brigid #72

Merged

lament merged 5 commits from brigid into main 2026-07-09 20:37:01 -05:00

Conversation 0 Commits 5 Files changed 22 +176 -58

lament commented 2026-07-09 18:12:09 -05:00

Owner

Copy link

• new brigid box - Proxmox virtio VM, uefi-plain layout, roles builder + impermanent
  • takes the builder role off ishtar, so the remote builder + forgejo runner now live here instead
  • directory entry with its wg/ssh keys, overlay ::51; keys seeded into sops/privkeys.yaml
  • no borg subuser - it's stateless, nothing to back up
• roles restructured from a flat bag into nested groups
  • edge.{vpn,web,mail} and dns.{authority,resolver} replace the flat wgHub/mailserver/knot/resolver
  • roleHost takes a role path now (roleHost [ "edge" "mail" ]), walks it with attrByPath
  • new roleModulesFor helper maps each role to the modules it pulls in (dns.authority -> knot, edge.web -> caddy, builder -> forgejo-runner, ...)
    • host configs stop hand-listing caddy/knot/kresd/mailserver/forgejo-runner - they fall out of the declared roles now
    • athena/ishtar activeModules slim down to just their genuinely host-specific bits ++ roleModulesFor
• disko configs keyed by layout, not hostname
  • athena.nix/ishtar.nix/minerva.nix -> bios-linode.nix/uefi-lvm.nix/uefi-plain.nix, each a reusable template
  • new modules.disko.layout enum picks one per host; minerva + brigid share uefi-plain
  • module.nix selects on the option instead of config.networking.hostName
• buildMachines derives the builder from the builder role via roleHost instead of hardcoding ishtar - every host offloads to it except the builder itself
• hardware: linodeBase -> linodeGuest, hoisted the virtio bits (linuxPackages + virtio_net) up into virtualGuest so every qemu guest inherits them
• borg: subuser is nullOr/default null now - stateless hosts (the runner/builder) leave it unset and get no job at all, instead of half-declaring dead sops secrets
• left for later:
  • sub4 borg creds are seeded in sops/borg.yaml but unwired - there if brigid ever grows state worth keeping
  • the brigid VM still needs its actual install/enroll; uefi-plain's /dev/vda wants confirming on the box

- new `brigid` box - Proxmox virtio VM, `uefi-plain` layout, roles `builder` + `impermanent` - takes the `builder` role off `ishtar`, so the remote builder + forgejo runner now live here instead - directory entry with its wg/ssh keys, overlay `::51`; keys seeded into `sops/privkeys.yaml` - no borg subuser - it's stateless, nothing to back up - roles restructured from a flat bag into nested groups - `edge.{vpn,web,mail}` and `dns.{authority,resolver}` replace the flat `wgHub`/`mailserver`/`knot`/`resolver` - `roleHost` takes a role *path* now (`roleHost [ "edge" "mail" ]`), walks it with `attrByPath` - new `roleModulesFor` helper maps each role to the modules it pulls in (`dns.authority -> knot`, `edge.web -> caddy`, `builder -> forgejo-runner`, ...) - host configs stop hand-listing `caddy`/`knot`/`kresd`/`mailserver`/`forgejo-runner` - they fall out of the declared roles now - `athena`/`ishtar` `activeModules` slim down to just their genuinely host-specific bits `++ roleModulesFor` - disko configs keyed by *layout*, not hostname - `athena.nix`/`ishtar.nix`/`minerva.nix` -> `bios-linode.nix`/`uefi-lvm.nix`/`uefi-plain.nix`, each a reusable template - new `modules.disko.layout` enum picks one per host; `minerva` + `brigid` share `uefi-plain` - `module.nix` selects on the option instead of `config.networking.hostName` - `buildMachines` derives the builder from the `builder` role via `roleHost` instead of hardcoding `ishtar` - every host offloads to it except the builder itself - hardware: `linodeBase` -> `linodeGuest`, hoisted the virtio bits (`linuxPackages` + `virtio_net`) up into `virtualGuest` so every qemu guest inherits them - borg: `subuser` is `nullOr`/`default null` now - stateless hosts (the runner/builder) leave it unset and get no job at all, instead of half-declaring dead sops secrets - left for later: - `sub4` borg creds are seeded in `sops/borg.yaml` but unwired - there if brigid ever grows state worth keeping - the `brigid` VM still needs its actual install/enroll; `uefi-plain`'s `/dev/vda` wants confirming on the box

lament added 3 commits 2026-07-09 18:12:09 -05:00

further modularization, and brigid's start 257d1f53b7

moved builder and runner 625567e928

moved some virtualGuest options 4a3a4ad0f9

lament force-pushed brigid from 4a3a4ad0f9 to 5955581516 2026-07-09 19:51:32 -05:00 Compare

lament added 2 commits 2026-07-09 20:18:20 -05:00

removed limits on runner 2b3dd64ee8

emergency: lsfg-vk hash updated 8d5c242042

lament merged commit 6e29576a7f into main 2026-07-09 20:37:01 -05:00

lament deleted branch brigid 2026-07-09 20:37:01 -05:00

lament referenced this pull request from a commit 2026-07-09 20:37:01 -05:00

brigid (#72)

lament referenced this pull request 2026-07-09 21:16:16 -05:00

new deploy pipeline #74

lament referenced this pull request from a commit 2026-07-09 21:55:05 -05:00

new deploy pipeline (#74)

lament added the

fleet

label 2026-07-24 23:16:42 -05:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

chore

lockfile bumps, CI, reorg, docs, formatting

  

desktop

niri, theming, browser, WM/terminal, gaming

  

dropped

This is a dropped feature

  

fix

This fixes a problem

  

fleet

This is a fleet issue

  

networking

WG, DNS/kresd, NAT, firewall, site-mesh

  

security

auth, identity, secrets, hardening

  

service

new or changed app services

No labels

chore

desktop

dropped

fix

fleet

networking

security

service

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference

lament/pantheon!72

No description provided.