nixpkgs' alertmanager uses DynamicUser, so the `alertmanager` user only
exists while the service is running. The matrix-alertmanager-urlfile
secret is owned by that user; at boot sops-install-secrets cannot resolve
it and rejects the whole manifest, leaving /run/secrets empty (no ssh
host key, yggdrasil key, tor key, ...). Deploys masked it because the
dynamic user was resolvable via nss-systemd at switch time.
Create a static alertmanager user/group and disable DynamicUser.
nixpkgs' services/printing/ipp-usb.nix still sets the obsolete
services.avahi.publish.{enable,userServices}, warning on every machine
that enables ipp-usb. Disable the upstream module and carry a copy that
uses services.avahi.settings.publish; only that block differs.
hunspellWithDicts -> hunspell.withDicts; pin programs.firefox.configPath
to the legacy .mozilla/firefox so the profile stays put when stateVersion
crosses 26.05.
nixpkgs removed services.nextcloud.config.{adminuser,adminpassFile} and
now installs with --disable-admin-user. Add a nextcloud-admin-user oneshot
that creates the admin account from the vars secret after nextcloud-setup.
dhcp-leasefile=/dev/null logs 'failed to write /dev/null: Invalid argument'
every lease; leasefile-ro is the supported way to run without a lease file.
mirach and almach have each hung at least twice since July with nothing in
the journal or pstore, and stayed down until someone power-cycled the board.
RuntimeWatchdogSec was 0 and kernel.panic was 0, so a hung kernel/PID1 or a
panic could never self-recover.
Arm the systemd hardware watchdog (30s) and reboot 10s after a panic on all
phonebox nodes. Watchdog resets will show up as extra entries in
journalctl --list-boots.
WordPress writes into wp-content/upgrade-temp-backup (core rollback on
theme/plugin updates) and wp-content/ai1wm-backups (All-in-One WP
Migration). Both sit directly under wp-content, which is the read-only
Nix store path, so creation fails.
Symlink both dirs out to the writable state dir and add matching
tmpfiles rules, same pattern as themes/plugins/upgrade.
Fixes "Could not create the upgrade-temp-backup directory" on Bricks
theme update, and the ai1wm-backups permission errors.
kurogeek
mooyai