b2749dc -> b2b5daa (rev 203 -> 497). Pulls in cnx-network's new
hermes-agent input (uv2nix, pyproject-nix, ...) and its nixos-mailserver
pin d357b9f -> b3e735a.
All nixosConfigurations, checks, packages and the devShell evaluate.
All data-mesher-node-identity certs were signed on 2026-07-22 with the
default 90-day validity and expired on 2026-10-20, taking the whole mesh
down ("identity certificate not signed by network certificate authority"
is actually an expiry failure). Nothing rotates them automatically.
Requires `clan vars generate --generator data-mesher-node-identity
--regenerate` and a redeploy to take effect.
The sops vars backend deploys generator files at
/run/secrets/vars/per-machine/<machine>/<generator>/<file>; the hard-coded
rsh still pointed at /run/secrets/vars/borgbackup/borgbackup.ssh, so
borgbackup-job-alex could not find its key. Align with alasia's entry.
nixpkgs' alertmanager uses DynamicUser, so the `alertmanager` user only
exists while the service is running. The matrix-alertmanager-urlfile
secret is owned by that user; at boot sops-install-secrets cannot resolve
it and rejects the whole manifest, leaving /run/secrets empty (no ssh
host key, yggdrasil key, tor key, ...). Deploys masked it because the
dynamic user was resolvable via nss-systemd at switch time.
Create a static alertmanager user/group and disable DynamicUser.
Building the frappix hosts on nixos-unstable 3ec6363 fails in frappix's
python overlay:
- sql_metadata 2.12.0 pins sqlparse<0.6, nixpkgs ships 0.6.0. frappe
itself needs 0.6 (MAX_GROUPING_TOKENS), and sql_metadata 3.x needs
sqlglot >= 30 which nixpkgs lacks, so relax the pin. frappe only feeds it
SELECT statements; the only regressions on 0.6 are CREATE TABLE IF NOT
EXISTS name extraction.
- rq 1.16.2 test_parse_connection fails against redis-py 8.1 (extra
himport_registry kwarg). Test-only; disable it.
nix flake check does not catch these: it only evaluates hosts.
nixos-unstable dropped nixVersions.nix_2_31, which clan-core still pins
for clan-cli (pkgs/clan-cli/flake-module.nix); override it to pkgs.nix in
the devshell.
nixpkgs#575004 bumped mcp 1.29 -> 2.2 and marked python3Packages.posthog
broken; only one optional MCP test fails. frappe needs posthog at runtime.
Skip that test and clear meta.broken until the upstream unbreak lands;
the overlay warns at eval time once it does.
Temporary overlay until the PR reaches nixpkgs-unstable. Fixes
CVE-2026-109618 and CVE-2026-109619. Becomes a no-op and warns at eval
time once the locked nixpkgs ships these versions; delete it then.
Fixes devShell build on nixpkgs 5adc508: makeWrapper no longer word-splits
makeWrapperArgs, so clan-cli's "--unset LD_LIBRARY_PATH" single-string
args failed with "makeWrapper doesn't understand the arg". Upstream
clan-core main splits the tokens.
nixpkgs' services/printing/ipp-usb.nix still sets the obsolete
services.avahi.publish.{enable,userServices}, warning on every machine
that enables ipp-usb. Disable the upstream module and carry a copy that
uses services.avahi.settings.publish; only that block differs.
hunspellWithDicts -> hunspell.withDicts; pin programs.firefox.configPath
to the legacy .mozilla/firefox so the profile stays put when stateVersion
crosses 26.05.
nixpkgs removed services.nextcloud.config.{adminuser,adminpassFile} and
now installs with --disable-admin-user. Add a nextcloud-admin-user oneshot
that creates the admin account from the vars secret after nextcloud-setup.
ygg.jjolly.dev:3443 has been offline 21 weeks and
[2602:fc24:18:7a42::1]:993 is unreachable (dropped from the public
peer list); every node was retrying both. Add measured-reachable
peers near the Asian (SG/JP/HK) and US nodes so tree parents are no
longer forced through two US-Midwest relays.
The ISP modem restart at 08:19 re-delegated the same /64 five seconds
after the PPPoE drop. networkd re-announced it at once, but the fixed
7 s radvd run kept sending preferred-lifetime-0 RAs for it, so clients
sat on a deprecated prefix until networkd's next periodic RA and IPv6
stayed broken for minutes.
Send one RA per radvd start, up to three 3 s apart, and skip each one if
the /64 is already back on the interface. Verified on stellio with the
rendered script: a prefix gone for good -> three RAs; the PD address
removed and re-added 4 s later -> two RAs, then "is back, leaving it
announced", client preferred again and pinging over v6.
After the reboot vlan-lan got its /64 at boot, but IPv6 still failed for
clients: the first PPPoE session lands on another AIS BNG, is torn down
minutes later, and the reconnect brings a different /64 (07:53
2405:9800:b911:91e3 -> 07:57 b910:1f5d). networkd announces the new
prefix at once but never deprecates the old one (systemd#29651), so
clients keep it preferred for up to 30 minutes and source selection
sends every connection from a dead address.
router-radv-deprecate.service watches vlan-* for networkd removing a
dynamic address and sends RAs with that /64 at preferred lifetime 0 via
a short-lived radvd (SIGKILLed: no shutdown RA). Identical script to the
upstream commit; drop once the cnx-network input is bumped past it.
Verified on stellio: the stale prefix flipped to deprecated on the
client at the first RA and pings resumed; a synthetic dynamic address
removed from vlan-lan produced the same RA end to end.
Clients on stellio's lan had no global IPv6. AIS delegates a single /64
over PPPoE; cnx-network's router service carves the VLAN prefixes with
SubnetId=auto, so vlan-mgmt took the whole prefix and vlan-lan logged
"Couldn't find a suitable prefix. Ran out of address space" -- no RA
prefix on lan.
Pin SubnetId: 0x0 on vlan-lan (the whole /64), 0x1 on vlan-mgmt (out of
range on a /64, harmless; works unchanged if AIS ever delegates wider).
Verified live via runtime drop-ins: vlan-lan got 2405:9800:b910:1f5d::/64
and a LAN client pinged 2606:4700:4700::1111 over v6.
Drop once cnx-network carries the per-VLAN `ipv6SubnetId` option
(cnx-network-clan commit 27c697a) and the input is bumped.
The router service only opens SSH to the mgmt VLAN, the staging port
and the ZeroTier mesh. Also admit it on the yggdrasil interface (`ygg`,
as named by clan-core's service) so the box stays reachable when
ZeroTier is down. Interface-scoped, so a spoofed 200::/7 source on the
WAN never matches.
Picks up print formats for Purchase Invoice/Order and Sales Order,
Withholding Tax Certificate print format and button, DRAFT watermark
on unsubmitted certificates, Type of Income Paid on Tax Withholding
Category.
dhcp-leasefile=/dev/null logs 'failed to write /dev/null: Invalid argument'
every lease; leasefile-ro is the supported way to run without a lease file.
mirach and almach have each hung at least twice since July with nothing in
the journal or pstore, and stayed down until someone power-cycled the board.
RuntimeWatchdogSec was 0 and kernel.panic was 0, so a hung kernel/PID1 or a
panic could never self-recover.
Arm the systemd hardware watchdog (30s) and reboot 10s after a panic on all
phonebox nodes. Watchdog resets will show up as extra entries in
journalctl --list-boots.
The MT7531 on the Flint 2 is MDIO-attached and shares the SoC MDIO bus
with the 2.5G WAN PHY. On 6.18.49 mt7530_get_stats64 takes the MDIO
mutex under the RCU read lock that /proc/net/dev readers hold; when the
WAN PHY is renegotiating (PPPoE flap) the mutex is contended, the read
sleeps in atomic context and the box oopses:
BUG: scheduling while atomic: zerotier-one/1748/0x00000002
mt7530_get_stats64 -> dsa_user_get_stats64 -> dev_seq_show
Unable to handle kernel paging request at 0000afa547cef5f0
Vendor upstream 07d99587396024932e02474c3a5bede71d108454 (mainline
2026-05-04, absent from linux-6.18.y). Applies to v6.18.49 with one
fuzz-1 hunk (6.18 still exports mt7530_switch_ops).
Storage=volatile left nothing behind for the 2026-09-23/24 reboots: the
last persisted entry is journald stopping during the 2026-09-22 switch,
and /sys/fs/pstore is empty too. Keep the eMMC-wear intent with a 256M
cap and a 1 min sync interval matching the ext4 commit=60.
Package git.b4l.co.th/newedge/default_thai_company as a frappix app
(pkgs/frappix/default-thai-company.nix) and expose it through a new
frappixAppsOverlay that extends the pkgs.frappix scope. Install it on
the poyerp.newedge.house site on deneb.
kurogeek