inventory/borgbackup: fix ssh key path for cursa, hadar, procyon, bosona, canopus, deneb

The sops vars backend deploys generator files at /run/secrets/vars/per-machine/<machine>/<generator>/<file>; the hard-coded rsh still pointed at /run/secrets/vars/borgbackup/borgbackup.ssh, so borgbackup-job-alex could not find its key. Align with alasia's entry.
inventory.json: update install time of alasia
2026-10-27 06:15:06 +00:00 · 2026-10-27 12:01:54 +07:00 · 2026-10-27 12:01:53 +07:00 · 2026-10-27 02:20:53 +00:00 · 2026-10-27 02:20:53 +00:00 · 2026-10-27 02:04:04 +00:00
19 changed files with 388 additions and 209 deletions
@@ -151,11 +151,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1792664877,
-        "narHash": "sha256-yl7J8TPJ9GCG0T5KreuquOpyP2yzBHHaK/IlkO8x8z0=",
+        "lastModified": 1792819087,
+        "narHash": "sha256-1bxllGymY+u3NvEX4FHMZyE4l9y0nRpvk/qLaPkwAjg=",
        "ref": "refs/heads/main",
-        "rev": "a566329bbcf0f915c4e6f42c2aee0354e1cd2c12",
-        "revCount": 15401,
+        "rev": "94862153f6e63016151d7c527f9e7bb3e96b0598",
+        "revCount": 15417,
        "type": "git",
        "url": "https://git.clan.lol/clan/clan-core"
      },
@@ -249,11 +249,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1789770686,
-        "narHash": "sha256-uZkBR7yHdIKUFB5SZdfgh1qkGfI3XmYmI/lTiquxbck=",
+        "lastModified": 1792526520,
+        "narHash": "sha256-3hSJlv8mUVnZPMWK2+CM7a9O+nR6Z4mCh27NfLCmTPc=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "725ea35e410ad83be4931d1bff7e090eacaf3563",
+        "rev": "cedd626e11b635470fa6f9fdb8ad79b0075dd7f9",
        "type": "github"
      },
      "original": {
@@ -419,11 +419,11 @@
        "std": "std"
      },
      "locked": {
-        "lastModified": 1787631179,
-        "narHash": "sha256-l+Zt5XNTD0f0ChkzDJURfQlFAgANIMrGYrk51SZEJKU=",
+        "lastModified": 1789106589,
+        "narHash": "sha256-RMQdAvDaa4eUcdePDqUGAhnyTtzKxc6a8abauy8bzb0=",
        "owner": "kurogeek",
        "repo": "frappix",
-        "rev": "fcb797886ae753b26a6e4415a7f2c19ba6adcf3b",
+        "rev": "dbfa76d84df6354bd7528c9d0c407387f66c3e33",
        "type": "github"
      },
      "original": {
@@ -689,11 +689,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1792366139,
-        "narHash": "sha256-jto4pdsl0bgErQ5vaMc3gOyj//PILLRJuqX3I7fUk6s=",
+        "lastModified": 1792737899,
+        "narHash": "sha256-P0/GhewcEQmAbzq3QunNWY2jLJaYH9F6c/5dEM/jQ4M=",
        "owner": "nix-darwin",
        "repo": "nix-darwin",
-        "rev": "f0ec2b3fae4df92ea7788359aef9e07bb88d720f",
+        "rev": "bb0b90dbd54e207100de72b5dcbe3188c98a4b69",
        "type": "github"
      },
      "original": {
@@ -890,16 +890,16 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1792506237,
-        "narHash": "sha256-Q/8KLB6jNfpaUN1HAedE/u/Et9feE/zYSsutBLKrCFk=",
+        "lastModified": 1792773339,
+        "narHash": "sha256-rZLrzrC6i+jnTAlvPZHogKDulY7WWDEv9hJeHieO7Zw=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "5adc50831c259f87faeb09ddf930d43597197473",
+        "rev": "3ec636362e1816bc2f0888fa0fa2c69f1bc9e504",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -1014,11 +1014,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1792056300,
-        "narHash": "sha256-YU1LjDe1o2Ymg5zEiCHbmMXLkDCtxHQRiVqZ3nC5GGk=",
+        "lastModified": 1792809984,
+        "narHash": "sha256-KV+CaZX7QS0hcdKxwGKehDb1jmUgx6lbkTPpaoIW5Nw=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "44931708c62937c2b1bf7953902989fa5bb9ee1b",
+        "rev": "442449fa7b1fe6c692d0103ac9fc8f9e82931cf3",
        "type": "github"
      },
      "original": {
@@ -31,7 +31,7 @@
      inputs.home-manager.follows = "home-manager";
    };
    import-tree.url = "github:vic/import-tree";
-    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    treefmt-nix = {
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -100,7 +100,6 @@
              inherit system;
              overlays = [
                inputs.self.overlays.packagesOverlay
-                inputs.self.overlays.phpPr576853Overlay # TEMPORARY, see overlays/nixpkgs-pr-576853-php.nix
              ];
              config = { };
            };
@@ -68,43 +68,43 @@
          roles.client.machines."cursa".settings.destinations = {
            alex = {
              repo = "ssh://borg@10.0.10.225:2222/backup/cursa/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/cursa/borgbackup/borgbackup.ssh";
            };
          };
          roles.client.machines."hadar".settings.destinations = {
            alex = {
              repo = "ssh://borg@10.0.10.225:2222/backup/hadar/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/hadar/borgbackup/borgbackup.ssh";
            };
          };
          roles.client.machines."procyon".settings.destinations = {
            alex = {
              repo = "ssh://borg@10.0.10.225:2222/backup/procyon/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/procyon/borgbackup/borgbackup.ssh";
            };
          };
          roles.client.machines."bosona".settings.destinations = {
            alex = {
              repo = "ssh://borg@10.0.10.225:2222/backup/bosona/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/bosona/borgbackup/borgbackup.ssh";
            };
          };
          roles.client.machines."canopus".settings.destinations = {
            alex = {
              repo = "ssh://borg@10.0.10.225:2222/backup/canopus/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/canopus/borgbackup/borgbackup.ssh";
            };
          };
          roles.client.machines."deneb".settings.destinations = {
            alex = {
              repo = "ssh://borg@10.0.10.225:2222/backup/deneb/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/deneb/borgbackup/borgbackup.ssh";
            };
          };
          roles.client.machines."alasia".settings.destinations = {
            alex = {
              repo = "ssh://borg@10.0.10.225:2222/backup/alasia/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/alasia/borgbackup/borgbackup.ssh";
            };
          };
        };
@@ -43,7 +43,7 @@
      "installedAt": 1775458442
    },
    "alasia": {
-      "installedAt": 1778661666
+      "installedAt": 1793077313
    },
    "bosona": {
      "installedAt": 1779098893
@@ -25,7 +25,10 @@
      {
        "index": 8,
        "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -73,7 +76,10 @@
      {
        "index": 9,
        "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -125,7 +131,10 @@
      {
        "index": 10,
        "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -173,7 +182,10 @@
      {
        "index": 11,
        "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -229,7 +241,10 @@
      {
        "index": 12,
        "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -282,14 +297,21 @@
        },
        "driver": "piix4_smbus",
        "driver_module": "i2c_piix4",
-        "drivers": ["piix4_smbus"],
-        "driver_modules": ["i2c_piix4"],
+        "drivers": [
+          "piix4_smbus"
+        ],
+        "driver_modules": [
+          "i2c_piix4"
+        ],
        "module_alias": "pci:v00008086d00007113sv00001AF4sd00001100bc06sc80i00"
      },
      {
        "index": 17,
        "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -337,9 +359,13 @@
    ],
    "cdrom": [
      {
-        "index": 22,
+        "index": 23,
        "attached_to": 15,
-        "class_list": ["cdrom", "scsi", "block_device"],
+        "class_list": [
+          "cdrom",
+          "scsi",
+          "block_device"
+        ],
        "bus_type": {
          "hex": "0084",
          "name": "SCSI",
@@ -396,8 +422,14 @@
        "unix_device_name2": "/dev/sg1",
        "driver": "ata_piix",
        "driver_module": "ata_piix",
-        "drivers": ["ata_piix", "sr"],
-        "driver_modules": ["ata_piix", "sr_mod"]
+        "drivers": [
+          "ata_piix",
+          "sr"
+        ],
+        "driver_modules": [
+          "ata_piix",
+          "sr_mod"
+        ]
      }
    ],
    "cpu": [
@@ -464,7 +496,9 @@
          "spectre_v2_user",
          "its"
        ],
-        "power_management": [""],
+        "power_management": [
+          ""
+        ],
        "bogo": 4224,
        "cache": 16384,
        "page_size": 4096,
@@ -475,7 +509,7 @@
        "fpu_exception": false,
        "cpuid_level": 13,
        "write_protect": false,
-        "tlb_size": 32764,
+        "tlb_size": 32766,
        "clflush_size": 64,
        "cache_alignment": 128,
        "address_sizes": {
@@ -546,7 +580,9 @@
          "spectre_v2_user",
          "its"
        ],
-        "power_management": [""],
+        "power_management": [
+          ""
+        ],
        "bogo": 4224,
        "cache": 16384,
        "page_size": 4096,
@@ -557,7 +593,7 @@
        "fpu_exception": false,
        "cpuid_level": 13,
        "write_protect": false,
-        "tlb_size": 32764,
+        "tlb_size": 32766,
        "clflush_size": 64,
        "cache_alignment": 128,
        "address_sizes": {
@@ -568,16 +604,20 @@
    ],
    "disk": [
      {
-        "index": 23,
-        "attached_to": 19,
-        "class_list": ["disk", "scsi", "block_device"],
+        "index": 22,
+        "attached_to": 20,
+        "class_list": [
+          "disk",
+          "scsi",
+          "block_device"
+        ],
        "bus_type": {
          "hex": "0084",
          "name": "SCSI",
          "value": 132
        },
        "slot": {
-          "bus": 1,
+          "bus": 3,
          "number": 0
        },
        "base_class": {
@@ -606,20 +646,20 @@
          "value": 0
        },
        "model": "QEMU HARDDISK",
-        "sysfs_id": "/class/block/sda",
-        "sysfs_bus_id": "1:0:0:0",
-        "sysfs_device_link": "/devices/pci0000:00/0000:00:05.0/0000:01:01.0/virtio2/host1/target1:0:0/1:0:0:0",
+        "sysfs_id": "/class/block/sdb",
+        "sysfs_bus_id": "3:0:0:0",
+        "sysfs_device_link": "/devices/pci0000:00/0000:00:05.0/0000:01:01.0/virtio3/host3/target3:0:0/3:0:0:0",
        "unix_device_names": [
          "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0",
          "/dev/disk/by-path/pci-0000:01:01.0-scsi-0:0:0:0",
-          "/dev/sda"
+          "/dev/sdb"
        ],
-        "unix_device_name2": "/dev/sg0",
+        "unix_device_name2": "/dev/sg2",
        "rom_id": "0x80",
        "resources": [
          {
            "type": "disk_geo",
-            "cylinders": 8354,
+            "cylinders": 9399,
            "heads": 255,
            "sectors": 63,
            "size": "0x0",
@@ -628,21 +668,30 @@
          {
            "type": "size",
            "unit": "sectors",
-            "value_1": 134217728,
+            "value_1": 150994944,
            "value_2": 512
          }
        ],
        "driver": "virtio_scsi",
        "driver_module": "virtio_scsi",
-        "drivers": ["sd", "virtio_scsi"],
-        "driver_modules": ["sd_mod", "virtio_scsi"]
+        "drivers": [
+          "sd",
+          "virtio_scsi"
+        ],
+        "driver_modules": [
+          "sd_mod",
+          "virtio_scsi"
+        ]
      }
    ],
    "graphics_card": [
      {
        "index": 16,
        "attached_to": 0,
-        "class_list": ["graphics_card", "pci"],
+        "class_list": [
+          "graphics_card",
+          "pci"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -699,8 +748,12 @@
        },
        "driver": "bochs-drm",
        "driver_module": "bochs",
-        "drivers": ["bochs-drm"],
-        "driver_modules": ["bochs"],
+        "drivers": [
+          "bochs-drm"
+        ],
+        "driver_modules": [
+          "bochs"
+        ],
        "module_alias": "pci:v00001234d00001111sv00001AF4sd00001100bc03sc00i00"
      }
    ],
@@ -708,7 +761,10 @@
      {
        "index": 24,
        "attached_to": 7,
-        "class_list": ["usb", "hub"],
+        "class_list": [
+          "usb",
+          "hub"
+        ],
        "bus_type": {
          "hex": "0086",
          "name": "USB",
@@ -781,8 +837,12 @@
        "hotplug": "usb",
        "driver": "hub",
        "driver_module": "usbcore",
-        "drivers": ["hub"],
-        "driver_modules": ["usbcore"],
+        "drivers": [
+          "hub"
+        ],
+        "driver_modules": [
+          "usbcore"
+        ],
        "module_alias": "usb:v1D6Bp0001d0618dc09dsc00dp00ic09isc00ip00in00"
      }
    ],
@@ -790,7 +850,9 @@
      {
        "index": 5,
        "attached_to": 0,
-        "class_list": ["memory"],
+        "class_list": [
+          "memory"
+        ],
        "base_class": {
          "hex": "0101",
          "name": "Internally Used Class",
@@ -814,7 +876,9 @@
      {
        "index": 21,
        "attached_to": 16,
-        "class_list": ["monitor"],
+        "class_list": [
+          "monitor"
+        ],
        "base_class": {
          "hex": "0100",
          "name": "Monitor",
@@ -960,7 +1024,10 @@
      {
        "index": 25,
        "attached_to": 24,
-        "class_list": ["mouse", "usb"],
+        "class_list": [
+          "mouse",
+          "usb"
+        ],
        "bus_type": {
          "hex": "0086",
          "name": "USB",
@@ -996,7 +1063,9 @@
        "model": "QEMU USB Tablet",
        "sysfs_id": "/devices/pci0000:00/0000:00:01.2/usb1/1-1/1-1:1.0",
        "sysfs_bus_id": "1-1:1.0",
-        "unix_device_names": ["/dev/input/mice"],
+        "unix_device_names": [
+          "/dev/input/mice"
+        ],
        "unix_device_name2": "/dev/input/mouse0",
        "resources": [
          {
@@ -1037,11 +1106,18 @@
        "hotplug": "usb",
        "driver": "usbhid",
        "driver_module": "usbhid",
-        "drivers": ["usbhid"],
-        "driver_modules": ["usbhid"],
+        "drivers": [
+          "usbhid"
+        ],
+        "driver_modules": [
+          "usbhid"
+        ],
        "driver_info": {
          "type": "mouse",
-          "db_entry_0": ["explorerps/2", "exps2"],
+          "db_entry_0": [
+            "explorerps/2",
+            "exps2"
+          ],
          "xf86": "explorerps/2",
          "gpm": "exps2",
          "buttons": -1,
@@ -1054,7 +1130,9 @@
      {
        "index": 18,
        "attached_to": 13,
-        "class_list": ["network_controller"],
+        "class_list": [
+          "network_controller"
+        ],
        "bus_type": {
          "hex": "008f",
          "name": "Virtio",
@@ -1079,7 +1157,9 @@
        "model": "Virtio Ethernet Card 0",
        "sysfs_id": "/devices/pci0000:00/0000:00:12.0/virtio1",
        "sysfs_bus_id": "virtio1",
-        "unix_device_names": ["ens18"],
+        "unix_device_names": [
+          "ens18"
+        ],
        "resources": [
          {
            "type": "hwaddr",
@@ -1092,8 +1172,12 @@
        ],
        "driver": "virtio_net",
        "driver_module": "virtio_net",
-        "drivers": ["virtio_net"],
-        "driver_modules": ["virtio_net"],
+        "drivers": [
+          "virtio_net"
+        ],
+        "driver_modules": [
+          "virtio_net"
+        ],
        "module_alias": "virtio:d00000001v00001AF4"
      }
    ],
@@ -1101,7 +1185,9 @@
      {
        "index": 26,
        "attached_to": 18,
-        "class_list": ["network_interface"],
+        "class_list": [
+          "network_interface"
+        ],
        "base_class": {
          "hex": "0107",
          "name": "Network Interface",
@@ -1115,7 +1201,9 @@
        "model": "Ethernet network interface",
        "sysfs_id": "/class/net/ens18",
        "sysfs_device_link": "/devices/pci0000:00/0000:00:12.0/virtio1",
-        "unix_device_names": ["ens18"],
+        "unix_device_names": [
+          "ens18"
+        ],
        "resources": [
          {
            "type": "hwaddr",
@@ -1128,13 +1216,19 @@
        ],
        "driver": "virtio_net",
        "driver_module": "virtio_net",
-        "drivers": ["virtio_net"],
-        "driver_modules": ["virtio_net"]
+        "drivers": [
+          "virtio_net"
+        ],
+        "driver_modules": [
+          "virtio_net"
+        ]
      },
      {
        "index": 27,
        "attached_to": 0,
-        "class_list": ["network_interface"],
+        "class_list": [
+          "network_interface"
+        ],
        "base_class": {
          "hex": "0107",
          "name": "Network Interface",
@@ -1147,14 +1241,19 @@
        },
        "model": "Loopback network interface",
        "sysfs_id": "/class/net/lo",
-        "unix_device_names": ["lo"]
+        "unix_device_names": [
+          "lo"
+        ]
      }
    ],
    "pci": [
      {
        "index": 13,
        "attached_to": 0,
-        "class_list": ["pci", "unknown"],
+        "class_list": [
+          "pci",
+          "unknown"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -1211,14 +1310,21 @@
        },
        "driver": "virtio-pci",
        "driver_module": "virtio_pci",
-        "drivers": ["virtio-pci"],
-        "driver_modules": ["virtio_pci"],
+        "drivers": [
+          "virtio-pci"
+        ],
+        "driver_modules": [
+          "virtio_pci"
+        ],
        "module_alias": "pci:v00001AF4d00001000sv00001AF4sd00000001bc02sc00i00"
      },
      {
        "index": 14,
        "attached_to": 0,
-        "class_list": ["pci", "unknown"],
+        "class_list": [
+          "pci",
+          "unknown"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -1274,8 +1380,12 @@
        },
        "driver": "virtio-pci",
        "driver_module": "virtio_pci",
-        "drivers": ["virtio-pci"],
-        "driver_modules": ["virtio_pci"],
+        "drivers": [
+          "virtio-pci"
+        ],
+        "driver_modules": [
+          "virtio_pci"
+        ],
        "module_alias": "pci:v00001AF4d00001002sv00001AF4sd00000005bc00scFFi00"
      }
    ],
@@ -1283,7 +1393,10 @@
      {
        "index": 6,
        "attached_to": 17,
-        "class_list": ["storage_controller", "pci"],
+        "class_list": [
+          "storage_controller",
+          "pci"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -1325,7 +1438,7 @@
        "resources": [
          {
            "type": "io",
-            "base": 49152,
+            "base": 49216,
            "range": 64,
            "enabled": true,
            "access": "read_write"
@@ -1340,14 +1453,21 @@
        },
        "driver": "virtio-pci",
        "driver_module": "virtio_pci",
-        "drivers": ["virtio-pci"],
-        "driver_modules": ["virtio_pci"],
+        "drivers": [
+          "virtio-pci"
+        ],
+        "driver_modules": [
+          "virtio_pci"
+        ],
        "module_alias": "pci:v00001AF4d00001004sv00001AF4sd00000008bc01sc00i00"
      },
      {
        "index": 15,
        "attached_to": 0,
-        "class_list": ["storage_controller", "pci"],
+        "class_list": [
+          "storage_controller",
+          "pci"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -1437,8 +1557,12 @@
        },
        "driver": "ata_piix",
        "driver_module": "ata_piix",
-        "drivers": ["ata_piix"],
-        "driver_modules": ["ata_piix"],
+        "drivers": [
+          "ata_piix"
+        ],
+        "driver_modules": [
+          "ata_piix"
+        ],
        "module_alias": "pci:v00008086d00007010sv00001AF4sd00001100bc01sc01i80"
      }
    ],
@@ -1448,33 +1572,10 @@
    "unknown": [
      {
        "index": 19,
-        "attached_to": 6,
-        "class_list": ["unknown"],
-        "base_class": {
-          "hex": "0000",
-          "name": "Unclassified device",
-          "value": 0
-        },
-        "sub_class": {
-          "hex": "0000",
-          "name": "Unclassified device",
-          "value": 0
-        },
-        "vendor": "Virtio",
-        "device": "",
-        "model": "Virtio Unclassified device",
-        "sysfs_id": "/devices/pci0000:00/0000:00:05.0/0000:01:01.0/virtio2",
-        "sysfs_bus_id": "virtio2",
-        "driver": "virtio_scsi",
-        "driver_module": "virtio_scsi",
-        "drivers": ["virtio_scsi"],
-        "driver_modules": ["virtio_scsi"],
-        "module_alias": "virtio:d00000008v00001AF4"
-      },
-      {
-        "index": 20,
        "attached_to": 14,
-        "class_list": ["unknown"],
+        "class_list": [
+          "unknown"
+        ],
        "base_class": {
          "hex": "0000",
          "name": "Unclassified device",
@@ -1492,16 +1593,54 @@
        "sysfs_bus_id": "virtio0",
        "driver": "virtio_balloon",
        "driver_module": "virtio_balloon",
-        "drivers": ["virtio_balloon"],
-        "driver_modules": ["virtio_balloon"],
+        "drivers": [
+          "virtio_balloon"
+        ],
+        "driver_modules": [
+          "virtio_balloon"
+        ],
        "module_alias": "virtio:d00000005v00001AF4"
+      },
+      {
+        "index": 20,
+        "attached_to": 6,
+        "class_list": [
+          "unknown"
+        ],
+        "base_class": {
+          "hex": "0000",
+          "name": "Unclassified device",
+          "value": 0
+        },
+        "sub_class": {
+          "hex": "0000",
+          "name": "Unclassified device",
+          "value": 0
+        },
+        "vendor": "Virtio",
+        "device": "",
+        "model": "Virtio Unclassified device",
+        "sysfs_id": "/devices/pci0000:00/0000:00:05.0/0000:01:01.0/virtio3",
+        "sysfs_bus_id": "virtio3",
+        "driver": "virtio_scsi",
+        "driver_module": "virtio_scsi",
+        "drivers": [
+          "virtio_scsi"
+        ],
+        "driver_modules": [
+          "virtio_scsi"
+        ],
+        "module_alias": "virtio:d00000008v00001AF4"
      }
    ],
    "usb_controller": [
      {
        "index": 7,
        "attached_to": 0,
-        "class_list": ["usb_controller", "pci"],
+        "class_list": [
+          "usb_controller",
+          "pci"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -1568,15 +1707,25 @@
        },
        "driver": "uhci_hcd",
        "driver_module": "uhci_hcd",
-        "drivers": ["uhci_hcd"],
-        "driver_modules": ["uhci_hcd"],
+        "drivers": [
+          "uhci_hcd"
+        ],
+        "driver_modules": [
+          "uhci_hcd"
+        ],
        "driver_info": {
          "type": "module",
-          "db_entry_0": ["uhci-hcd"],
+          "db_entry_0": [
+            "uhci-hcd"
+          ],
          "active": true,
          "modprobe": true,
-          "names": ["uhci-hcd"],
-          "module_args": [""],
+          "names": [
+            "uhci-hcd"
+          ],
+          "module_args": [
+            ""
+          ],
          "conf": ""
        },
        "module_alias": "pci:v00008086d00007020sv00001AF4sd00001100bc0Csc03i00"
@@ -1682,7 +1831,9 @@
          "name": "RAM",
          "value": 7
        },
-        "memory_type_details": ["Other"],
+        "memory_type_details": [
+          "Other"
+        ],
        "speed": 0
      }
    ],
@@ -17,6 +17,8 @@ in
    inputs.self.overlays.frappixLibsOverlay
    inputs.self.overlays.frappixPythonOverlay
    inputs.self.overlays.frappixToolsOverlay
+    inputs.self.overlays.posthogPr578265Overlay # TEMPORARY, see overlays/nixpkgs-pr-578265-posthog.nix
+    inputs.self.overlays.frappixFixupsOverlay
  ];

  clan.core.vars.generators.frappix = {
@@ -17,6 +17,8 @@ in
    inputs.self.overlays.frappixLibsOverlay
    inputs.self.overlays.frappixPythonOverlay
    inputs.self.overlays.frappixToolsOverlay
+    inputs.self.overlays.posthogPr578265Overlay # TEMPORARY, see overlays/nixpkgs-pr-578265-posthog.nix
+    inputs.self.overlays.frappixFixupsOverlay
  ];

  clan.core.vars.generators.frappix = {
@@ -26,6 +26,8 @@ in
    inputs.self.overlays.frappixPythonOverlay
    inputs.self.overlays.frappixToolsOverlay
    inputs.self.overlays.frappixAppsOverlay
+    inputs.self.overlays.posthogPr578265Overlay # TEMPORARY, see overlays/nixpkgs-pr-578265-posthog.nix
+    inputs.self.overlays.frappixFixupsOverlay
  ];

  fonts.packages = [ pkgs.tlwg ];
@@ -56,7 +56,6 @@ in
  ];
  nixpkgs.overlays = [
    self.overlays.packagesOverlay
-    self.overlays.phpPr576853Overlay # TEMPORARY, see overlays/nixpkgs-pr-576853-php.nix
  ];

  clan.core.vars.generators.greaterchiangmai = {
@@ -1,4 +1,4 @@
-{ self, ... }:
+{ ... }:
 {
  system.stateVersion = "25.11";
  nixpkgs.hostPlatform = {
@@ -30,7 +30,4 @@
  security.acme.acceptTerms = true;

  imports = [ ];
-
-  # TEMPORARY: wordpress php-fpm pools use pkgs.php; see overlays/nixpkgs-pr-576853-php.nix
-  nixpkgs.overlays = [ self.overlays.phpPr576853Overlay ];
 }
@@ -256,6 +256,21 @@
                ];
              };

+              # nixpkgs runs alertmanager with DynamicUser; that user only exists
+              # while the service runs, so sops-install-secrets cannot resolve the
+              # owner of matrix-alertmanager-urlfile at boot and rejects the whole
+              # manifest (no secrets installed). Use a static user instead.
+              users.users.alertmanager = {
+                isSystemUser = true;
+                group = "alertmanager";
+              };
+              users.groups.alertmanager = { };
+              systemd.services.alertmanager.serviceConfig = {
+                DynamicUser = lib.mkForce false;
+                User = "alertmanager";
+                Group = "alertmanager";
+              };
+
              services.matrix-alertmanager = lib.mkIf settings.matrix-alertmanager.enable {
                enable = true;
                tokenFile = config.clan.core.vars.generators.prometheus.files.matrix-alertmanager-token.path;
@@ -2,13 +2,15 @@
 {
  flake.overlays = {
    packagesOverlay = import ../pkgs/overlay.nix;
-    # TEMPORARY: drop with the file once NixOS/nixpkgs#576853 reaches nixpkgs-unstable.
-    phpPr576853Overlay = import ./nixpkgs-pr-576853-php.nix;
+    # TEMPORARY: drop with the file once NixOS/nixpkgs#578265 reaches nixos-unstable.
+    posthogPr578265Overlay = import ./nixpkgs-pr-578265-posthog.nix;

    frappixFrappeOverlay = inputs.frappix.frappeOverlay.x86_64-linux;
    frappixLibsOverlay = inputs.frappix.libsOverlay.x86_64-linux;
    frappixPythonOverlay = inputs.frappix.pythonOverlay.x86_64-linux;
    frappixToolsOverlay = inputs.frappix.toolsOverlay.x86_64-linux;
    frappixAppsOverlay = import ../pkgs/frappix/overlay.nix;
+    # Must be applied after frappixPythonOverlay (overrides packages from it).
+    frappixFixupsOverlay = import ./frappix-fixups.nix;
  };
 }
@@ -0,0 +1,34 @@
+# Fixups for frappix's python overlay on current nixos-unstable. Everything
+# here belongs upstream in kurogeek/frappix; drop entries as they land.
+# Must be applied after frappixPythonOverlay.
+_final: prev:
+let
+  inherit (prev) lib;
+in
+{
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyFinal: pyPrev: {
+      # frappe >= v15.120 needs sqlparse 0.6 (db_query.py touches
+      # sqlparse.engine.grouping.MAX_GROUPING_TOKENS), but every sql_metadata
+      # 2.x release pins sqlparse<0.6; the sqlglot-based 3.x needs sqlglot >= 30,
+      # which nixpkgs does not ship yet. Relaxing the pin is safe for frappe: its
+      # two call sites (desk/reportview.py, core/doctype/recorder/db_optimizer.py)
+      # only parse SELECT statements, and the only sql_metadata test regressions
+      # on sqlparse 0.6 are `CREATE TABLE IF NOT EXISTS` name extraction (2/150).
+      sql_metadata =
+        if lib.versionAtLeast pyPrev.sql_metadata.version "3" then
+          lib.warn "frappix ships sql_metadata ${pyPrev.sql_metadata.version} (no sqlparse dependency): drop the sql_metadata entry from overlays/frappix-fixups.nix" pyPrev.sql_metadata
+        else
+          pyPrev.sql_metadata.overridePythonAttrs (old: {
+            pythonRelaxDeps = (old.pythonRelaxDeps or [ ]) ++ [ "sqlparse" ];
+          });
+
+      # rq 1.16.2 (frappix's rq_1 pin): test_parse_connection compares redis
+      # connection kwargs against a literal; redis-py 8.1 (current nixpkgs) adds
+      # `himport_registry`, so the assertion fails. Test-only.
+      rq_1 = pyPrev.rq_1.overridePythonAttrs (old: {
+        disabledTests = old.disabledTests ++ [ "test_parse_connection" ];
+      });
+    })
+  ];
+}
@@ -1,59 +0,0 @@
-# TEMPORARY backport of NixOS/nixpkgs#576853
-# (php 8.3.36 / 8.4.27 / 8.5.12; fixes CVE-2026-109618, CVE-2026-109619).
-# Merged to master 2026-10-21, not yet on nixpkgs-unstable.
-# Track: https://track.nix.ee/?pr=576853
-#
-# Remove once `nix flake update` pulls it in: delete this file and every
-# reference to it (grep 576853). The overlay becomes a no-op and warns at eval
-# time as soon as the locked nixpkgs ships these versions or newer.
-final: prev:
-let
-  inherit (prev) lib;
-
-  updates = {
-    php83 = {
-      version = "8.3.36";
-      hash = "sha256-RvS0XjaI7SsYGQFae1MsFbUcwFW907E/0A3f7r7tzV8=";
-    };
-    php84 = {
-      version = "8.4.27";
-      hash = "sha256-slMKh3xyL0sIyeF0owywi6wrfhkD7m6eMV8KqfX4LCQ=";
-    };
-    php85 = {
-      version = "8.5.12";
-      hash = "sha256-/7YO3EN87WO1E35JhNs3moERxQBJxxFRDYuVgnfvwag=";
-    };
-  };
-
-  # php-packages.nix hunk of the PR: the new releases' filter OOM tests only
-  # pass when the freshly built module is loaded explicitly.
-  packageOverrides = _: phpPrev: {
-    extensions = phpPrev.extensions // {
-      filter = phpPrev.extensions.filter.override {
-        postConfigure = ''
-          substituteInPlace \
-            tests/oom_filter_input.phpt \
-            tests/oom_filter_input_array.phpt \
-            tests/oom_filter_default_encoded.phpt \
-            --replace-fail "'-n'," "'-n', '-d', 'extension=$PWD/modules/filter.so',"
-        '';
-      };
-    };
-  };
-
-  bump =
-    name:
-    { version, hash }:
-    if lib.versionAtLeast prev.${name}.version version then
-      lib.warn
-        "nixpkgs ships ${name} ${prev.${name}.version} (>= ${version}): NixOS/nixpkgs#576853 has landed, remove overlays/nixpkgs-pr-576853-php.nix"
-        prev.${name}
-    else
-      # `.override` on a php buildEnv rebuilds the interpreter with the new
-      # args, but the extension scope (php-packages) keeps the closure's
-      # original `packageOverrides`. Only `overrideAttrs` re-enters
-      # generic.nix with the overridden args and rebuilds that scope, so a
-      # no-op `overrideAttrs` is what makes `packageOverrides` take effect.
-      (prev.${name}.override { inherit version hash packageOverrides; }).overrideAttrs (_: { });
-in
-lib.mapAttrs bump updates
@@ -0,0 +1,33 @@
+# TEMPORARY workaround for NixOS/nixpkgs#578265 (python3Packages.posthog: unbreak).
+# nixpkgs#575004 bumped mcp 1.29 -> 2.2 and marked posthog broken; the only
+# failure is one test in posthog's optional MCP integration (field rename in
+# mcp 2). posthog is a runtime dependency of frappe, so frappix machines fail
+# to evaluate without this.
+#
+# Remove once `nix flake update` pulls the PR in: delete this file and every
+# reference to it (grep 578265). The overlay becomes a no-op and warns at eval
+# time as soon as the locked nixpkgs no longer marks posthog broken.
+_final: prev:
+let
+  inherit (prev) lib;
+in
+{
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyFinal: pyPrev: {
+      posthog =
+        if !pyPrev.posthog.meta.broken then
+          lib.warn "nixpkgs no longer marks posthog broken: NixOS/nixpkgs#578265 has landed, remove overlays/nixpkgs-pr-578265-posthog.nix" pyPrev.posthog
+        else
+          pyPrev.posthog.overridePythonAttrs (old: {
+            disabledTests = old.disabledTests ++ [
+              # AttributeError: 'CallToolResult' object has no attribute 'structuredContent'
+              # (mcp>=2 renamed the field to `structured_content`)
+              "test_prepare_tool_result_delivers_into_call_tool_result_models"
+            ];
+            meta = old.meta // {
+              broken = false;
+            };
+          });
+    })
+  ];
+}
@@ -7,14 +7,14 @@
 let
  repoSrc = fetchgit {
    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
-    rev = "895092dea1da99ca1fa3c5c6d805384e579d417e";
-    hash = "sha256-ffbwQVQ1lL8XpubsGX6FTbJOjz1mbqCn+AKvR7xJhRw=";
+    rev = "deadb17b255b0733a2c552ae3638ecde0b9ee7d6";
+    hash = "sha256-xXq3yZjlp0ULzlSkBnc5SIRxwXZQQoIXgy0rztgFGHg=";
  };
  src = "${repoSrc}/upload-large-file";
 in
 buildNpmPackage {
  pname = "gtcm-file-uploader";
-  version = "1.1.2";
+  version = "1.1.6";

  nativeBuildInputs = with pkgs; [
    nodejs
@@ -6,14 +6,14 @@
 let
  repoSrc = fetchgit {
    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
-    rev = "895092dea1da99ca1fa3c5c6d805384e579d417e";
-    hash = "sha256-ffbwQVQ1lL8XpubsGX6FTbJOjz1mbqCn+AKvR7xJhRw=";
+    rev = "deadb17b255b0733a2c552ae3638ecde0b9ee7d6";
+    hash = "sha256-xXq3yZjlp0ULzlSkBnc5SIRxwXZQQoIXgy0rztgFGHg=";
  };
  src = "${repoSrc}/think-backend.greaterchiangmai.com";
 in
 php.buildComposerProject2 (finalAttrs: {
  pname = "think-backend-gtcm";
-  version = "1.1.2";
+  version = "1.1.6";

  inherit src;

@@ -32,5 +32,5 @@ php.buildComposerProject2 (finalAttrs: {
  '';

  composerStrictValidation = false;
-  vendorHash = "sha256-1cY33xOF0f1qWkZKtJSjOYReb9vLQRnLZuF+GdVA7xU=";
+  vendorHash = "sha256-FaAwFzLXfMAiUv9eZLtFI0QurkNLh4fsTYrvGv1rAlo=";
 })
@@ -6,14 +6,14 @@
 let
  repoSrc = fetchgit {
    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
-    rev = "895092dea1da99ca1fa3c5c6d805384e579d417e";
-    hash = "sha256-ffbwQVQ1lL8XpubsGX6FTbJOjz1mbqCn+AKvR7xJhRw=";
+    rev = "deadb17b255b0733a2c552ae3638ecde0b9ee7d6";
+    hash = "sha256-xXq3yZjlp0ULzlSkBnc5SIRxwXZQQoIXgy0rztgFGHg=";
  };
  src = "${repoSrc}/think.greaterchiangmai.com";
 in
 php.buildComposerProject2 (finalAttrs: {
  pname = "think-gtcm";
-  version = "1.1.2";
+  version = "1.1.6";

  inherit src;

@@ -32,5 +32,5 @@ php.buildComposerProject2 (finalAttrs: {
  '';

  composerStrictValidation = false;
-  vendorHash = "sha256-rEE1C4uYNoVq5wiCooNnjj6uIQmSel7u9khAlM3hopk=";
+  vendorHash = "sha256-7M0nn3u8ERVFF6WiNjYByNdkFwHZz1vfoClybdOtIJ8=";
 })
@@ -4,12 +4,14 @@
    inputs.devshell.flakeModule
  ];
  perSystem =
-    { system, ... }:
+    { pkgs, system, ... }:
    {
      devshells.default = {
        devshell = {
          packages = [
-            inputs.clan-core.packages.${system}.clan-cli
+            # clan-core pins `nixVersions.nix_2_31` for a CI perf A/B test;
+            # nixos-unstable has dropped that attribute. Use nixpkgs' default nix.
+            (inputs.clan-core.packages.${system}.clan-cli.override { nix = pkgs.nix; })
          ];
        };
      };
Author	SHA1	Message	Date
kurogeek	7abdbfec85	inventory/borgbackup: fix ssh key path for cursa, hadar, procyon, bosona, canopus, deneb The sops vars backend deploys generator files at /run/secrets/vars/per-machine/<machine>/<generator>/<file>; the hard-coded rsh still pointed at /run/secrets/vars/borgbackup/borgbackup.ssh, so borgbackup-job-alex could not find its key. Align with alasia's entry.	2026-10-27 06:15:06 +00:00
kurogeek	63614d824a	inventory.json: update install time of alasia	2026-10-27 12:01:54 +07:00
kurogeek	cc7cb5aae9	machines/alasia/facter.json: update hardware configuration	2026-10-27 12:01:53 +07:00
kurogeek	2f36a34a95	gtcm-file-uploader: bump to deadb17 (1.1.6) upload-large-file untouched upstream; rev pinned in lockstep.	2026-10-27 02:20:53 +00:00
kurogeek	85d1591f05	think-gtcm, think-backend-gtcm: bump to deadb17 (1.1.6) composer.lock unchanged; vendorHash moves with the version (embedded in vendor/composer/installed.*).	2026-10-27 02:20:53 +00:00
kurogeek	9f76f7ddc2	gtcm-file-uploader: bump to c274e6d (1.1.5) upload-large-file untouched upstream; rev pinned in lockstep.	2026-10-27 02:04:04 +00:00
kurogeek	ee3059a8d7	think-gtcm, think-backend-gtcm: bump to c274e6d (1.1.5) composer.lock unchanged; vendorHash moves anyway because the vendor FOD embeds the root package version (vendor/composer/installed.*).	2026-10-27 02:04:04 +00:00
kurogeek	37496b974e	modules/prometheus: run alertmanager as a static user nixpkgs' alertmanager uses DynamicUser, so the `alertmanager` user only exists while the service is running. The matrix-alertmanager-urlfile secret is owned by that user; at boot sops-install-secrets cannot resolve it and rejects the whole manifest, leaving /run/secrets empty (no ssh host key, yggdrasil key, tor key, ...). Deploys masked it because the dynamic user was resolvable via nss-systemd at switch time. Create a static alertmanager user/group and disable DynamicUser.	2026-10-26 09:27:42 +00:00
kurogeek	452bd5f686	flake.lock: bump frappix to dbfa76d frappe v15.113.3 -> v15.120.1, erpnext v15.115.0 -> v15.121.2, insights v3.0.24 -> v3.12.6.	2026-10-26 07:54:10 +00:00
kurogeek	d8193f0652	bosona, canopus, deneb: apply frappix fixups overlay	2026-10-26 07:54:10 +00:00
kurogeek	ac2b1873b9	overlays: add frappix fixups for nixos-unstable (sql_metadata, rq_1) Building the frappix hosts on nixos-unstable 3ec6363 fails in frappix's python overlay: - sql_metadata 2.12.0 pins sqlparse<0.6, nixpkgs ships 0.6.0. frappe itself needs 0.6 (MAX_GROUPING_TOKENS), and sql_metadata 3.x needs sqlglot >= 30 which nixpkgs lacks, so relax the pin. frappe only feeds it SELECT statements; the only regressions on 0.6 are CREATE TABLE IF NOT EXISTS name extraction. - rq 1.16.2 test_parse_connection fails against redis-py 8.1 (extra himport_registry kwarg). Test-only; disable it. nix flake check does not catch these: it only evaluates hosts.	2026-10-26 07:54:10 +00:00
kurogeek	466dcba07c	gtcm-file-uploader: bump to fdb71d6 (1.1.4)	2026-10-26 07:09:32 +00:00
kurogeek	136daea65d	think-gtcm, think-backend-gtcm: bump to fdb71d6 (1.1.4) composer.lock unchanged; vendorHash moved with the php/composer bump in nixos-unstable 3ec6363.	2026-10-26 07:09:32 +00:00
kurogeek	835373fa06	flake.lock: bump clan-core to 9486215 Also moves clan-core/{disko,nix-darwin,sops-nix}.	2026-10-26 06:53:54 +00:00
kurogeek	d63c87d0bf	ramus, tangra, flake, overlays: drop php backport (nixpkgs#576853 landed) nixos-unstable 3ec6363 ships php83 8.3.36 / php85 8.5.12; the overlay was warning that it had become a no-op.	2026-10-26 06:53:54 +00:00
kurogeek	477af55f8c	flake: switch nixpkgs to nixos-unstable, bump to 3ec6363 nixos-unstable dropped nixVersions.nix_2_31, which clan-core still pins for clan-cli (pkgs/clan-cli/flake-module.nix); override it to pkgs.nix in the devshell.	2026-10-26 06:53:45 +00:00
kurogeek	c909e483b8	bosona, canopus, deneb: apply posthog workaround overlay	2026-10-26 06:53:24 +00:00
kurogeek	70be800f77	overlays: work around nixpkgs#578265 (posthog broken with mcp 2) nixpkgs#575004 bumped mcp 1.29 -> 2.2 and marked python3Packages.posthog broken; only one optional MCP test fails. frappe needs posthog at runtime. Skip that test and clear meta.broken until the upstream unbreak lands; the overlay warns at eval time once it does.	2026-10-26 06:53:24 +00:00
kurogeek	e04805f889	gtcm-file-uploader: bump to 225578a (1.1.3)	2026-10-23 09:31:23 +00:00
kurogeek	2b69d0d7c4	think-gtcm, think-backend-gtcm: bump to 225578a (1.1.3)	2026-10-23 09:31:23 +00:00