All data-mesher-node-identity certs were signed on 2026-07-22 with the
default 90-day validity and expired on 2026-10-20, taking the whole mesh
down ("identity certificate not signed by network certificate authority"
is actually an expiry failure). Nothing rotates them automatically.
Requires `clan vars generate --generator data-mesher-node-identity
--regenerate` and a redeploy to take effect.
The sops vars backend deploys generator files at
/run/secrets/vars/per-machine/<machine>/<generator>/<file>; the hard-coded
rsh still pointed at /run/secrets/vars/borgbackup/borgbackup.ssh, so
borgbackup-job-alex could not find its key. Align with alasia's entry.
nixpkgs' alertmanager uses DynamicUser, so the `alertmanager` user only
exists while the service is running. The matrix-alertmanager-urlfile
secret is owned by that user; at boot sops-install-secrets cannot resolve
it and rejects the whole manifest, leaving /run/secrets empty (no ssh
host key, yggdrasil key, tor key, ...). Deploys masked it because the
dynamic user was resolvable via nss-systemd at switch time.
Create a static alertmanager user/group and disable DynamicUser.
Building the frappix hosts on nixos-unstable 3ec6363 fails in frappix's
python overlay:
- sql_metadata 2.12.0 pins sqlparse<0.6, nixpkgs ships 0.6.0. frappe
itself needs 0.6 (MAX_GROUPING_TOKENS), and sql_metadata 3.x needs
sqlglot >= 30 which nixpkgs lacks, so relax the pin. frappe only feeds it
SELECT statements; the only regressions on 0.6 are CREATE TABLE IF NOT
EXISTS name extraction.
- rq 1.16.2 test_parse_connection fails against redis-py 8.1 (extra
himport_registry kwarg). Test-only; disable it.
nix flake check does not catch these: it only evaluates hosts.
nixos-unstable dropped nixVersions.nix_2_31, which clan-core still pins
for clan-cli (pkgs/clan-cli/flake-module.nix); override it to pkgs.nix in
the devshell.
nixpkgs#575004 bumped mcp 1.29 -> 2.2 and marked python3Packages.posthog
broken; only one optional MCP test fails. frappe needs posthog at runtime.
Skip that test and clear meta.broken until the upstream unbreak lands;
the overlay warns at eval time once it does.
Temporary overlay until the PR reaches nixpkgs-unstable. Fixes
CVE-2026-109618 and CVE-2026-109619. Becomes a no-op and warns at eval
time once the locked nixpkgs ships these versions; delete it then.
Fixes devShell build on nixpkgs 5adc508: makeWrapper no longer word-splits
makeWrapperArgs, so clan-cli's "--unset LD_LIBRARY_PATH" single-string
args failed with "makeWrapper doesn't understand the arg". Upstream
clan-core main splits the tokens.
nixpkgs' services/printing/ipp-usb.nix still sets the obsolete
services.avahi.publish.{enable,userServices}, warning on every machine
that enables ipp-usb. Disable the upstream module and carry a copy that
uses services.avahi.settings.publish; only that block differs.
hunspellWithDicts -> hunspell.withDicts; pin programs.firefox.configPath
to the legacy .mozilla/firefox so the profile stays put when stateVersion
crosses 26.05.
nixpkgs removed services.nextcloud.config.{adminuser,adminpassFile} and
now installs with --disable-admin-user. Add a nextcloud-admin-user oneshot
that creates the admin account from the vars secret after nextcloud-setup.
kurogeek