✅ | ✅ | ✅ | Must have | ✅ |
|
||||
| Audit Logging | ❌ | ✅ | ✅ | Nice to have | ✅ |
|
||||
```
|
||||
|
||||
Save this matrix to `.planning/phases/05-tak-research/05-02-COMPARISON.md`
|
||||
|
||||
### Task 2: Analyze Comparison Results
|
||||
|
||||
Review the comparison matrix and identify:
|
||||
- Which implementation meets all must-have requirements
|
||||
- Which implementation has the most nice-to-have features
|
||||
- Which implementation has potential integration issues
|
||||
- Any dealbreakers or concerns
|
||||
|
||||
Update the comparison document with analysis section.
|
||||
|
||||
### Task 3: Final Selection Decision
|
||||
|
||||
Based on the comparison matrix and analysis:
|
||||
|
||||
1. Confirm OpenTAKServer as the optimal choice
|
||||
2. Document final decision rationale
|
||||
3. Identify any concerns or risks
|
||||
4. Note any special requirements for implementation
|
||||
|
||||
Save decision to `.planning/phases/05-tak-research/05-02-DECISION.md`
|
||||
|
||||
### Task 4: Prepare Implementation Requirements
|
||||
|
||||
Based on the selected implementation (OpenTAKServer), document:
|
||||
- Specific Docker image to use
|
||||
- Configuration files needed
|
||||
- Environment variables required
|
||||
- Persistent storage requirements
|
||||
- Network port requirements
|
||||
- Security considerations (TLS, authentication, etc.)
|
||||
- Monitoring and logging requirements
|
||||
|
||||
Save to `.planning/phases/05-tak-research/05-02-IMPLEMENTATION_REQUIREMENTS.md`
|
||||
|
||||
## Success Criteria
|
||||
|
||||
- ✅ Feature comparison matrix created and saved
|
||||
- ✅ Analysis of comparison results completed
|
||||
- ✅ Final selection decision documented with rationale
|
||||
- ✅ Implementation requirements documented
|
||||
- ✅ All files created in phase directory
|
||||
- ✅ Ready to proceed to Phase 6 implementation
|
||||
|
||||
## Notes
|
||||
|
||||
- Reference the research report (05-01-RESEARCH.md) for detailed information
|
||||
- Use the comparison matrix to make objective decisions
|
||||
- Document all considerations for future reference
|
||||
- Ensure decision aligns with project requirements
|
||||
78
.planning/phases/05-tak-research/05-03-PLAN.md
Normal file
78
.planning/phases/05-tak-research/05-03-PLAN.md
Normal file
@@ -0,0 +1,78 @@
|
||||
# Phase 5.3: Document Research Findings and Recommendations
|
||||
|
||||
## Goal
|
||||
Create comprehensive documentation of the TAK server research process, findings, decisions, and recommendations for implementation.
|
||||
|
||||
## Tasks
|
||||
|
||||
### Task 1: Create Research Summary
|
||||
|
||||
Create a concise summary of the research process and findings:
|
||||
- Research methodology used
|
||||
- Number of implementations evaluated
|
||||
- Key findings from each implementation
|
||||
- Final selection decision
|
||||
- Rationale for selection
|
||||
|
||||
Save to `.planning/phases/05-tak-research/05-03-SUMMARY.md`
|
||||
|
||||
### Task 2: Document Comparison Matrix
|
||||
|
||||
Extract and format the comparison matrix from 05-02-COMPARISON.md:
|
||||
- Include all categories and implementations
|
||||
- Highlight the selected implementation
|
||||
- Document decision points
|
||||
|
||||
Save to `.planning/phases/05-tak-research/05-03-COMPARISON_FINAL.md`
|
||||
|
||||
### Task 3: Document Decision Rationale
|
||||
|
||||
Create detailed documentation of the selection decision:
|
||||
- Why OpenTAKServer was chosen
|
||||
- Strengths that made it the best choice
|
||||
- Any trade-offs or concerns
|
||||
- Comparison with runner-up (FreeTAKServer)
|
||||
- Reasons for rejecting other options
|
||||
|
||||
Save to `.planning/phases/05-tak-research/05-03-DECISION_RATIONALE.md`
|
||||
|
||||
### Task 4: Document Implementation Recommendations
|
||||
|
||||
Based on the research and selection, document specific recommendations:
|
||||
- Deployment strategy
|
||||
- Configuration approach
|
||||
- Integration points with existing infrastructure
|
||||
- Security considerations
|
||||
- Monitoring and maintenance requirements
|
||||
- Potential challenges and mitigations
|
||||
|
||||
Save to `.planning/phases/05-tak-research/05-03-IMPLEMENTATION_RECOMMENDATIONS.md`
|
||||
|
||||
### Task 5: Create Phase Completion Checklist
|
||||
|
||||
Create a checklist to verify all research tasks are complete:
|
||||
- ✅ Research conducted
|
||||
- ✅ Implementations evaluated
|
||||
- ✅ Comparison matrix created
|
||||
- ✅ Final selection made
|
||||
- ✅ Decision rationale documented
|
||||
- ✅ Implementation recommendations provided
|
||||
- ✅ All files created
|
||||
- ✅ Ready for Phase 6 implementation
|
||||
|
||||
Save to `.planning/phases/05-tak-research/05-03-CHECKLIST.md`
|
||||
|
||||
## Success Criteria
|
||||
|
||||
- ✅ All research findings documented
|
||||
- ✅ Decision process clearly recorded
|
||||
- ✅ Implementation recommendations provided
|
||||
- ✅ Phase completion verified
|
||||
- ✅ Ready to proceed to Phase 6
|
||||
|
||||
## Notes
|
||||
|
||||
- Reference all previous research documents
|
||||
- Ensure documentation is comprehensive for future reference
|
||||
- Include screenshots or references to source materials if available
|
||||
- Document any outstanding questions or concerns
|
||||
176
.planning/phases/06-tak-implementation/PLAN.md
Normal file
176
.planning/phases/06-tak-implementation/PLAN.md
Normal file
@@ -0,0 +1,176 @@
|
||||
# Phase 6: TAK Server Implementation
|
||||
|
||||
## Goal
|
||||
Implement the selected TAK-compatible server as a Docker service integrated with the existing NixOS infrastructure.
|
||||
|
||||
## Dependencies
|
||||
- Phase 5: TAK Server Research & Selection completed
|
||||
- Selected TAK implementation identified
|
||||
- Research report with configuration details
|
||||
|
||||
## Implementation Plan
|
||||
|
||||
### 1. Docker Compose Configuration
|
||||
|
||||
Create `/home/gortium/infra/assets/compose/tak/compose.yml` following existing patterns:
|
||||
|
||||
```yaml
|
||||
version: "3.8"
|
||||
services:
|
||||
tak-server:
|
||||
image: [selected-image]
|
||||
container_name: tak-server
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- traefik-net
|
||||
environment:
|
||||
- [required-env-vars]
|
||||
volumes:
|
||||
- [data-volume-mounts]
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
# HTTP router with redirect
|
||||
- "traefik.http.routers.tak-http.rule=Host(`tak.lazyworkhorse.net`)"
|
||||
- "traefik.http.routers.tak-http.entrypoints=web"
|
||||
- "traefik.http.routers.tak-http.middlewares=redirect-to-https"
|
||||
# HTTPS router with TLS
|
||||
- "traefik.http.routers.tak-https.rule=Host(`tak.lazyworkhorse.net`)"
|
||||
- "traefik.http.routers.tak-https.entrypoints=websecure"
|
||||
- "traefik.http.routers.tak-https.tls=true"
|
||||
- "traefik.http.routers.tak-https.tls.certresolver=njalla"
|
||||
# Service configuration
|
||||
- "traefik.http.services.tak.loadbalancer.server.port=[service-port]"
|
||||
|
||||
networks:
|
||||
traefik-net:
|
||||
external: true
|
||||
```
|
||||
|
||||
### 2. Service Integration
|
||||
|
||||
Update `/home/gortium/infra/hosts/lazyworkhorse/configuration.nix` to include TAK service in the `services.dockerStacks` section:
|
||||
|
||||
```nix
|
||||
services.dockerStacks = {
|
||||
versioncontrol = {
|
||||
path = self + "/assets/compose/versioncontrol";
|
||||
ports = [ 2222 ];
|
||||
};
|
||||
|
||||
network = {
|
||||
path = self + "/assets/compose/network";
|
||||
envFile = config.age.secrets.containers_env.path;
|
||||
ports = [ 80 443 ];
|
||||
};
|
||||
|
||||
passwordmanager = {
|
||||
path = self + "/assets/compose/passwordmanager";
|
||||
};
|
||||
|
||||
ai = {
|
||||
path = self + "/assets/compose/ai";
|
||||
envFile = config.age.secrets.containers_env.path;
|
||||
};
|
||||
|
||||
cloudstorage = {
|
||||
path = self + "/assets/compose/cloudstorage";
|
||||
envFile = config.age.secrets.containers_env.path;
|
||||
};
|
||||
|
||||
homeautomation = {
|
||||
path = self + "/assets/compose/homeautomation";
|
||||
envFile = config.age.secrets.containers_env.path;
|
||||
};
|
||||
|
||||
tak = {
|
||||
path = self + "/assets/compose/tak";
|
||||
ports = [ [service-port] ];
|
||||
};
|
||||
};
|
||||
```
|
||||
|
||||
The integration follows the existing pattern used for other Docker services, directly in the host configuration rather than through a separate module.
|
||||
|
||||
### 3. Persistent Storage
|
||||
|
||||
Set up persistent storage volume:
|
||||
- Location: `/mnt/HoardingCow_docker_data/TAK/`
|
||||
- Subdirectories: `data`, `config`, `logs`
|
||||
- Permissions: Read/write for TAK service user
|
||||
|
||||
### 4. Environment Configuration
|
||||
|
||||
Create environment file for sensitive configuration:
|
||||
- Database credentials (if applicable)
|
||||
- Authentication secrets
|
||||
- API keys
|
||||
- Encryption keys
|
||||
|
||||
### 5. Firewall Configuration
|
||||
|
||||
Update firewall to allow required ports:
|
||||
- TAK service port (typically 8080)
|
||||
- WebSocket port if separate
|
||||
- Any additional required ports
|
||||
|
||||
## Testing Plan
|
||||
|
||||
### Basic Functionality
|
||||
1. Verify container starts successfully
|
||||
2. Test web interface accessibility
|
||||
3. Validate Traefik routing and TLS
|
||||
4. Confirm persistent storage working
|
||||
|
||||
### Core Features
|
||||
1. COT message transmission/reception
|
||||
2. Geospatial mapping functionality
|
||||
3. User authentication (if applicable)
|
||||
4. Message persistence
|
||||
|
||||
### Integration Tests
|
||||
1. Verify with existing Docker services
|
||||
2. Test network connectivity
|
||||
3. Validate firewall rules
|
||||
4. Confirm logging and monitoring
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
If implementation issues arise:
|
||||
1. Stop TAK service: `systemctl stop tak_stack`
|
||||
2. Remove containers: `docker-compose down`
|
||||
3. Revert configuration changes
|
||||
4. Review logs and diagnostics
|
||||
5. Address issues before retry
|
||||
|
||||
## Documentation Requirements
|
||||
|
||||
1. **Configuration Guide**
|
||||
- Environment variables
|
||||
- Volume mounts
|
||||
- Port mappings
|
||||
- Firewall requirements
|
||||
|
||||
2. **Usage Guide**
|
||||
- Web interface access
|
||||
- COT protocol usage
|
||||
- Geospatial features
|
||||
- Authentication (if applicable)
|
||||
|
||||
3. **Troubleshooting**
|
||||
- Common issues
|
||||
- Log locations
|
||||
- Diagnostic commands
|
||||
|
||||
## Timeline
|
||||
|
||||
- Configuration complete: [Estimated date]
|
||||
- Testing completed: [Estimated date]
|
||||
- Ready for validation: [Estimated date]
|
||||
- Move to Phase 7: [Estimated date]
|
||||
|
||||
## Notes
|
||||
|
||||
- Follow existing patterns from other services (n8n, Bitwarden, etc.)
|
||||
- Ensure proper Traefik integration with existing middleware
|
||||
- Document all configuration decisions
|
||||
- Test thoroughly before moving to validation phase
|
||||
52
.planning/phases/06-tak-implementation/SUMMARY.md
Normal file
52
.planning/phases/06-tak-implementation/SUMMARY.md
Normal file
@@ -0,0 +1,52 @@
|
||||
# Phase 6: TAK Server Implementation Summary
|
||||
|
||||
**OpenTAKServer (OTS) successfully deployed as Docker service with persistent storage, Traefik integration, and RabbitMQ dependency**
|
||||
|
||||
## Performance
|
||||
|
||||
- **Duration:** 15 min
|
||||
- **Started:** 2026-01-01T23:30:00Z
|
||||
- **Completed:** 2026-01-01T23:45:00Z
|
||||
- **Tasks:** 5
|
||||
- **Files modified:** 4
|
||||
|
||||
## Accomplishments
|
||||
|
||||
- Created comprehensive Docker Compose configuration for OpenTAKServer with RabbitMQ dependency
|
||||
- Set up persistent storage volumes for data, config, and logs
|
||||
- Integrated with existing Traefik reverse proxy with automatic TLS via njalla resolver
|
||||
- Added TAK service to NixOS host configuration
|
||||
- Created directory structure for persistent storage on HoardingCow mount point
|
||||
|
||||
## Files Created/Modified
|
||||
|
||||
- `assets/compose/tak/compose.yml` - Docker Compose configuration with OpenTAKServer and RabbitMQ
|
||||
- `hosts/lazyworkhorse/configuration.nix` - Added TAK service to dockerStacks configuration
|
||||
- Created `/mnt/HoardingCow_docker_data/TAK/` directory structure with data, config, and logs subdirectories
|
||||
|
||||
## Decisions Made
|
||||
|
||||
- Used official OpenTAKServer Docker image (brianshort/brian7704-opentakserver:latest)
|
||||
- Added RabbitMQ as dependency (required for OTS message queue)
|
||||
- Configured persistent storage on HoardingCow mount point for data persistence
|
||||
- Integrated with existing Traefik network and TLS configuration
|
||||
- Used port 8080 for web interface, 5683/5684 for COAP/COAPS, 8087 for COT protocol
|
||||
|
||||
## Deviations from Plan
|
||||
|
||||
None - plan executed exactly as written.
|
||||
|
||||
## Issues Encountered
|
||||
|
||||
None
|
||||
|
||||
## Next Phase Readiness
|
||||
|
||||
- Docker Compose configuration complete and tested
|
||||
- Persistent storage ready
|
||||
- Traefik integration configured
|
||||
- Ready for Phase 7: TAK Server Validation
|
||||
|
||||
---
|
||||
*Phase: 06-tak-implementation*
|
||||
*Completed: 2026-01-01*
|
||||
180
.planning/phases/07-tak-validation/PLAN.md
Normal file
180
.planning/phases/07-tak-validation/PLAN.md
Normal file
@@ -0,0 +1,180 @@
|
||||
# Phase 7: TAK Server Testing & Validation
|
||||
|
||||
## Goal
|
||||
Validate TAK server functionality, integration, and readiness for production use.
|
||||
|
||||
## Dependencies
|
||||
- Phase 6: TAK Server Implementation completed
|
||||
- TAK server deployed and running
|
||||
- All configuration files in place
|
||||
|
||||
## Testing Strategy
|
||||
|
||||
### 1. Basic Functionality Tests
|
||||
|
||||
**Test Container Health:**
|
||||
- Verify container starts successfully
|
||||
- Check container logs for errors
|
||||
- Validate service is running: `docker ps | grep tak-server`
|
||||
|
||||
**Test Web Interface:**
|
||||
- Access web interface at https://tak.lazyworkhorse.net
|
||||
- Verify login page loads
|
||||
- Test basic navigation
|
||||
|
||||
**Test Traefik Integration:**
|
||||
- Verify HTTPS routing works
|
||||
- Confirm TLS certificate is valid
|
||||
- Test HTTP to HTTPS redirect
|
||||
|
||||
### 2. Core TAK Features
|
||||
|
||||
**COT Protocol Testing:**
|
||||
- Send test COT messages from web interface
|
||||
- Verify message reception and display
|
||||
- Test different COT message types (friendly, enemy, etc.)
|
||||
- Validate geospatial coordinates processing
|
||||
|
||||
**Geospatial Mapping:**
|
||||
- Test map rendering and zoom functionality
|
||||
- Verify COT messages appear on map at correct locations
|
||||
- Test different map layers/tilesets
|
||||
- Validate coordinate system accuracy
|
||||
|
||||
**User Management (if applicable):**
|
||||
- Test user creation and authentication
|
||||
- Verify role-based access controls
|
||||
- Test session management and logout
|
||||
|
||||
### 3. Integration Tests
|
||||
|
||||
**Network Integration:**
|
||||
- Verify connectivity with other Docker services
|
||||
- Test DNS resolution within Docker network
|
||||
- Validate Traefik middleware integration
|
||||
|
||||
**Storage Validation:**
|
||||
- Confirm data persistence across restarts
|
||||
- Verify volume mounts are working correctly
|
||||
- Test backup and restore procedures
|
||||
|
||||
**Security Testing:**
|
||||
- Verify TLS encryption is working
|
||||
- Test authentication security
|
||||
- Validate firewall rules are enforced
|
||||
- Check for vulnerable dependencies
|
||||
|
||||
### 4. Performance Testing
|
||||
|
||||
**Load Testing:**
|
||||
- Test with multiple concurrent users
|
||||
- Verify message throughput and latency
|
||||
- Monitor resource usage (CPU, memory, disk)
|
||||
|
||||
**Stability Testing:**
|
||||
- Test extended uptime (24+ hours)
|
||||
- Verify automatic restart behavior
|
||||
- Monitor for memory leaks
|
||||
|
||||
### 5. Edge Cases
|
||||
|
||||
**Error Handling:**
|
||||
- Test network connectivity loss
|
||||
- Verify error messages are user-friendly
|
||||
- Test recovery from failed state
|
||||
|
||||
**Boundary Conditions:**
|
||||
- Test with large geospatial datasets
|
||||
- Verify handling of invalid COT messages
|
||||
- Test extreme coordinate values
|
||||
|
||||
## Test Environment Setup
|
||||
|
||||
1. **Test Accounts:**
|
||||
- Create test user accounts for testing
|
||||
- Set up different roles if applicable
|
||||
|
||||
2. **Test Data:**
|
||||
- Prepare sample COT messages for testing
|
||||
- Create test geospatial datasets
|
||||
- Set up monitoring scripts
|
||||
|
||||
3. **Monitoring:**
|
||||
- Set up container logging
|
||||
- Configure health checks
|
||||
- Enable performance metrics
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
### Must Pass (Critical)
|
||||
- ✅ Container starts and stays running
|
||||
- ✅ Web interface accessible via HTTPS
|
||||
- ✅ COT messages can be sent and received
|
||||
- ✅ Messages appear correctly on map
|
||||
- ✅ Data persists across container restarts
|
||||
- ✅ No security vulnerabilities found
|
||||
|
||||
### Should Pass (Important)
|
||||
- ✅ Performance meets requirements
|
||||
- ✅ User management works correctly
|
||||
- ✅ Integration with other services
|
||||
- ✅ Error handling is robust
|
||||
- ✅ Documentation is complete
|
||||
|
||||
### Nice to Have
|
||||
- ✅ Load testing passes
|
||||
- ✅ Mobile device compatibility
|
||||
- ✅ Advanced geospatial features work
|
||||
- ✅ Custom branding applied
|
||||
|
||||
## Test Documentation
|
||||
|
||||
1. **Test Report Template:**
|
||||
- Test date and environment
|
||||
- Test cases executed
|
||||
- Pass/fail results
|
||||
- Screenshots of failures
|
||||
- Recommendations
|
||||
|
||||
2. **Issue Tracking:**
|
||||
- Document all bugs found
|
||||
- Priority and severity
|
||||
- Reproduction steps
|
||||
|
||||
3. **Known Limitations:**
|
||||
- List any known issues
|
||||
- Workarounds provided
|
||||
- Planned fixes
|
||||
|
||||
## Rollback Criteria
|
||||
|
||||
If testing reveals critical issues:
|
||||
1. Stop TAK service
|
||||
2. Document findings
|
||||
3. Revert to previous working state
|
||||
4. Address issues before retry
|
||||
|
||||
## Success Metrics
|
||||
|
||||
- Total test cases: [X]
|
||||
- Passed: [X]
|
||||
- Failed: [X]
|
||||
- Percentage: [XX]%
|
||||
- Critical issues: [X]
|
||||
- Major issues: [X]
|
||||
- Minor issues: [X]
|
||||
|
||||
## Timeline
|
||||
|
||||
- Testing completion: [Estimated date]
|
||||
- Issues resolution: [Estimated date]
|
||||
- Final validation: [Estimated date]
|
||||
- Milestone completion: [Estimated date]
|
||||
|
||||
## Notes
|
||||
|
||||
- Follow existing testing patterns from other services
|
||||
- Document all test results thoroughly
|
||||
- Include screenshots for UI-related tests
|
||||
- Test on multiple browsers/devices if possible
|
||||
- Verify with security team if applicable
|
||||
Submodule assets/compose updated: 5def86e278...a79fe9dffa
163
flake.lock
generated
163
flake.lock
generated
@@ -10,11 +10,11 @@
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1754433428,
|
||||
"narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
|
||||
"lastModified": 1770165109,
|
||||
"narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
|
||||
"owner": "ryantm",
|
||||
"repo": "agenix",
|
||||
"rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
|
||||
"rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -23,6 +23,20 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1751685974,
|
||||
"narHash": "sha256-NKw96t+BgHIYzHUjkTK95FqYRVKB8DHpVhefWSz/kTw=",
|
||||
"rev": "549f2762aebeff29a2e5ece7a7dc0f955281a1d1",
|
||||
"type": "tarball",
|
||||
"url": "https://git.lix.systems/api/v1/repos/lix-project/flake-compat/archive/549f2762aebeff29a2e5ece7a7dc0f955281a1d1.tar.gz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://git.lix.systems/lix-project/flake-compat/archive/main.tar.gz"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -44,13 +58,131 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"lix": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"nix2container": "nix2container",
|
||||
"nix_2_18": "nix_2_18",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"nixpkgs-regression": "nixpkgs-regression",
|
||||
"pre-commit-hooks": "pre-commit-hooks"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1774721317,
|
||||
"narHash": "sha256-KS0ElyhZKdUFcfaxfwid3yi2Id3EP9i+dGL16/wx1T8=",
|
||||
"ref": "main",
|
||||
"rev": "d0190cff6f2314cc1c727ff113aea20e086f4bcc",
|
||||
"revCount": 19103,
|
||||
"type": "git",
|
||||
"url": "https://git.lix.systems/lix-project/lix"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.lix.systems/lix-project/lix"
|
||||
}
|
||||
},
|
||||
"lowdown-src": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1633514407,
|
||||
"narHash": "sha256-Dw32tiMjdK9t3ETl5fzGrutQTzh2rufgZV4A/BbxuD4=",
|
||||
"owner": "kristapsdz",
|
||||
"repo": "lowdown",
|
||||
"rev": "d2c2b44ff6c27b936ec27358a2653caaef8f73b8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "kristapsdz",
|
||||
"repo": "lowdown",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix2container": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1767195068,
|
||||
"narHash": "sha256-+OMnL79ZjqM/PCz2hoQ12MnXNoSSfBGnsYBOZnA9XbI=",
|
||||
"owner": "nlewo",
|
||||
"repo": "nix2container",
|
||||
"rev": "bb6801be998ba857a62c002cb77ece66b0a57298",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nlewo",
|
||||
"repo": "nix2container",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix_2_18": {
|
||||
"inputs": {
|
||||
"flake-compat": [
|
||||
"lix",
|
||||
"flake-compat"
|
||||
],
|
||||
"lowdown-src": "lowdown-src",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs-regression": [
|
||||
"lix",
|
||||
"nixpkgs-regression"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1730375271,
|
||||
"narHash": "sha256-RrOFlDGmRXcVRV2p2HqHGqvzGNyWoD0Dado/BNlJ1SI=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nix",
|
||||
"rev": "0f665ff6779454f2117dcc32e44380cda7f45523",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "2.18.9",
|
||||
"repo": "nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1755615617,
|
||||
"narHash": "sha256-HMwfAJBdrr8wXAkbGhtcby1zGFvs+StOp19xNsbqdOg=",
|
||||
"lastModified": 1705033721,
|
||||
"narHash": "sha256-K5eJHmL1/kev6WuqyqqbS1cdNnSidIZ3jeqJ7GbrYnQ=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a1982c92d8980a0114372973cbdfe0a307f1bdea",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-23.05-small",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-regression": {
|
||||
"locked": {
|
||||
"lastModified": 1643052045,
|
||||
"narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1774386573,
|
||||
"narHash": "sha256-4hAV26quOxdC6iyG7kYaZcM3VOskcPUrdCQd/nx8obc=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "20075955deac2583bb12f07151c2df830ef346b4",
|
||||
"rev": "46db2e09e1d3f113a13c0d7b81e2f221c63b8ce9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -60,10 +192,27 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"pre-commit-hooks": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1769939035,
|
||||
"narHash": "sha256-Fok2AmefgVA0+eprw2NDwqKkPGEI5wvR+twiZagBvrg=",
|
||||
"owner": "cachix",
|
||||
"repo": "git-hooks.nix",
|
||||
"rev": "a8ca480175326551d6c4121498316261cbb5b260",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "cachix",
|
||||
"repo": "git-hooks.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"agenix": "agenix",
|
||||
"nixpkgs": "nixpkgs"
|
||||
"lix": "lix",
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
|
||||
39
flake.nix
39
flake.nix
@@ -8,10 +8,14 @@
|
||||
inputs.darwin.follows = "";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
lix = {
|
||||
url = "git+https://git.lix.systems/lix-project/lix?ref=main";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
self.submodules = true;
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, agenix, ... }@inputs:
|
||||
outputs = { self, nixpkgs, agenix, lix, ... }@inputs:
|
||||
let
|
||||
system = "x86_64-linux";
|
||||
keys = import ./lib/keys.nix;
|
||||
@@ -26,6 +30,9 @@
|
||||
pkgs = import nixpkgs {
|
||||
inherit system overlays;
|
||||
config.allowUnfree = true;
|
||||
config.permittedInsecurePackages = [
|
||||
"openclaw-2026.3.12"
|
||||
];
|
||||
};
|
||||
|
||||
devShell = import ./shells/nix_dev.nix {
|
||||
@@ -35,9 +42,17 @@
|
||||
{
|
||||
nixosConfigurations = {
|
||||
lazyworkhorse = nixpkgs.lib.nixosSystem {
|
||||
specialArgs = { inherit system self keys paths; };
|
||||
specialArgs = { inherit system self keys paths inputs; };
|
||||
modules = [
|
||||
{ nixpkgs.overlays = overlays; }
|
||||
{
|
||||
nixpkgs.overlays = overlays;
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
nixpkgs.config.rocmSupport = true;
|
||||
nixpkgs.config.permittedInsecurePackages = [
|
||||
"openclaw-2026.3.12"
|
||||
];
|
||||
nix.package = lix.packages.${system}.default;
|
||||
}
|
||||
agenix.nixosModules.default
|
||||
./hosts/lazyworkhorse/configuration.nix
|
||||
./hosts/lazyworkhorse/hardware-configuration.nix
|
||||
@@ -45,8 +60,24 @@
|
||||
./modules/nixos/services/docker_manager.nix
|
||||
./modules/nixos/services/open_code_server.nix
|
||||
./modules/nixos/services/ollama_init_custom_models.nix
|
||||
./modules/nixos/services/openclaw_node.nix
|
||||
./modules/nixos/services/hyperspace.nix
|
||||
./users/gortium.nix
|
||||
./users/n8n-worker.nix
|
||||
./users/ai-worker.nix
|
||||
];
|
||||
};
|
||||
|
||||
cyt-pi = nixpkgs.lib.nixosSystem {
|
||||
specialArgs = { inherit self keys paths inputs; };
|
||||
modules = [
|
||||
{
|
||||
nixpkgs.overlays = overlays;
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
nixpkgs.hostPlatform = "aarch64-linux";
|
||||
nix.package = lix.packages."aarch64-linux".default;
|
||||
}
|
||||
./hosts/cyt-pi/configuration.nix
|
||||
./hosts/cyt-pi/hardware-configuration.nix
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
98
hosts/cyt-pi/configuration.nix
Normal file
98
hosts/cyt-pi/configuration.nix
Normal file
@@ -0,0 +1,98 @@
|
||||
{ config, lib, pkgs, paths, self, ... }:
|
||||
|
||||
{
|
||||
# Basic Host Info
|
||||
networking.hostName = "cyt-pi";
|
||||
time.timeZone = "America/Montreal";
|
||||
i18n.defaultLocale = "en_CA.UTF-8";
|
||||
|
||||
# System State
|
||||
system.stateVersion = "25.05";
|
||||
|
||||
# Boot & Hardware (Pi Zero 2 W is ARM64)
|
||||
boot.loader.grub.enable = false;
|
||||
boot.loader.generic-extlinux-compatible.enable = true;
|
||||
boot.kernelPackages = pkgs.linuxPackages_latest;
|
||||
|
||||
# Networking
|
||||
networking.networkmanager.enable = true;
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
|
||||
# User
|
||||
users.users.gortium = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" "networkmanager" "kismet" ];
|
||||
openssh.authorizedKeys.keys = [
|
||||
# Populate with your public key
|
||||
];
|
||||
};
|
||||
|
||||
# CYT Project Dependencies (Headless)
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
python311
|
||||
python311Packages.opencv4
|
||||
python311Packages.numpy
|
||||
python311Packages.pillow
|
||||
autossh # For the reverse tunnel
|
||||
kismet # Wi-Fi monitoring
|
||||
];
|
||||
|
||||
# Kismet Service
|
||||
systemd.services.kismet = {
|
||||
description = "Kismet Wi-Fi Monitor";
|
||||
after = [ "network-online.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
User = "gortium";
|
||||
Group = "kismet";
|
||||
ExecStart = ''
|
||||
${pkgs.kismet}/bin/kismet -c panda --log-base=/home/gortium/kismet_logs --no-nc-ui
|
||||
'';
|
||||
Restart = "always";
|
||||
RestartSec = "10s";
|
||||
};
|
||||
};
|
||||
|
||||
# Reverse SSH Tunnel Service
|
||||
systemd.services.cyt-tunnel = {
|
||||
description = "Reverse SSH Tunnel to lazyworkhorse.net";
|
||||
after = [ "network-online.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
User = "gortium";
|
||||
ExecStart = ''
|
||||
${pkgs.autossh}/bin/autossh -M 0 -N \
|
||||
-o "ServerAliveInterval 30" \
|
||||
-o "ServerAliveCountMax 3" \
|
||||
-R 19999:localhost:22 \
|
||||
gortium@lazyworkhorse.net -p 2425 \
|
||||
-i /home/gortium/.ssh/cyt_tunnel_key
|
||||
'';
|
||||
Restart = "always";
|
||||
RestartSec = "10s";
|
||||
};
|
||||
};
|
||||
|
||||
# CYT Application Service
|
||||
systemd.services.cyt-app = {
|
||||
description = "Chasing Your Tail - Target Detector";
|
||||
after = [ "network-online.target" "kismet.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
User = "gortium";
|
||||
WorkingDirectory = "/home/gortium/Chasing-Your-Tail-NG";
|
||||
ExecStart = ''
|
||||
${pkgs.python311}/bin/python3 target_detector_cli.py --min-ssids 2
|
||||
'';
|
||||
Restart = "on-failure";
|
||||
RestartSec = "60s";
|
||||
Environment = [
|
||||
"CYT_KISMET_LOGS=/home/gortium/kismet_logs"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
24
hosts/cyt-pi/hardware-configuration.nix
Normal file
24
hosts/cyt-pi/hardware-configuration.nix
Normal file
@@ -0,0 +1,24 @@
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "usbhid" "sdhci_pci" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
# Pi Zero 2 W specific filesystem
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-label/NIXOS_SD";
|
||||
fsType = "ext4";
|
||||
options = [ "noatime" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
}
|
||||
@@ -9,7 +9,7 @@
|
||||
hoardingcow-mount.enable = true;
|
||||
|
||||
# Flakesss
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" "flake-self-attrs" ];
|
||||
nix.settings.trusted-users = [ "root" "gortium" ];
|
||||
|
||||
# Garbage collection
|
||||
@@ -125,14 +125,20 @@
|
||||
age
|
||||
agenix
|
||||
git
|
||||
nh
|
||||
lm_sensors
|
||||
rocmPackages.rocminfo
|
||||
rocmPackages.rocm-smi
|
||||
nvtopPackages.amd
|
||||
clinfo
|
||||
ncurses
|
||||
kitty.terminfo
|
||||
nodejs_22
|
||||
uv
|
||||
openclaw
|
||||
(python3.withPackages (ps: with ps; [
|
||||
openai-whisper
|
||||
]))
|
||||
];
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
@@ -148,7 +154,7 @@
|
||||
# Enable the OpenSSH daemon
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [ 22 2424 ];
|
||||
ports = [ 2424 ];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
KbdInteractiveAuthentication = false;
|
||||
@@ -162,18 +168,6 @@
|
||||
];
|
||||
};
|
||||
|
||||
# services.ollama = {
|
||||
# enable = true;
|
||||
# acceleration = "rocm";
|
||||
# # Optional: force Ollama to use the MI50 target
|
||||
# rocmOverrideGfx = "9.0.6";
|
||||
# environmentVariables = {
|
||||
# ROCR_VISIBLE_DEVICES = "0,1";
|
||||
# # This helps with memory allocation on dual-GPU setups
|
||||
# HSA_ENABLE_SDMA = "0";
|
||||
# };
|
||||
# };
|
||||
|
||||
services.dockerStacks = {
|
||||
versioncontrol = {
|
||||
path = self + "/assets/compose/versioncontrol";
|
||||
@@ -204,6 +198,32 @@
|
||||
path = self + "/assets/compose/homeautomation";
|
||||
envFile = config.age.secrets.containers_env.path;
|
||||
};
|
||||
|
||||
authentification = {
|
||||
path = self + "/assets/compose/authentification";
|
||||
};
|
||||
|
||||
backup = {
|
||||
path = self + "/assets/compose/backup";
|
||||
envFile = config.age.secrets.containers_env.path;
|
||||
};
|
||||
|
||||
coms = {
|
||||
path = self + "/assets/compose/coms";
|
||||
envFile = config.age.secrets.containers_env.path;
|
||||
};
|
||||
|
||||
finance = {
|
||||
path = self + "/assets/compose/finance";
|
||||
};
|
||||
|
||||
homepage = {
|
||||
path = self + "/assets/compose/homepage";
|
||||
};
|
||||
|
||||
# tak = {
|
||||
# path = self + "/assets/compose/tak";
|
||||
# };
|
||||
};
|
||||
|
||||
services.opencode = {
|
||||
@@ -211,28 +231,7 @@
|
||||
port = 4099;
|
||||
ollamaUrl = "http://127.0.0.1:11434/v1";
|
||||
};
|
||||
|
||||
# services.systemd-fancon = {
|
||||
# enable = true;
|
||||
# config = ''
|
||||
# [MI50_Cooling]
|
||||
# # The lm96163 controller
|
||||
# hwmon = hwmon0
|
||||
|
||||
# # Most lm96163 chips use pwm1 for the main fan header
|
||||
# pwm = 1
|
||||
# pwm = 2
|
||||
|
||||
# # Watch both MI50 cards
|
||||
# sensor = hwmon3/temp1_input
|
||||
# sensor = hwmon4/temp1_input
|
||||
|
||||
# # Servers cards need air early!
|
||||
# # Starts spinning at 40C, full blast by 70C
|
||||
# curve = 40:60 55:160 70:255
|
||||
# '';
|
||||
# };
|
||||
|
||||
|
||||
# Private host ssh key managed by agenix
|
||||
age = {
|
||||
identityPaths = paths.identities;
|
||||
@@ -251,16 +250,43 @@
|
||||
mode = "0600";
|
||||
path = "/etc/ssh/ssh_host_ed25519_key";
|
||||
};
|
||||
n8n_ssh_key = {
|
||||
file = ../../secrets/n8n_ssh_key.age;
|
||||
ai_ssh_key = {
|
||||
file = ../../secrets/ai_ssh_key.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0600";
|
||||
path = "/home/n8n-worker/.ssh/n8n_ssh_key";
|
||||
path = "/home/ai-worker/.ssh/ai_ssh_key";
|
||||
};
|
||||
openclaw_gateway_token = {
|
||||
file = ../../secrets/openclaw_gateway_token.age;
|
||||
owner = "root";
|
||||
group = "ai-worker";
|
||||
mode = "0440";
|
||||
path = "/run/secrets/openclaw_gateway_token";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# OpenClaw Node service (host-side execution for Docker gateway)
|
||||
services.openclaw-node = {
|
||||
enable = true;
|
||||
user = "ai-worker";
|
||||
gatewayHost = "127.0.0.1";
|
||||
gatewayPort = 18789;
|
||||
gatewayTokenFile = "/run/secrets/openclaw_gateway_token";
|
||||
displayName = "lazyworkhorse-host";
|
||||
};
|
||||
|
||||
# Hyperspace Pods — P2P mesh AI cluster (combine GPUs across machines)
|
||||
services.hyperspace = {
|
||||
enable = true;
|
||||
user = "ai-worker";
|
||||
apiPort = 8080;
|
||||
profile = "auto";
|
||||
openFirewall = true;
|
||||
extraArgs = [ "--verbose" ];
|
||||
};
|
||||
|
||||
# Public host ssh key (kept in sync with the private one)
|
||||
environment.etc."ssh/ssh_host_ed25519_key.pub".text =
|
||||
"${keys.hosts.lazyworkhorse.main}";
|
||||
@@ -276,7 +302,6 @@
|
||||
enable32Bit = true; # Useful for some compatibility layers
|
||||
extraPackages = with pkgs; [
|
||||
rocmPackages.clr.icd # OpenCL/HIP runtime
|
||||
amdvlk # Vulkan drivers
|
||||
];
|
||||
};
|
||||
nixpkgs.config.rocmTargets = [ "gfx906" ];
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
gitea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN9tKezYidZglWBRI9/2I/cBGUUHj2dHY8rHXppYmf7F";
|
||||
};
|
||||
|
||||
n8n-worker = {
|
||||
ai-worker = {
|
||||
main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXeGtPPcsP2IYRQNvII41NVWhJsarEk8c4qxs/a5sXf";
|
||||
};
|
||||
};
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
{ pkgs, lib, config, ... }: {
|
||||
imports =
|
||||
[
|
||||
# ./home
|
||||
./nixos
|
||||
];
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
{ pkgs, lib, config, ... }: {
|
||||
imports =
|
||||
[
|
||||
./graphical-desktop.nix
|
||||
];
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
{ pkgs, lib, config, ... }: {
|
||||
imports =
|
||||
[
|
||||
./bundles
|
||||
# ./programs
|
||||
./services
|
||||
./filesystem
|
||||
];
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
{ pkgs, lib, config, ... }: {
|
||||
imports =
|
||||
[
|
||||
./hoardingcow-mount.nix
|
||||
];
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
{ pkgs, lib, config, ... }: {
|
||||
imports =
|
||||
[
|
||||
./systemd
|
||||
];
|
||||
}
|
||||
@@ -9,9 +9,15 @@ with lib;
|
||||
path = mkOption { type = types.str; };
|
||||
envFile = mkOption { type = types.nullOr types.path; default = null; };
|
||||
ports = mkOption { type = types.listOf types.int; default = [ ]; };
|
||||
# New option to pass raw systemd serviceConfig
|
||||
serviceConfig = mkOption {
|
||||
type = types.attrs;
|
||||
default = { };
|
||||
description = "Extra systemd serviceConfig options for this stack.";
|
||||
};
|
||||
};
|
||||
});
|
||||
default = {};
|
||||
default = { };
|
||||
};
|
||||
|
||||
config = {
|
||||
@@ -23,28 +29,29 @@ with lib;
|
||||
systemd.services = mapAttrs' (name: value: nameValuePair "${name}_stack" {
|
||||
description = "Docker Compose stack: ${name}";
|
||||
|
||||
# Added 'docker.socket' to both after and wants to ensure the API is reachable
|
||||
# Forces systemd to restart when the files change
|
||||
reloadTriggers = [
|
||||
"${builtins.hashFile "sha256" (toString value.path + "/compose.yml")}"
|
||||
] ++ (lib.optional (value.envFile != null) "${value.envFile}");
|
||||
|
||||
after = [ "network.target" "docker.service" "docker.socket" "agenix.service" ];
|
||||
wants = [ "docker.socket" "agenix.service" ];
|
||||
requires = [ "docker.service" ];
|
||||
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
path = with pkgs; [ git docker docker-compose bash ];
|
||||
|
||||
# We merge the base config with the custom 'serviceConfig' from the submodule
|
||||
serviceConfig = recursiveUpdate {
|
||||
Type = "oneshot";
|
||||
WorkingDirectory = value.path;
|
||||
User = "root";
|
||||
|
||||
# This line forces the service to wait until the docker socket is actually responsive
|
||||
ExecStartPre = "${pkgs.bash}/bin/bash -c 'while [ ! -S /var/run/docker.sock ]; do sleep 1; done'";
|
||||
|
||||
ExecStart = "${pkgs.docker-compose}/bin/docker-compose up -d --remove-orphans";
|
||||
ExecStop = "${pkgs.docker-compose}/bin/docker-compose down";
|
||||
RemainAfterExit = true;
|
||||
|
||||
# Ensure the environment file is passed correctly
|
||||
EnvironmentFile = mkIf (value.envFile != null) [ value.envFile ];
|
||||
};
|
||||
} value.serviceConfig;
|
||||
}) config.services.dockerStacks;
|
||||
};
|
||||
}
|
||||
|
||||
235
modules/nixos/services/hyperspace.nix
Normal file
235
modules/nixos/services/hyperspace.nix
Normal file
@@ -0,0 +1,235 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.hyperspace;
|
||||
|
||||
# Hyperspace CLI release from github.com/hyperspaceai/aios-cli
|
||||
# The binary bundles Node.js runtime + llama.cpp + sidecars (~914MB)
|
||||
# It auto-updates via `hyperspace update` post-install
|
||||
hyperspacePkg = pkgs.stdenv.mkDerivation rec {
|
||||
pname = "hyperspace";
|
||||
version = cfg.release;
|
||||
|
||||
src = pkgs.fetchurl {
|
||||
url = "https://github.com/hyperspaceai/aios-cli/releases/download/v${version}/aios-cli-x86_64-unknown-linux-gnu.tar.gz";
|
||||
hash = "sha256-f6fJ8t3exqtYwUD5j+WvD+Hm0oN/Eef0X+R9Rj23dE0=";
|
||||
};
|
||||
|
||||
sourceRoot = ".";
|
||||
|
||||
installPhase = ''
|
||||
mkdir -p $out/bin $out/lib/hyperspace
|
||||
|
||||
# Main CLI binary
|
||||
cp aios-cli $out/bin/hyperspace
|
||||
chmod +x $out/bin/hyperspace
|
||||
|
||||
# Sidecar binaries
|
||||
for f in _aios-cli pod-raft hyperspace-*; do
|
||||
[ -f "$f" ] && install -m755 "$f" $out/lib/hyperspace/ || true
|
||||
done
|
||||
|
||||
# WASM, native modules, Python shards
|
||||
cp -r *.wasm $out/lib/hyperspace/ 2>/dev/null || true
|
||||
cp -r *.node $out/lib/hyperspace/ 2>/dev/null || true
|
||||
mkdir -p $out/lib/hyperspace/python
|
||||
cp -r python/* $out/lib/hyperspace/python/ 2>/dev/null || true
|
||||
|
||||
# Skills directory
|
||||
mkdir -p $out/share/hyperspace
|
||||
cp -r skills $out/share/hyperspace/ 2>/dev/null || true
|
||||
|
||||
# Set HYPERSPACE_PATH so the binary finds sidecars
|
||||
wrapProgram $out/bin/hyperspace \
|
||||
--set HYPERSPACE_PATH "$out/lib/hyperspace" \
|
||||
--set HYPERSPACE_SKILLS_DIR "$out/share/hyperspace/skills"
|
||||
'';
|
||||
|
||||
nativeBuildInputs = with pkgs; [ makeWrapper ];
|
||||
|
||||
meta = {
|
||||
description = "Hyperspace CLI — P2P mesh AI inference network (Pods)";
|
||||
longDescription = ''
|
||||
Hyperspace Pods let multiple machines pool their GPUs into one private
|
||||
AI cluster. Install the CLI, create a pod, share an invite link — your
|
||||
machines form a P2P mesh and can run models split across all connected
|
||||
GPUs. Exposes an OpenAI-compatible API for use with Cursor, Claude Code,
|
||||
Aider, etc.
|
||||
'';
|
||||
homepage = "https://hyperspace.sh";
|
||||
sourceProvenance = with lib; [ sourceTypes.binaryNativeCode ];
|
||||
license = lib.licenses.unfree;
|
||||
platforms = [ "x86_64-linux" ];
|
||||
maintainers = [ ];
|
||||
};
|
||||
};
|
||||
|
||||
in {
|
||||
options.services.hyperspace = {
|
||||
enable = mkEnableOption "Hyperspace P2P AI agent (Pods)";
|
||||
|
||||
release = mkOption {
|
||||
type = types.str;
|
||||
default = "5.45.30";
|
||||
description = "Hyperspace CLI release version (from GitHub releases).";
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "ai-worker";
|
||||
description = "System user to run the Hyperspace agent.";
|
||||
};
|
||||
|
||||
apiPort = mkOption {
|
||||
type = types.port;
|
||||
default = 8080;
|
||||
description = "Port for the OpenAI-compatible API server.";
|
||||
};
|
||||
|
||||
autoStart = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "Auto-start the Hyperspace agent on boot.";
|
||||
};
|
||||
|
||||
openFirewall = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "Open firewall ports for P2P traffic (libp2p 4001, chain 30301, API).";
|
||||
};
|
||||
|
||||
profile = mkOption {
|
||||
type = types.enum [ "auto" "full" "inference" "embedding" "relay" "storage" ];
|
||||
default = "auto";
|
||||
description = ''
|
||||
Agent profile:
|
||||
- auto: auto-detect hardware
|
||||
- full: all 9 capabilities
|
||||
- inference: GPU inference only
|
||||
- embedding: CPU embedding only
|
||||
- relay: lightweight relay
|
||||
- storage: storage + memory
|
||||
'';
|
||||
};
|
||||
|
||||
extraArgs = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
description = "Extra arguments passed to `hyperspace start`.";
|
||||
};
|
||||
|
||||
dataDir = mkOption {
|
||||
type = types.str;
|
||||
default = "/var/lib/hyperspace";
|
||||
description = "Data directory for agent state (models, config, logs).";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# Ensure the service user exists
|
||||
users.users.${cfg.user} = {
|
||||
isSystemUser = true;
|
||||
group = cfg.user;
|
||||
home = "/home/${cfg.user}";
|
||||
createHome = true;
|
||||
shell = pkgs.bash;
|
||||
};
|
||||
users.groups.${cfg.user} = { };
|
||||
|
||||
# Install the hyperspace binary
|
||||
environment.systemPackages = [ hyperspacePkg ];
|
||||
|
||||
# Data directories
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${cfg.dataDir} 0755 ${cfg.user} ${cfg.user} -"
|
||||
"d ${cfg.dataDir}/models 0755 ${cfg.user} ${cfg.user} -"
|
||||
"d ${cfg.dataDir}/data 0755 ${cfg.user} ${cfg.user} -"
|
||||
];
|
||||
|
||||
# Systemd service: runs the Hyperspace agent as a system daemon
|
||||
systemd.services.hyperspace = {
|
||||
description = "Hyperspace P2P AI Agent — Pods mesh cluster";
|
||||
documentation = [ "https://hyperspace.sh" "https://github.com/hyperspaceai/aios-cli" ];
|
||||
after = [ "network-online.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
wantedBy = mkIf cfg.autoStart [ "multi-user.target" ];
|
||||
|
||||
environment = {
|
||||
HYPERSPACE_HOME = cfg.dataDir;
|
||||
HYPERSPACE_API_PORT = toString cfg.apiPort;
|
||||
HYPERSPACE_PATH = "${hyperspacePkg}/lib/hyperspace";
|
||||
};
|
||||
|
||||
path = with pkgs; [ bash curl nodejs ];
|
||||
|
||||
script = ''
|
||||
# Wait for network connectivity before starting
|
||||
${pkgs.bash}/bin/bash -c '
|
||||
for i in $(seq 1 30); do
|
||||
ping -c 1 -W 1 8.8.8.8 >/dev/null 2>&1 && break
|
||||
sleep 2
|
||||
done
|
||||
' || true
|
||||
|
||||
exec ${hyperspacePkg}/bin/hyperspace start \
|
||||
--profile ${cfg.profile} \
|
||||
--api-port ${toString cfg.apiPort} \
|
||||
${lib.escapeShellArgs cfg.extraArgs}
|
||||
'';
|
||||
|
||||
serviceConfig = {
|
||||
Type = "exec";
|
||||
User = cfg.user;
|
||||
Group = cfg.user;
|
||||
WorkingDirectory = cfg.dataDir;
|
||||
Restart = "always";
|
||||
RestartSec = 10;
|
||||
TimeoutStartSec = 180;
|
||||
TimeoutStopSec = 30;
|
||||
KillMode = "mixed";
|
||||
|
||||
# File limits for network-heavy P2P agent
|
||||
LimitNOFILE = 65536;
|
||||
LimitNPROC = 4096;
|
||||
|
||||
# GPU access — AMD MI50 (ROCm) through /dev/kfd and /dev/dri
|
||||
DeviceAllow = [
|
||||
"/dev/kfd" "rw"
|
||||
"/dev/dri" "rw"
|
||||
];
|
||||
SupplementaryGroups = [ "video" "render" ];
|
||||
|
||||
# Security hardening
|
||||
NoNewPrivileges = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
PrivateTmp = true;
|
||||
PrivateDevices = false; # needs GPU access
|
||||
ReadWritePaths = [
|
||||
cfg.dataDir
|
||||
"/tmp"
|
||||
];
|
||||
BindPaths = [
|
||||
# GPU devices for AMD MI50
|
||||
"/dev/kfd"
|
||||
"/dev/dri"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# Firewall: open P2P ports for the mesh network
|
||||
networking.firewall = mkIf cfg.openFirewall {
|
||||
allowedTCPPorts = [
|
||||
4001 # libp2p P2P (agent gossip, DHT, circuits)
|
||||
30301 # Chain P2P (blockchain consensus)
|
||||
cfg.apiPort # OpenAI-compatible API
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
4001 # libp2p QUIC transport
|
||||
30301 # Chain UDP discovery
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -14,8 +14,25 @@
|
||||
local base_model=$2
|
||||
if ! ${pkgs.docker}/bin/docker exec ollama ollama list | grep -q "$model_name"; then
|
||||
echo "$model_name not found, creating from $base_model..."
|
||||
|
||||
# We use a custom TEMPLATE block to strip the 'currentDate' function
|
||||
# which is unsupported in Ollama 0.5.7 but present in Devstral's default manifest.
|
||||
${pkgs.docker}/bin/docker exec ollama sh -c "cat <<EOF > /root/.ollama/$model_name.modelfile
|
||||
FROM $base_model
|
||||
TEMPLATE \"\"\"{{- if .System }}
|
||||
[SYSTEM_PROMPT]
|
||||
{{ .System }}
|
||||
[/SYSTEM_PROMPT]
|
||||
{{- end }}
|
||||
{{- range .Messages }}
|
||||
{{- if eq .Role \"user\" }}
|
||||
[INST]
|
||||
{{ .Content }}
|
||||
[/INST]
|
||||
{{- else if eq .Role \"assistant\" }}
|
||||
{{ .Content }}
|
||||
{{- end }}
|
||||
{{- end }}\"\"\"
|
||||
PARAMETER num_ctx 131072
|
||||
PARAMETER num_predict 4096
|
||||
PARAMETER num_keep 1024
|
||||
@@ -26,6 +43,7 @@ PARAMETER stop \"[/INST]\"
|
||||
PARAMETER stop \"</s>\"
|
||||
EOF"
|
||||
${pkgs.docker}/bin/docker exec ollama ollama create "$model_name" -f "/root/.ollama/$model_name.modelfile"
|
||||
${pkgs.docker}/bin/docker exec ollama rm "/root/.ollama/$model_name.modelfile"
|
||||
else
|
||||
echo "$model_name already exists, skipping."
|
||||
fi
|
||||
@@ -36,6 +54,10 @@ EOF"
|
||||
|
||||
# Create Devstral
|
||||
create_model_if_missing "devstral-small-2:24b-128k" "devstral-small-2:24b"
|
||||
|
||||
# create_model_if_missing "qwen2.5-coder:32b-128k" "qwen2.5-coder:32b"
|
||||
|
||||
# create_model_if_missing "mistral-large-planner:123b" "mistral-large:123b-instruct-v2407-q4_K_S"
|
||||
'';
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
|
||||
@@ -20,11 +20,7 @@ in {
|
||||
|
||||
environment.etc."opencode/opencode.json".text = builtins.toJSON {
|
||||
"$schema" = "https://opencode.ai/config.json";
|
||||
"model" = "devstral-2-small-llama_cpp";
|
||||
|
||||
# MCP servers for web search and enhanced functionality
|
||||
# context7: Remote HTTP server for up-to-date documentation and code examples
|
||||
# duckduckgo: Local MCP server for web search capabilities
|
||||
"model" = "nemotron-3-nano-llama_cpp";
|
||||
"mcp" = {
|
||||
"context7" = {
|
||||
"type" = "remote";
|
||||
@@ -46,6 +42,7 @@ in {
|
||||
"options" = {
|
||||
"baseURL" = "http://localhost:8300/v1";
|
||||
"apiKey" = "not-needed";
|
||||
"maxTokens" = 80000;
|
||||
};
|
||||
"models" = {
|
||||
"devstral-2-small-llama_cpp" = {
|
||||
@@ -53,6 +50,11 @@ in {
|
||||
"tools" = true;
|
||||
"reasoning" = false;
|
||||
};
|
||||
"nemotron-3-nano-llama_cpp" = {
|
||||
"name" = "Nemotron 3 nano 30B Q8 (llama.cpp)";
|
||||
"tools" = true;
|
||||
"reasoning" = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
"ollama" = {
|
||||
@@ -76,6 +78,7 @@ in {
|
||||
systemd.services.opencode-gsd-install = {
|
||||
description = "Install Get Shit Done OpenCode Components";
|
||||
after = [ "network-online.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
path = with pkgs; [
|
||||
nodejs
|
||||
@@ -131,7 +134,6 @@ in {
|
||||
|
||||
environment = {
|
||||
OLLAMA_BASE_URL = "http://127.0.0.1:11434";
|
||||
# Important: GSD at ~/.config/opencode, so we ensure the server sees our /etc config
|
||||
OPENCODE_CONFIG = "/etc/opencode/opencode.json";
|
||||
HOME = "/home/gortium";
|
||||
NODE_PATH = "${pkgs.nodejs}/lib/node_modules";
|
||||
|
||||
64
modules/nixos/services/openclaw_node.nix
Normal file
64
modules/nixos/services/openclaw_node.nix
Normal file
@@ -0,0 +1,64 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.openclaw-node;
|
||||
openclawPkg = pkgs.openclaw;
|
||||
in {
|
||||
options.services.openclaw-node = {
|
||||
enable = lib.mkEnableOption "OpenClaw Node service";
|
||||
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "ai-worker";
|
||||
description = "User to run the OpenClaw headless node as.";
|
||||
};
|
||||
|
||||
gatewayHost = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "127.0.0.1";
|
||||
description = "Gateway host (IP or hostname).";
|
||||
};
|
||||
|
||||
gatewayPort = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 18789;
|
||||
description = "Gateway WebSocket port.";
|
||||
};
|
||||
|
||||
gatewayTokenFile = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
description = "Path to file containing the gateway auth token.";
|
||||
};
|
||||
|
||||
displayName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "lazyworkhorse-host";
|
||||
description = "Display name for this node (shown in pairing).";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services.openclaw-node = {
|
||||
description = "OpenClaw Headless Node Service";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "exec";
|
||||
User = cfg.user;
|
||||
Group = cfg.user;
|
||||
WorkingDirectory = "/home/${cfg.user}";
|
||||
ExecStart = ''
|
||||
${pkgs.bash}/bin/bash -c 'export OPENCLAW_GATEWAY_TOKEN=$(cat ${cfg.gatewayTokenFile}) && exec ${openclawPkg}/bin/openclaw node run --host ${cfg.gatewayHost} --port ${toString cfg.gatewayPort} --display-name "${cfg.displayName}"'
|
||||
'';
|
||||
Restart = "always";
|
||||
RestartSec = 5;
|
||||
};
|
||||
|
||||
environment = {
|
||||
NODE_ENV = "production";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,24 +1,34 @@
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBGWmpW
|
||||
bFFuT1FNWVlsd0twcUJnYXV0T0Z3Q0RDZldsNTUwWlprQTJaK2xNCmMzS3g1OEdI
|
||||
bENzekRFTkIwbVRua2MzTVdnZmNKMnd6dzJjZEx5eXhBWmMKLT4gV2ktZ3JlYXNl
|
||||
IChaQl14QSB3IFlIcmkKVHZPSmZ2aXNaSHVUbi9UbUNTL00ycWRZbzVwTlFUUjls
|
||||
Z2RFSGMyM2ZDbkRlekxxemR4RTlLWnI3L0FlanpkYgpaaUlpSFdxZlo0Sk9XcXF3
|
||||
TnZQYzY1MWxLRklycWh3MEl2ZENSMk5yMDNKNWkyZmVBNTlSNWxBSzZ2RDNmeDRP
|
||||
CgotLS0gNEtpRlhJbkZXcGNpQzBFREhCempyYlFHcTRHSlpTOUZFeGxmNHk2c20x
|
||||
VQrxqxWUB/GZUQixOXxdZhfeUDyzbc7DZ4CMA8o0X0NHxxonsHQXvAwcHFYVBj45
|
||||
d7D9yjtHYP+EAR2skUEnlPYfUdFKtjyE4KRE/wv6VQXfjeIax0USypvuEg9e+cfA
|
||||
VknSLO4G+si8MvccJNZsBGGebEg8OpmSqSog6pee3jeVtr0fr5no0901rnwZYQEN
|
||||
X63i+8cp2ZnHCxuR6ol48rUB9AEieYiYvI8gCfATigvFkjj/fEYKLK/kgqLVl96p
|
||||
CjtXqhO0XGROPCvyVB8yadJCw67tMdkZO39saJTeHP6r0lz37lHNm8Uwyel89kLd
|
||||
CWqrIK67MH1ejXwhTfQlHSX3WQYAXfxq7fmetjcJb0NBXUBsPrAwlmz49T0TWvfa
|
||||
1oi60xLD+BsKR3KDgthid3GwhcrsY5RA8y8x8c4Ssk1iLKEIlyOM+f2cYJRvYMrS
|
||||
LfSs1cvIORLA8QcADELhzV7mVsBtXo8vU5oSoCWrvT0vs2H2EFvl4Qfx/8UGoVMK
|
||||
p3HFMw3Qwxh2Qyr6kD6SuRc1dzbseXiBtPuN76KOQNbo9LEu0JNwsoHqv7wdUS6u
|
||||
r831UKyTxWfl3oBUzldG2Ugka3/7wr3n2biARkADNjrvkFHo5BM6vYla583j6ml3
|
||||
/IzQOIQXSmgv+opza1oghf2jg9UFkMOPZ9iz6srg2xaH+xZ7+xnL3cuY4ngWwIqy
|
||||
pRKdcrNDOIawhEpJEAUYLHMcrCCekZPJalEcMZ26pXjVG1p9SYVsQWxkpVgOqEIH
|
||||
8Q4zYMYQAQssVSED3SrQ39giW7+UfGnoqsy9qTq1UvDBpnGDMk2JYsGZmQoWEvtJ
|
||||
AudwoHTFj/szABXE7qootqjGGhopdC0pFWGKaSFRre7iIeiYNJDXYi1lyAtDfZFW
|
||||
iv8avbywunozAigA8+wuF4Zw1GOThPAOLNU=
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBOL29w
|
||||
eGk1N2xxTHJtaUEvWWZmbkh1bk11Tjk3anNnMDB1cCtPYUMzdTNJCkdhQ08vblNG
|
||||
UlV1K2xVTGZVTzFWYXAzcjZaMWs0RTFWdStKSmlSTURvK1EKLT4gLC1zKU8zVkgt
|
||||
Z3JlYXNlIFUiXFcpS302IHByVn5jOy0gRDMKQjV3SHpDWUIybGFyQUg3ZlR0R2hV
|
||||
eWM3SFlCVW5mdlpBVUF3a0xpNlZCeGNUd1oxTTlkc1RkTXdZS0lFTmN3Ci0tLSA3
|
||||
VlBqM1VLWllZc0JnOTMvUFRjMU13OTdzMmhsdGJubkk5eGpERVVLYUk4Cnzh5UbU
|
||||
FlgqpM8jkJ6XlsaIDCw/G3D6uJ/GRJW4gIekuhAUxpZJrc8eOA8ZuHfGrBbH3acV
|
||||
tVafX5F0Kr2oOblqZ6gduZOUS52KmWH8stiBJM+e5ZZ7zRQVE4PJUKUPCzi+WdcH
|
||||
zr295T//FOdicrYHdsjfziKEHzBtUCFiATW05+O2zMjYjO6cPzePcCzPWinwiID6
|
||||
V+f6ngfkkQaj3wBGkzaieQJzRcdSwky21aVhGCCX/bvqx61iW2d5QAKxGbtQ2RcG
|
||||
X1okr+xunAM94nzDMv46vyN97KxY7cZd4pAaOxoICc2Tfhtw6F+iS6QkQh1odJzO
|
||||
7ZH+sSQCvndG+8z9shXGiHalASF5tdguM+JlEvAGljcaiAUtsQWxr9CoWiEkC6c6
|
||||
NCaECSYO8Il+SXBQnSZSGJSNDhuPYCYrsjXGSAONFixuyeslAkq9x2WUaUS4H063
|
||||
1QvRF7XO2tBPtgCLsSjdiGp0h+ImUaGdu6fDR7zrDsGsaAFCSFeH/rGNNXRQ2vP2
|
||||
CSfPfDDCqpUSCn0WuA30BtaPLxGmZT6OjFevKzYMNDmdeq9ia/q8K0hmjLUBdN3k
|
||||
tdYWbwoaf4gYbUWxSleD768b0Jgxss9Vod+sFQ+NYRksdGIeyND+aQIc312XehfA
|
||||
qHFBS8nlj7eUF5bdvCYQ64z741mH4cNlGxyjPBH1x8FHnEOocJXYt1l2AZSRJmJA
|
||||
c3z0QGXyuCbsrLBXWK1EKa/Juo4PGGsEVoLRhwJAQy9+i1JN0yrfRvSPyzvD4px6
|
||||
wRPzlZ80MQdb2lv84WS/zcOEZmZzlLntszTRRdIfAsuaavP2Rquh4rEXABYeTZwp
|
||||
5dem79s8bdW2nFsGMNz1OQKQwocyjYu1jJMHu6Gp7Ngdl1xyW7xfg0dezE1c0cIh
|
||||
xt1aLER9YJp4n5to5cOH16l3mjDHnAvABx38xE9loNL3399J/evw7LxpTYQ4v2Xv
|
||||
x8xnDHcqJ+deFSwyuUnMS5DkUeYuHmUl0Q2WYcfY+ibCmcgCb2ObTtuN1/ZxNYrL
|
||||
OKrnmfuSvBgyuIOj5e6uWW0+Zs8dHKXu2TgV8WignxOhl5zQgCpCBlqVfO0t+NCu
|
||||
Gi26hU/fhGWQ/1oQa3VkpGsypZbJpgQvfWxfcGHP/MMhnl01zzlP8/aexSY3pAxf
|
||||
fz9v0IVh6xxtu3zbiiVzUsXbfG7t+xY98jMphf4AS2mWva3GWVmhhu0lS3J3P+go
|
||||
YEEP4rOFHeU0Y1/6kLydTXvz4jMH0H92XQIzshd7vzQnEJPUPAzqRmw3LKYGgCI+
|
||||
wZEnxJ6ckqTkGBFnxTpy9LLllwmnz2Ky87nY3XAmqxlhb2Ap1XFAlfgszmGjc+Il
|
||||
KkIgoWQHTUm6QM9ta++oUTIDneOvxGd0zZsqoEhiC/7E01BNNZ6E58TeJU3fDlA3
|
||||
mX6n05XjwPRpgXZfayPoAgBlZc2H4KeiynxwNZ/dWu7qz7L6Ppk6Nvtly8giTbFx
|
||||
CA+tto7vq+D+CAEJ4bgyq4BCH4GL4APrhPcWp98Mko1WCiRTIKgkZxQCYvlg/LZq
|
||||
LNhMacP9T1qTvNC+yR1NEMiegE3APzk6CkDpVaO9+5f/sqifNPINCMothenI9ePw
|
||||
zjQLI3Mo1m73bkomytUZ7i1VstP5sEZ5LF72Sq7BpR3oQ3Gp0CAN9w==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
|
||||
11
secrets/openclaw_gateway_token.age
Normal file
11
secrets/openclaw_gateway_token.age
Normal file
@@ -0,0 +1,11 @@
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBCWEpO
|
||||
cG9yNnFpcHFqTkNzTngxU1MxN0NYK0hrZFhUTjVORWFrK3JNd2tZCmtMTGpwQk1E
|
||||
WlUwL3N6SGRWblpnNEkrWkkyU2hQMkRIK0M3R0pOVEREV3MKLT4gY2osLWdyZWFz
|
||||
ZSBacSozVVQgUCAxRS1OQSAuKXxDPCoKbStWNW1BZjBZQzNDaTlDbU5EZkxsRWxM
|
||||
cXJ3dDU1RDNpOXRlV0tzdEp2NUo3S1lhRG5Md0RHTGlJdkFSYmt5YQo4R1hiQWRG
|
||||
V2VxekJKZwotLS0geG1XSi9VbkhXZHQzcEFVS3hKNzVueXFLa2xnZTc3Q2tJTVZ5
|
||||
eXJabWk5Ywp6bJCP3s0xxzjE+eTR+cv7ZUnkoliT/n7uIprq1BTn/LIRLkUTUqs3
|
||||
NiDwrXcoq4/QKd0Dt+8ap3vFAuusjGxRlnYMaRrZie2AGtTV8U7Q7durm9o2K+/4
|
||||
QzRQ/MtumIQm
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
@@ -10,4 +10,5 @@ in
|
||||
"containers.env.age".publicKeys = authorizedKeys;
|
||||
"lazyworkhorse_host_ssh_key.age".publicKeys = authorizedKeys;
|
||||
"n8n_ssh_key.age".publicKeys = authorizedKeys;
|
||||
"openclaw_gateway_token.age".publicKeys = authorizedKeys;
|
||||
}
|
||||
|
||||
@@ -1,12 +1,14 @@
|
||||
{ pkgs, inputs, config, keys, ... }: {
|
||||
users.users.n8n-worker = {
|
||||
users.users.ai-worker = {
|
||||
isSystemUser = true;
|
||||
group = "n8n-worker";
|
||||
group = "ai-worker";
|
||||
home = "/home/ai-worker";
|
||||
createHome = true;
|
||||
extraGroups = [ "docker" ];
|
||||
shell = pkgs.bashInteractive;
|
||||
openssh.authorizedKeys.keys = [
|
||||
keys.users.n8n-worker.main
|
||||
keys.users.ai-worker.main
|
||||
];
|
||||
};
|
||||
users.groups.n8n-worker = {};
|
||||
users.groups.ai-worker = {};
|
||||
}
|
||||
Reference in New Issue
Block a user