nixpkgs' alertmanager uses DynamicUser, so the `alertmanager` user only
exists while the service is running. The matrix-alertmanager-urlfile
secret is owned by that user; at boot sops-install-secrets cannot resolve
it and rejects the whole manifest, leaving /run/secrets empty (no ssh
host key, yggdrasil key, tor key, ...). Deploys masked it because the
dynamic user was resolvable via nss-systemd at switch time.
Create a static alertmanager user/group and disable DynamicUser.
Building the frappix hosts on nixos-unstable 3ec6363 fails in frappix's
python overlay:
- sql_metadata 2.12.0 pins sqlparse<0.6, nixpkgs ships 0.6.0. frappe
itself needs 0.6 (MAX_GROUPING_TOKENS), and sql_metadata 3.x needs
sqlglot >= 30 which nixpkgs lacks, so relax the pin. frappe only feeds it
SELECT statements; the only regressions on 0.6 are CREATE TABLE IF NOT
EXISTS name extraction.
- rq 1.16.2 test_parse_connection fails against redis-py 8.1 (extra
himport_registry kwarg). Test-only; disable it.
nix flake check does not catch these: it only evaluates hosts.
nixos-unstable dropped nixVersions.nix_2_31, which clan-core still pins
for clan-cli (pkgs/clan-cli/flake-module.nix); override it to pkgs.nix in
the devshell.
nixpkgs#575004 bumped mcp 1.29 -> 2.2 and marked python3Packages.posthog
broken; only one optional MCP test fails. frappe needs posthog at runtime.
Skip that test and clear meta.broken until the upstream unbreak lands;
the overlay warns at eval time once it does.
Temporary overlay until the PR reaches nixpkgs-unstable. Fixes
CVE-2026-109618 and CVE-2026-109619. Becomes a no-op and warns at eval
time once the locked nixpkgs ships these versions; delete it then.
Fixes devShell build on nixpkgs 5adc508: makeWrapper no longer word-splits
makeWrapperArgs, so clan-cli's "--unset LD_LIBRARY_PATH" single-string
args failed with "makeWrapper doesn't understand the arg". Upstream
clan-core main splits the tokens.
nixpkgs' services/printing/ipp-usb.nix still sets the obsolete
services.avahi.publish.{enable,userServices}, warning on every machine
that enables ipp-usb. Disable the upstream module and carry a copy that
uses services.avahi.settings.publish; only that block differs.
hunspellWithDicts -> hunspell.withDicts; pin programs.firefox.configPath
to the legacy .mozilla/firefox so the profile stays put when stateVersion
crosses 26.05.
nixpkgs removed services.nextcloud.config.{adminuser,adminpassFile} and
now installs with --disable-admin-user. Add a nextcloud-admin-user oneshot
that creates the admin account from the vars secret after nextcloud-setup.
ygg.jjolly.dev:3443 has been offline 21 weeks and
[2602:fc24:18:7a42::1]:993 is unreachable (dropped from the public
peer list); every node was retrying both. Add measured-reachable
peers near the Asian (SG/JP/HK) and US nodes so tree parents are no
longer forced through two US-Midwest relays.
kurogeek