hestia joins the fleet; pihole gives way to a network reporter #98

Merged

lament merged 7 commits from hestia-init into main 2026-07-19 17:10:47 -05:00

Conversation 0 Commits 7 Files changed 19 +955 -59

lament commented 2026-07-18 18:09:37 -05:00

Owner

Copy link

• hestia added - home-LAN laptop (HP Envy x360), a fleet member but not a fleet service

  • lanzaboote secure boot (the trust marker for physically-held hosts), impermanent tmpfs / like the rest of the fleet, nixpkgs-small
  • wifi to start (wlan0, static .5) - the router's ethernet ports are all spoken for; eth0 left on DHCP as a rescue path so a bad wireless state is still reachable
  • new uefi-laptop disko layout; resolves through athena's kresd over WG like the other spokes

• built as a pihole appliance, then parked - pihole-ftl + a local unbound recursor, dashboard VPN-only via the edge

  • the home router won't advertise a custom DNS server to LAN clients (Spectrum ignores the field), so the whole point - LAN-wide resolution/adblock - is dead until the hardware changes
  • module kept but unplaced: directory.services.pihole dropped, so no host runs it and no vhost generates - re-wiring is a one-line registry edit when a real router lands

• repurposed as a network reporter - what a box actually on the home LAN earns its keep doing

  • static/hestia/reporter.nix: blackbox exporter (icmp + http, WG-bound) probing the gateway/WAN/*.lament.gay from inside the house - the vantage minerva can't see from a friend's network
  • librespeed throughput every 30 min via a speedtest oneshot -> node-exporter textfile collector, so it rides the existing scrape with no new port
  • grafana.nix: blackbox-icmp + blackbox-http scrape jobs on minerva's prometheus, http targets derived from directory.services

• just newhost <host> - mints a host's ssh/wg/age identity into sops/privkeys/<host>.yaml and prints the pubkeys + .sops.yaml blocks to paste

  • age identity generated standalone, not ssh-to-age-derived - an ssh host key leak must not also surrender the host's secrets
  • additive only: refuses to clobber an existing identity; copies the shared builderKey from a donor host
  • devshell gains ssh-to-age + wireguard-tools (the ceremony needs them); ceremony/06-enroll-pki.sh walks the lanzaboote PKI enrollment for a fresh box (untracked - ceremony/ is gitignored)

• hestia enrolled in the fleet secrets - added as a recipient on pass, borg/sub4, pki/db, and its own privkeys/hestia

  • no borg subuser: a stateless probe has nothing worth backing up

• cuda binary cache - cuda-maintainers.cachix.org substituter added, fleet-wide via core (consumed by ishtar + the builder)

• CLAUDE.md now tracked in-repo, drift corrected against the current fleet and layout

• left for later: re-enable pihole when the LAN can actually be pointed at it (a directory.services re-add); the speedtest probe loses the DNS race on its first run at boot before WG/kresd is up - self-corrects next tick, could be ordered on the tunnel if it nags

- `hestia` added - home-LAN laptop (HP Envy x360), a fleet member but not a fleet service - `lanzaboote` secure boot (the trust marker for physically-held hosts), impermanent tmpfs `/` like the rest of the fleet, `nixpkgs-small` - wifi to start (`wlan0`, static `.5`) - the router's ethernet ports are all spoken for; `eth0` left on DHCP as a rescue path so a bad wireless state is still reachable - new `uefi-laptop` disko layout; resolves through `athena`'s `kresd` over WG like the other spokes - built as a pihole appliance, then parked - `pihole-ftl` + a local `unbound` recursor, dashboard VPN-only via the edge - the home router won't advertise a custom DNS server to LAN clients (Spectrum ignores the field), so the whole point - LAN-wide resolution/adblock - is dead until the hardware changes - module kept but unplaced: `directory.services.pihole` dropped, so no host runs it and no vhost generates - re-wiring is a one-line registry edit when a real router lands - repurposed as a network reporter - what a box actually on the home LAN earns its keep doing - `static/hestia/reporter.nix`: `blackbox` exporter (icmp + http, WG-bound) probing the gateway/WAN/`*.lament.gay` from inside the house - the vantage `minerva` can't see from a friend's network - librespeed throughput every 30 min via a `speedtest` oneshot -> node-exporter textfile collector, so it rides the existing scrape with no new port - `grafana.nix`: `blackbox-icmp` + `blackbox-http` scrape jobs on `minerva`'s prometheus, http targets derived from `directory.services` - `just newhost <host>` - mints a host's ssh/wg/age identity into `sops/privkeys/<host>.yaml` and prints the pubkeys + `.sops.yaml` blocks to paste - age identity generated standalone, not `ssh-to-age`-derived - an ssh host key leak must not also surrender the host's secrets - additive only: refuses to clobber an existing identity; copies the shared `builderKey` from a donor host - devshell gains `ssh-to-age` + `wireguard-tools` (the ceremony needs them); `ceremony/06-enroll-pki.sh` walks the lanzaboote PKI enrollment for a fresh box (untracked - `ceremony/` is gitignored) - `hestia` enrolled in the fleet secrets - added as a recipient on `pass`, `borg/sub4`, `pki/db`, and its own `privkeys/hestia` - no `borg` subuser: a stateless probe has nothing worth backing up - cuda binary cache - `cuda-maintainers.cachix.org` substituter added, fleet-wide via `core` (consumed by `ishtar` + the `builder`) - `CLAUDE.md` now tracked in-repo, drift corrected against the current fleet and layout - left for later: re-enable pihole when the LAN can actually be pointed at it (a `directory.services` re-add); the speedtest probe loses the DNS race on its first run at boot before WG/`kresd` is up - self-corrects next tick, could be ordered on the tunnel if it nags

lament added 2 commits 2026-07-18 18:09:37 -05:00

docs: track CLAUDE.md and correct accumulated drift cf034613d5

created hestia 5cd77aef18

lament added 1 commit 2026-07-18 20:18:03 -05:00

hestia over wifi 3696d6b985

lament force-pushed hestia-init from 3696d6b985 to c60784f12d 2026-07-18 22:00:56 -05:00 Compare

lament force-pushed hestia-init from c60784f12d to cc108dce25 2026-07-18 22:03:29 -05:00 Compare

lament added 3 commits 2026-07-19 16:36:16 -05:00

eth0 rescue ea8faddfe1

pihole listens on v6 40a48303d2

spectrum router doesn't listen to DNS settings dc8d31008d

lament added 1 commit 2026-07-19 16:44:31 -05:00

speedtest failure 45f238b94a

lament changed title from hestia joins the fleet, an actual pihole this time to hestia joins the fleet; pihole gives way to a network reporter 2026-07-19 17:09:41 -05:00

lament merged commit 45f238b94a into main 2026-07-19 17:10:47 -05:00

lament deleted branch hestia-init 2026-07-19 17:10:47 -05:00

lament added the

fleet

networking

labels 2026-07-24 23:17:12 -05:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

chore

lockfile bumps, CI, reorg, docs, formatting

  

desktop

niri, theming, browser, WM/terminal, gaming

  

dropped

This is a dropped feature

  

fix

This fixes a problem

  

fleet

This is a fleet issue

  

networking

WG, DNS/kresd, NAT, firewall, site-mesh

  

security

auth, identity, secrets, hardening

  

service

new or changed app services

No labels

chore

desktop

dropped

fix

fleet

networking

security

service

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference

lament/pantheon!98

No description provided.