Upstream 07d9958739 was backported to linux-6.18.y as af98611ad109
(2026-10-15) and is in the 6.18.58 nixpkgs now builds for stellio.
Applying the patch on top fails: patch(1) rejects all 10 hunks as
already applied, so the kernel build has been broken since the nixpkgs
bump brought 6.18.58.
Restores the mgmt subnet id the dropped mkForce used, via cnx-network's
new per-VLAN option instead of overriding networkd config. Still skipped
on AIS's bare /64; unlike the VLAN-id default (10) it also fits a /61-/63
delegation.
Both interim blocks are in cnx-network b2b5daa:
- 27c697a adds vlans.<name>.ipv6SubnetId (lan -> 0, others -> VLAN id),
replacing the SubnetId=auto race the mkForce pins worked around. mgmt
moves from 0x1 to 0xA; on AIS's bare /64 both are skipped alike.
- 45643d6 is the router-radv-deprecate unit this file carried a copy
of. Keeping both concatenated the two scripts into one unit running
two ip-monitor loops.
b2749dc -> b2b5daa (rev 203 -> 497). Pulls in cnx-network's new
hermes-agent input (uv2nix, pyproject-nix, ...) and its nixos-mailserver
pin d357b9f -> b3e735a.
All nixosConfigurations, checks, packages and the devShell evaluate.
All data-mesher-node-identity certs were signed on 2026-07-22 with the
default 90-day validity and expired on 2026-10-20, taking the whole mesh
down ("identity certificate not signed by network certificate authority"
is actually an expiry failure). Nothing rotates them automatically.
Requires `clan vars generate --generator data-mesher-node-identity
--regenerate` and a redeploy to take effect.
The sops vars backend deploys generator files at
/run/secrets/vars/per-machine/<machine>/<generator>/<file>; the hard-coded
rsh still pointed at /run/secrets/vars/borgbackup/borgbackup.ssh, so
borgbackup-job-alex could not find its key. Align with alasia's entry.
nixpkgs' alertmanager uses DynamicUser, so the `alertmanager` user only
exists while the service is running. The matrix-alertmanager-urlfile
secret is owned by that user; at boot sops-install-secrets cannot resolve
it and rejects the whole manifest, leaving /run/secrets empty (no ssh
host key, yggdrasil key, tor key, ...). Deploys masked it because the
dynamic user was resolvable via nss-systemd at switch time.
Create a static alertmanager user/group and disable DynamicUser.
Building the frappix hosts on nixos-unstable 3ec6363 fails in frappix's
python overlay:
- sql_metadata 2.12.0 pins sqlparse<0.6, nixpkgs ships 0.6.0. frappe
itself needs 0.6 (MAX_GROUPING_TOKENS), and sql_metadata 3.x needs
sqlglot >= 30 which nixpkgs lacks, so relax the pin. frappe only feeds it
SELECT statements; the only regressions on 0.6 are CREATE TABLE IF NOT
EXISTS name extraction.
- rq 1.16.2 test_parse_connection fails against redis-py 8.1 (extra
himport_registry kwarg). Test-only; disable it.
nix flake check does not catch these: it only evaluates hosts.
nixos-unstable dropped nixVersions.nix_2_31, which clan-core still pins
for clan-cli (pkgs/clan-cli/flake-module.nix); override it to pkgs.nix in
the devshell.
nixpkgs#575004 bumped mcp 1.29 -> 2.2 and marked python3Packages.posthog
broken; only one optional MCP test fails. frappe needs posthog at runtime.
Skip that test and clear meta.broken until the upstream unbreak lands;
the overlay warns at eval time once it does.
Temporary overlay until the PR reaches nixpkgs-unstable. Fixes
CVE-2026-109618 and CVE-2026-109619. Becomes a no-op and warns at eval
time once the locked nixpkgs ships these versions; delete it then.
kurogeek