- Add NFSv4 ID mapping configuration using services.nfs.idmapd.settings
- Configure consistent domain 'home.lab' for ID mapping across all machines
- Update sleeper-service NFS server with proper security (root_squash, all_squash)
- Create reusable NFS client module (modules/services/nfs-client.nix)
- Deploy NFS client configuration to grey-area and congenital-optimist
- Maintain consistent media group GID (993) across all machines
- Support both local (10.0.0.0/24) and Tailscale (100.64.0.0/10) networks
- Test and verify NFS connectivity and ID mapping functionality
Resolves permission management issues and enables secure file sharing
across the home lab infrastructure.
- Remove /mnt/storage/media from systemd.tmpfiles.rules (it's a ZFS dataset mount point)
- Add ExecStartPost to set proper permissions on ZFS-mounted media directory
- Update NFS research documentation with ZFS integration best practices
- Add section explaining ZFS mount point vs tmpfiles.rules conflicts
This resolves the potential conflict where tmpfiles tries to create a directory
that ZFS wants to use as a mount point for the storage/media dataset.
- Create shared media-group.nix module with fixed GID (993)
- Add both geir and sma users to media group for shared NFS access
- Update NFS server configuration to use root:media ownership with 0775 permissions
- Convert all media services to use media group instead of users group:
- Jellyfin, Calibre-web, Audiobookshelf, Transmission
- Enable group write access to all NFS shares (/mnt/storage/*)
- Maintain security with root ownership while allowing group collaboration
This resolves NFS permission issues by providing consistent group-based access
control across all media services and storage directories.
- Port 1337 appears to be blocked by VPS provider
- Port 2222 is more commonly allowed for SSH services
- Update both reverse-proxy and Forgejo configurations
- This should resolve the SSH timeout issues
- Consolidated 25+ common CLI tools into modules/common/base.nix
- Added modern rust-based tools (eza, bat, ripgrep, etc.) system-wide
- Removed duplicated packages from user and machine configs
- Added consistent shell aliases for modern CLI tools
- Fixed gpa alias to properly push to all remotes
- Removed duplicate git-push-all alias from geir.nix
- Added comprehensive documentation in CLI_TOOLS_CONSOLIDATION.md
Benefits:
- Single source of truth for common CLI tools
- Reduced duplication across 7+ configuration files
- Improved git workflow with flexible multi-remote pushing
- Better maintainability and consistency
- Add nixos_logo.svg to assets/ directory with optimized viewBox
- Integrate logo into README header with centered layout
- Add inline logos in Technology Stack and Configuration Philosophy sections
- Include footer logo for consistent branding
- Enhance visual identity and professional presentation
The logo uses SVG format for crisp display at all resolutions and
includes gradient styling consistent with NixOS branding.
- Add congenital-optimist as local deployment target
- Use direct nixos-rebuild for local deployment (no SSH)
- Update all machine arrays and help text to include 4th machine
- Optimize deployment handling for local vs remote machines
- Add update_all_machines function to deploy to all remote machines
- Support all deployment modes: boot, test, switch
- Provide detailed progress feedback and error reporting
- Update help text with new command and examples
Usage: lab update [mode]
Example: lab update switch # Update all machines immediately
- Update Forgejo service configuration on grey-area
- Refine reverse-proxy network configuration
- Add README_new.md with enhanced documentation structure
- Update instruction.md with latest workflow guidelines
- Enhance plan.md with additional deployment considerations
- Complete PR template restructuring for professional tone
These changes improve service reliability and documentation clarity
while maintaining infrastructure consistency across all machines.
- Add git commit message template with comprehensive guidelines
- Update PR template to remove emojis and casual language
- Rewrite README.md with professional, technical approach
- Update BRANCHING_STRATEGY.md to match new tone
- Backup original README as README_old.md
Templates now align with infrastructure documentation standards
and provide clear guidance for contributions.
- Phase 4: Restructured to use GNU Stow for regular dotfiles + literate programming for Emacs only
- Added comprehensive package structure for Stow deployment
- Elevated deploy-rs migration to high priority with detailed configuration examples
- Updated status to reflect 4/4 machines fully operational with complete service stack
- Added recent critical issue resolution documentation
- Updated next phase priorities to reflect new dotfiles approach
- Create modules/network/extraHosts.nix with Tailscale IP mappings
- Replace hardcoded networking.extraHosts in all machine configs
- Add extraHosts module import to all machines
- Enable Tailscale service by default in the module
- Use Tailscale mesh network IPs for reliable connectivity
- Remove duplicate sma user definition from incus.nix module
- The sma user is properly defined in modules/users/sma.nix with incus-admin group
- This resolves the isNormalUser/isSystemUser assertion failure blocking congenital-optimist rebuild
- Clean up grey-area configuration and modularize services
- Update SSH keys with correct IP addresses for grey-area and reverse-proxy
- Add nginx stream configuration on reverse-proxy to forward port 2222 to apps:22
- Update firewall rules to allow port 2222 for Git SSH access
- Configure Forgejo to use SSH_PORT = 2222 for Git operations
- Add comprehensive SSH forwarding research documentation
- Enable Git operations via git@git.geokkjer.eu:2222
Phase 1 implementation using nginx stream module complete.
Ready for testing and potential Phase 2 migration to HAProxy.
- Removed system/ directory, merged applications into users/geir.nix
- Simplified fonts.nix to bare minimum (users can add more)
- Moved transmission.nix to sleeper-service/services/ (machine-specific)
- Organized grey-area services into services/ directory
- Updated import paths and tested all configurations
- Added research documentation for deploy-rs and GNU Stow
- Move network-congenital-optimist.nix to machines/congenital-optimist/
- Move network-sleeper-service.nix to machines/sleeper-service/
- Update import paths in machine configurations
- Clean up modules/network/common.nix to remove SSH duplication
- Consolidate SSH configuration in modules/security/ssh-keys.nix
- Remove machine-specific networking from shared common module
This improves dependency tracking by co-locating machine-specific
network configurations with their respective machines.
- Add comprehensive documentation for home-lab-tools package
- Document lab command capabilities and usage examples
- Record technical implementation details and benefits
- Include deployment workflow and infrastructure integration
- Add to deployment status & accomplishments section
- Document conflict resolution and system integration process
- Replace ext4 with ZFS pool 'filepool' for enhanced data integrity
- Add ZFS auto-scrub and TRIM services for file server
- Configure proper ZFS datasets: root, nix, var, storage
- Add networking hostId (a1b2c3d4) required for ZFS
- Update NFS and Transmission to use ZFS mount points
- Change file ownership to 'sma' user for server configuration
- Add comprehensive ZFS setup documentation
Ready for deployment with proper file server storage backend.
- Remove geir user module from sleeper-service configuration
- Servers should only use sma user to avoid pulling desktop packages
- Update instruction.md with user configuration strategy:
- Desktop machines: geir user (includes desktop packages)
- Server machines: sma user ONLY (minimal server config)
- This prevents servers from importing browsers and GUI applications
This change reduces server footprint and follows separation of concerns
between desktop workstations and headless servers.
- Disable Transmission service due to compilation errors in unstable
- Keep download directory creation for future re-enablement
- Remove Transmission firewall port (9091) from sleeper-service
- Focus on deploying NFS server functionality first
This allows sleeper-service deployment to proceed with NFS services
while Transmission package issues are resolved upstream.
- Create reverse-proxy machine configuration for VPS edge server
- Configure SSH access only via Tailscale (100.96.189.104)
- Implement strict DMZ firewall rules (HTTP/HTTPS only externally)
- Add enhanced fail2ban settings for DMZ environment
- Include sma user with SSH key management
- Configure Nginx reverse proxy with Let's Encrypt SSL
- Add reverse-proxy to flake.nix nixosConfigurations
Security features:
- SSH only accessible through Tailscale interface
- Aggressive fail2ban settings (24h ban, 3 max retries)
- Firewall rejects all non-essential traffic
- No common network config to avoid security conflicts
- Create reverse-proxy machine configuration for VPS edge server
- Configure SSH access only via Tailscale (100.96.189.104)
- Implement strict DMZ firewall rules (HTTP/HTTPS only externally)
- Add enhanced fail2ban settings for DMZ environment
- Include sma user with SSH key management
- Configure Nginx reverse proxy with Let's Encrypt SSL
- Add reverse-proxy to flake.nix nixosConfigurations
Security features:
- SSH only accessible through Tailscale interface
- Aggressive fail2ban settings (24h ban, 3 max retries)
- Firewall rejects all non-essential traffic
- No common network config to avoid security conflicts
- Fixed networking defaultGateway interface specification for sleeper-service
- Resolved shell alias conflict between geir and sma users
- Changed sma aliases from 'lab' to 'homelab' to avoid conflict
- Created modules/services/nfs.nix for network file sharing
- Updated sleeper-service configuration with NFS and Transmission
- Fixed SSH key management to use direct key configuration
- Updated hardware-configuration to use sleeper-service hostname
- Added firewall ports for Transmission RPC (9091)
- Add modules/security/ssh-keys.nix for centralized SSH key management
- Generate role-specific SSH keys with geir@geokkjer.eu email:
- Admin key (geir@geokkjer.eu-admin) for sma user server access
- Development key (geir@geokkjer.eu-dev) for geir user and git services
- Update SSH client config with role-based host patterns
- Configure users/geir.nix and users/sma.nix with appropriate key access
- Add SSH key setup to both machine configurations
- Create scripts/setup-ssh-keys.sh for key generation automation
- Update plan.md with completed SSH security implementation
Security benefits:
- Principle of least privilege (separate admin vs dev access)
- Limited blast radius if keys are compromised
- Clear usage patterns: ssh admin-sleeper vs ssh geir@sleeper-service.home
- Maintains compatibility with existing services during transition
