chore: update flake.lock

.github/workflows/merge_flake_lock_update.yml

@@ -19,5 +19,5 @@ jobs:
           python -m python.gitea_flake_lock merge
           --repo "${{ github.repository }}"
         env:
-          JEEVES_BOT_TOKEN: ${{ secrets.JEEVES_BOT_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_URL: https://gitea.tmmworkshop.com

.github/workflows/update-flake-lock.yml

@@ -18,7 +18,7 @@ jobs:
         run: nix flake update
       - name: Create or update flake.lock PR
         env:
-          JEEVES_BOT_TOKEN: ${{ secrets.JEEVES_BOT_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_URL: https://gitea.tmmworkshop.com
         run: >-
           nix develop .#devShells.x86_64-linux.default -c

.sops.yaml

@@ -1,9 +1,6 @@
 # Generate AGE keys from SSH keys with:
 #   ssh-keygen -A
 #   nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
-# update keys after addin/removing a key
-#   nix-shell -p sops --run "sops updatekeys users/secrets.yaml" users/secrets.yaml
-
 keys:
   - &admin_richie age1u8zj599elqqvcmhxn8zuwrufsz8w8w366d3ayrljjejljt2q45kq8mxw9c # cspell:disable-line
 
@@ -11,7 +8,6 @@ keys:
   - &system_brain age1jhf7vm0005j60mjq63696frrmjhpy8kpc2d66mw044lqap5mjv4snmwvwm # cspell:disable-line
   - &system_jeeves age13lmqgc3jvkyah5e3vcwmj4s5wsc2akctcga0lpc0x8v8du3fxprqp4ldkv # cspell:disable-line
   - &system_rhapsody age1ufnewppysaq2wwcl4ugngjz8pfzc5a35yg7luq0qmuqvctajcycs5lf6k4 # cspell:disable-line
-  - &system_portal_1 age1vyav6kxtvt3z4vtnkkjj38eu8hlts5m7ygyckhskvalg2gpjk52su53d0a # cspell:disable-line
 
 creation_rules:
   - path_regex: users/secrets\.yaml$
@@ -22,4 +18,3 @@ creation_rules:
           - *system_brain
           - *system_jeeves
           - *system_rhapsody
-          - *system_portal_1

Cargo.toml

@@ -1,4 +0,0 @@
-[workspace]
-resolver = "2"
-
-members = ["rust/*"]

common/global/default.nix

@@ -17,11 +17,16 @@
     ./nix.nix
     ./programs.nix
     ./ssh.nix
+    ./snapshot_manager.nix
   ];
 
   boot = {
-    tmp.useTmpfs = lib.mkDefault true;
+    tmp.useTmpfs = true;
     kernelPackages = lib.mkDefault pkgs.linuxPackages_6_12;
+    zfs = {
+      package = lib.mkDefault pkgs.zfs_2_4;
+      forceImportRoot = lib.mkDefault false;
+    };
   };
 
   hardware.enableRedistributableFirmware = true;
@@ -37,6 +42,9 @@
     overlays = builtins.attrValues outputs.overlays;
     config = {
       allowUnfree = true;
+      permittedInsecurePackages = [
+        "openssl-1.1.1w" # This is for discord-canary
+      ];
     };
   };
 
@@ -45,6 +53,16 @@
 
     # firmware update
     fwupd.enable = true;
+
+    snapshot_manager = {
+      enable = lib.mkDefault true;
+      PYTHONPATH = "${inputs.self}/";
+    };
+
+    zfs = {
+      trim.enable = lib.mkDefault true;
+      autoScrub.enable = lib.mkDefault true;
+    };
   };
 
   powerManagement.powertop.enable = lib.mkDefault true;

common/optional/monitoring-agent.nix

@@ -5,7 +5,7 @@
   ...
 }:
 let
-  monitoringInterface = "tailscale0";
+  monitoringInterface = "ztwfunumly";
   nodeTextfileDir = "/var/lib/prometheus-node-exporter-textfile";
 
   mkProcessNameTemplate =

common/optional/tailscale.nix

@@ -1,37 +0,0 @@
-{
-  config,
-  inputs,
-  ...
-}:
-{
-  nix.settings = {
-    trusted-substituters = [ "http://jeeves:5000" ];
-    substituters = [ "http://jeeves:5000/?priority=1&want-mass-query=true" ];
-    trusted-public-keys = [ "cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA=" ];
-  };
-
-  services.tailscale = {
-    enable = true;
-    openFirewall = true;
-    authKeyFile = config.sops.secrets.tailscale_auth_key.path;
-
-    # OAuth client secrets create ephemeral nodes by default. NixOS machines
-    # are persistent and should enroll without interactive device approval.
-    authKeyParameters = {
-      ephemeral = false;
-      preauthorized = true;
-    };
-
-    extraUpFlags = [ "--advertise-tags=tag:nixos" ];
-  };
-
-  sops = {
-    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
-    secrets.tailscale_auth_key = {
-      sopsFile = "${inputs.self}/users/secrets.yaml";
-      owner = "root";
-      mode = "0400";
-    };
-  };
-}

common/optional/zerotier.nix

@@ -0,0 +1,11 @@
+{
+  services.zerotierone = {
+    enable = true;
+    joinNetworks = [ "e4da7455b2ae64ca" ];
+  };
+  nix.settings = {
+    trusted-substituters = [ "http://192.168.90.40:5000" ];
+    substituters = [ "http://192.168.90.40:5000/?priority=1&want-mass-query=true" ];
+    trusted-public-keys = [ "cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA=" ];
+  };
+}

common/optional/zfs/default.nix

@@ -1,26 +0,0 @@
-{
-  inputs,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  imports = [ ./snapshot.nix ];
-
-  boot.zfs = {
-    package = lib.mkDefault pkgs.zfs_2_4;
-    forceImportRoot = lib.mkDefault false;
-  };
-
-  services = {
-    snapshot_manager = {
-      enable = lib.mkDefault true;
-      PYTHONPATH = "${inputs.self}/";
-    };
-
-    zfs = {
-      trim.enable = lib.mkDefault true;
-      autoScrub.enable = lib.mkDefault true;
-    };
-  };
-}

flake.lock

@@ -1,25 +1,5 @@
 {
   "nodes": {
-    "disko": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781152676,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
-        "owner": "nix-community",
-        "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "disko",
-        "type": "github"
-      }
-    },
     "firefox-addons": {
       "inputs": {
         "nixpkgs": [
@@ -28,11 +8,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1787025780,
-        "narHash": "sha256-NhyLP9G4DFOn/7aYr7K/D7hWrzEGr5EgUBV+lpdmJ24=",
+        "lastModified": 1786075368,
+        "narHash": "sha256-vSiTq6wa9WiKGHOdCRlABkKksOgfrsUuRz/K6tQ9EYA=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "5ad360b6d3cb0aa1b61f9cb27fef113ca9117c37",
+        "rev": "f516bdb9bc003c9d1f041d8ad9f0a9627fe800d2",
         "type": "gitlab"
       },
       "original": {
@@ -49,11 +29,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786999651,
-        "narHash": "sha256-MTGMFlLDTklsXhCp4r5GXB4VAVadPdalXLvUjd/K7h0=",
+        "lastModified": 1786031233,
+        "narHash": "sha256-TIDlLTLI1/pB7IqgjzcKQjpODQsZE2oII4XGG9B6KjI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "353742587cbaf079b3caee743115d037bc51fea6",
+        "rev": "7834e82588860aaf780cec1366524456a70898d7",
         "type": "github"
       },
       "original": {
@@ -67,11 +47,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1786867632,
-        "narHash": "sha256-ez+ubZlA1RtdjCB18a6zJ9M4u8qoPDy08EcnsW5M3Xw=",
+        "lastModified": 1785232496,
+        "narHash": "sha256-65EQYIRRpTdpH8lUiB6Mvo5uBkG60aBIzAJuALfx+O0=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "ff17823245ab9ff7bcae6acf950bd89cba82c38c",
+        "rev": "2e790b0a6be8ec2b76174ac0931b8ff11919ec98",
         "type": "github"
       },
       "original": {
@@ -96,11 +76,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1787081018,
-        "narHash": "sha256-K0uwZBtZsbBigHAMQW7YWti3gPe6a5ct5bcOw5F+Q9Y=",
+        "lastModified": 1786146526,
+        "narHash": "sha256-fNl4co87gT5b7Q/S205uV0TUS7rVdZpZBf5OODk5fW8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "cacac5ac351a010599d9f9d106acfed25a8e4c77",
+        "rev": "593eeb4d36f60968c197fcb5f356e1e09927415f",
         "type": "github"
       },
       "original": {
@@ -128,11 +108,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1787001381,
-        "narHash": "sha256-Ue1Yo8gfHdD4TMtNewhA4tkSYeFqXThju0nCyJc3ALo=",
+        "lastModified": 1785967620,
+        "narHash": "sha256-IItrdb7Puk05RqOBWZYFC5X6Wl1sJmCfh5MWVHw5iMM=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "ec2d622de0773551768cf98f3fc50cbcc003b9c5",
+        "rev": "b7c2ada94fe99c15b0dbcf4d11fd7850b957a436",
         "type": "github"
       },
       "original": {
@@ -144,7 +124,6 @@
     },
     "root": {
       "inputs": {
-        "disko": "disko",
         "firefox-addons": "firefox-addons",
         "home-manager": "home-manager",
         "nixos-hardware": "nixos-hardware",
@@ -162,11 +141,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786629091,
-        "narHash": "sha256-gkig4nPi1CWc4Z50GBsjE4ygSE7hMpl/TwID2an2Cck=",
+        "lastModified": 1783174389,
+        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "a8627b21b9107c5711c96b84f32a9a4b3d45295f",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
         "type": "github"
       },
       "original": {

flake.nix

@@ -35,11 +35,6 @@
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
-    disko = {
-      url = "github:nix-community/disko";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
   };
 
   outputs =

pyproject.toml

@@ -65,7 +65,6 @@ lint.ignore = [
     "ISC001", # (TEMP) conflicts when used with the formatter
     "S603",   # (PERM) This is known to cause a false positive
     "S607",   # (PERM) This is becoming a consistent annoyance
-    "CPY001",  # (PERM) I don't include the license in every file
 ]
 
 [tool.ruff.lint.per-file-ignores]

python/ebook_search/config.py

@@ -37,7 +37,7 @@ class RerankConfig(BaseSettings):
     model_config = SettingsConfigDict(env_prefix="EBOOK_SEARCH_RERANK_", frozen=True, protected_namespaces=())
 
     enabled: bool = True
-    base_url: str = "http://bob:8001"
+    base_url: str = "http://192.168.90.25:8001"
     model: str = "qwen3-reranker-06b"
     candidates: int = 24
     timeout_seconds: float = 30.0
@@ -67,7 +67,7 @@ class EbookSearchConfig(BaseSettings):
     )
     chat_model: str = "deepseek-v4-flash"
     answer_enabled: bool = True
-    embedding_base_url: str = "http://bob:8000/v1"
+    embedding_base_url: str = "http://192.168.90.25:8000/v1"
     embedding_api_key: str = "not-needed"
     embedding_model: str = "qwen3-embedding-0.6b"
     embedding_batch_size: int = 32

python/ebook_search/docker/docker-compose.yml

@@ -9,6 +9,8 @@ services:
     restart: unless-stopped
     ports:
       - "${EBOOK_SEARCH_PORT:-8070}:8070"
+    extra_hosts:
+      - "jeeves:192.168.90.40"
     env_file:
       - ../../../.env
     environment:

python/gitea_flake_lock.py

@@ -84,13 +84,13 @@ def push_branch(*, branch: str) -> None:
     run_cmd(["git", "push", "origin", f"HEAD:{branch}", "--force"])
 
 
-def _required_jeeves_bot_token() -> str:
+def _required_gitea_token() -> str:
     """Read the required Gitea token from the environment."""
-    token = getenv("JEEVES_BOT_TOKEN")
+    token = getenv("GITEA_TOKEN")
     if token:
         return token
 
-    msg = "JEEVES_BOT_TOKEN environment variable is required"
+    msg = "GITEA_TOKEN environment variable is required"
     raise RuntimeError(msg)
 
 
@@ -111,7 +111,7 @@ def update(
     owner, repo_name = split_repo_name(repo)
     with GiteaClient(
         base_url=getenv("GITEA_URL", DEFAULT_GITEA_URL),
-        token=_required_jeeves_bot_token(),
+        token=_required_gitea_token(),
     ) as client:
         pull_request = ensure_flake_lock_pull_request(
             client,
@@ -134,7 +134,7 @@ def merge(
     owner, repo_name = split_repo_name(repo)
     with GiteaClient(
         base_url=getenv("GITEA_URL", DEFAULT_GITEA_URL),
-        token=_required_jeeves_bot_token(),
+        token=_required_gitea_token(),
     ) as client:
         pull_request = find_flake_lock_pull_request(client, owner=owner, repo=repo_name)
         if not pull_request:

rust/van_weather/Cargo.toml

@@ -1,21 +0,0 @@
-[package]
-name = "van-weather"
-version = "0.1.0"
-edition = "2024"
-description = "Fetch privacy-masked weather for a van and publish it to Home Assistant"
-license = "MIT"
-
-[dependencies]
-anyhow = "1.0"
-chrono = "0.4"
-clap = { version = "4.5", features = ["derive", "env"] }
-env_logger = "0.11"
-log = "0.4"
-reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
-serde = { version = "1.0", features = ["derive"] }
-serde_json = "1.0"
-
-[lints.clippy]
-all = "deny"
-pedantic = "deny"
-

rust/van_weather/package.nix

@@ -1,13 +0,0 @@
-{ rustPlatform }:
-rustPlatform.buildRustPackage {
-  pname = "van-weather";
-  version = "0.1.0";
-  src = ./.;
-
-  cargoLock.lockFile = ./Cargo.lock;
-
-  meta = {
-    description = "Privacy-masked van weather publisher for Home Assistant";
-    mainProgram = "van-weather";
-  };
-}

rust/van_weather/src/main.rs

@@ -1,565 +0,0 @@
-use std::{thread, time::Duration};
-
-use anyhow::{Context, Result, bail};
-use chrono::{DateTime, Utc};
-use clap::Parser;
-use log::{error, info};
-use reqwest::{
-    StatusCode, Url,
-    blocking::{Client, ClientBuilder},
-    header::{AUTHORIZATION, HeaderMap, HeaderValue},
-    retry,
-};
-use serde::Deserialize;
-use serde_json::{Value, json};
-
-const LAT_ENTITY: &str = "sensor.van_last_known_latitude";
-const LON_ENTITY: &str = "sensor.van_last_known_longitude";
-const PIRATE_WEATHER_HOST: &str = "api.pirateweather.net";
-const MASK_DECIMALS: u32 = 1;
-const MASK_FACTOR: f64 = decimal_factor(MASK_DECIMALS);
-const RETRIES_PER_REQUEST: u32 = 2;
-
-const fn decimal_factor(decimals: u32) -> f64 {
-    let mut factor = 1.0;
-    let mut remaining = decimals;
-    while remaining > 0 {
-        factor *= 10.0;
-        remaining -= 1;
-    }
-    factor
-}
-
-#[derive(Debug, Parser)]
-#[command(about, version)]
-struct Args {
-    #[arg(long, env = "HA_URL")]
-    ha_url: String,
-
-    #[arg(long, env = "HA_TOKEN", hide_env_values = true)]
-    ha_token: String,
-
-    #[arg(long, env = "PIRATE_WEATHER_API_KEY", hide_env_values = true)]
-    pirate_weather_api_key: String,
-
-    #[arg(
-        long,
-        default_value_t = 900,
-        value_parser = clap::value_parser!(u64).range(1..)
-    )]
-    interval: u64,
-
-    #[arg(long, default_value = "info", env = "RUST_LOG")]
-    log_level: String,
-}
-
-#[derive(Debug, Deserialize)]
-struct HaState {
-    state: String,
-}
-
-#[derive(Debug)]
-struct HttpClients {
-    home_assistant: Client,
-    pirate_weather: Client,
-}
-
-#[derive(Debug, Default, Deserialize)]
-struct ApiResponse {
-    #[serde(default)]
-    currently: CurrentWeather,
-    #[serde(default)]
-    daily: ForecastBlock<DailyApiForecast>,
-    #[serde(default)]
-    hourly: ForecastBlock<HourlyApiForecast>,
-}
-
-#[derive(Debug, Default, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct CurrentWeather {
-    temperature: Option<f64>,
-    apparent_temperature: Option<f64>,
-    humidity: Option<f64>,
-    wind_speed: Option<f64>,
-    wind_bearing: Option<f64>,
-    icon: Option<String>,
-    pressure: Option<f64>,
-    visibility: Option<f64>,
-    uv_index: Option<f64>,
-    ozone: Option<f64>,
-    nearest_storm_distance: Option<f64>,
-    nearest_storm_bearing: Option<f64>,
-    precip_probability: Option<f64>,
-    cloud_cover: Option<f64>,
-}
-
-#[derive(Debug, Deserialize)]
-struct ForecastBlock<T> {
-    #[serde(default)]
-    data: Vec<T>,
-}
-
-impl<T> Default for ForecastBlock<T> {
-    fn default() -> Self {
-        Self { data: Vec::new() }
-    }
-}
-
-#[derive(Debug, Default, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct DailyApiForecast {
-    time: Option<i64>,
-    icon: Option<String>,
-    temperature_high: Option<f64>,
-    temperature_low: Option<f64>,
-    precip_probability: Option<f64>,
-}
-
-#[derive(Debug, Default, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct HourlyApiForecast {
-    time: Option<i64>,
-    icon: Option<String>,
-    temperature: Option<f64>,
-    precip_probability: Option<f64>,
-}
-
-#[derive(Debug)]
-struct Weather {
-    current: CurrentWeather,
-    daily: Vec<DailyForecast>,
-    hourly: Vec<HourlyForecast>,
-}
-
-#[derive(Debug)]
-struct DailyForecast {
-    datetime: DateTime<Utc>,
-    condition: &'static str,
-    temperature: Option<f64>,
-    templow: Option<f64>,
-    precipitation_probability: Option<f64>,
-}
-
-#[derive(Debug)]
-struct HourlyForecast {
-    datetime: DateTime<Utc>,
-    condition: &'static str,
-    temperature: Option<f64>,
-    precipitation_probability: Option<f64>,
-}
-
-fn main() -> Result<()> {
-    let Args {
-        ha_url,
-        ha_token,
-        pirate_weather_api_key,
-        interval,
-        log_level,
-    } = Args::parse();
-    env_logger::Builder::from_env(env_logger::Env::default().default_filter_or(log_level.as_str()))
-        .init();
-
-    let ha_url = ha_url.trim_end_matches('/').to_owned();
-    let ha_host = Url::parse(&ha_url)
-        .context("HA_URL is not a valid URL")?
-        .host_str()
-        .context("HA_URL has no host")?
-        .to_owned();
-    let clients = HttpClients {
-        home_assistant: build_client(&ha_host, Some(&ha_token))?,
-        pirate_weather: build_client(PIRATE_WEATHER_HOST, None)?,
-    };
-
-    info!("Starting van weather service, polling every {interval}s");
-    loop {
-        if let Err(err) = update_weather(&clients, &ha_url, &pirate_weather_api_key) {
-            error!("Weather update failed: {err:#}");
-        }
-        thread::sleep(Duration::from_secs(interval));
-    }
-}
-
-fn build_client(host: &str, bearer_token: Option<&str>) -> Result<Client> {
-    let policy = retry::for_host(host.to_owned())
-        .max_retries_per_request(RETRIES_PER_REQUEST)
-        .classify_fn(|request| {
-            let retryable = request.error().is_some()
-                || request.status().is_some_and(|status| {
-                    status == StatusCode::REQUEST_TIMEOUT
-                        || status == StatusCode::TOO_MANY_REQUESTS
-                        || status.is_server_error()
-                });
-            if retryable {
-                request.retryable()
-            } else {
-                request.success()
-            }
-        });
-
-    let mut builder = ClientBuilder::new()
-        .timeout(Duration::from_secs(30))
-        .retry(policy);
-
-    if let Some(token) = bearer_token {
-        let mut authorization = HeaderValue::from_str(&format!("Bearer {token}"))
-            .context("HA_TOKEN contains invalid header characters")?;
-        authorization.set_sensitive(true);
-        let mut headers = HeaderMap::new();
-        headers.insert(AUTHORIZATION, authorization);
-        builder = builder.default_headers(headers);
-    }
-
-    builder
-        .build()
-        .with_context(|| format!("failed to create HTTP client for {host}"))
-}
-
-fn update_weather(clients: &HttpClients, ha_url: &str, api_key: &str) -> Result<()> {
-    let lat = get_ha_state(&clients.home_assistant, ha_url, LAT_ENTITY)?;
-    let lon = get_ha_state(&clients.home_assistant, ha_url, LON_ENTITY)?;
-    let masked_lat = mask_coordinate(lat);
-    let masked_lon = mask_coordinate(lon);
-    info!("Masked location: {masked_lat}, {masked_lon}");
-
-    let weather = fetch_weather(&clients.pirate_weather, api_key, masked_lat, masked_lon)?;
-    info!(
-        "Weather: {}°F, {}",
-        weather
-            .current
-            .temperature
-            .map_or_else(|| "unknown".to_owned(), |value| value.to_string()),
-        condition(weather.current.icon.as_deref())
-    );
-    post_to_ha(&clients.home_assistant, ha_url, &weather)?;
-    info!("Posted weather to Home Assistant");
-    Ok(())
-}
-
-fn mask_coordinate(value: f64) -> f64 {
-    (value * MASK_FACTOR).round() / MASK_FACTOR
-}
-
-fn get_ha_state(client: &Client, ha_url: &str, entity_id: &str) -> Result<f64> {
-    let HaState { state } = client
-        .get(format!("{ha_url}/api/states/{entity_id}"))
-        .send()
-        .with_context(|| format!("request for {entity_id} failed"))?
-        .error_for_status()
-        .with_context(|| format!("Home Assistant rejected {entity_id} request"))?
-        .json()
-        .context("Home Assistant returned invalid JSON")?;
-
-    if matches!(state.as_str(), "unavailable" | "unknown") {
-        bail!("{entity_id} is {state}");
-    }
-
-    state
-        .parse::<f64>()
-        .with_context(|| format!("{entity_id} state is not numeric: {state}"))
-}
-
-fn fetch_weather(client: &Client, api_key: &str, lat: f64, lon: f64) -> Result<Weather> {
-    let response = client
-        .get(format!(
-            "https://{PIRATE_WEATHER_HOST}/forecast/{api_key}/{lat},{lon}"
-        ))
-        .query(&[("units", "us")])
-        .send()
-        .context("Pirate Weather request failed")?
-        .error_for_status()
-        .context("Pirate Weather rejected request")?;
-    let data = response
-        .json::<ApiResponse>()
-        .context("Pirate Weather returned invalid JSON")?;
-    Ok(parse_weather(data))
-}
-
-fn parse_weather(data: ApiResponse) -> Weather {
-    let daily = data
-        .daily
-        .data
-        .into_iter()
-        .take(8)
-        .filter_map(|day| {
-            timestamp(day.time).map(|datetime| DailyForecast {
-                datetime,
-                condition: condition(day.icon.as_deref()),
-                temperature: day.temperature_high,
-                templow: day.temperature_low,
-                precipitation_probability: day.precip_probability,
-            })
-        })
-        .collect();
-    let hourly = data
-        .hourly
-        .data
-        .into_iter()
-        .take(48)
-        .filter_map(|hour| {
-            timestamp(hour.time).map(|datetime| HourlyForecast {
-                datetime,
-                condition: condition(hour.icon.as_deref()),
-                temperature: hour.temperature,
-                precipitation_probability: hour.precip_probability,
-            })
-        })
-        .collect();
-    Weather {
-        current: data.currently,
-        daily,
-        hourly,
-    }
-}
-
-fn timestamp(value: Option<i64>) -> Option<DateTime<Utc>> {
-    value
-        .filter(|value| *value != 0)
-        .and_then(DateTime::from_timestamp_secs)
-}
-
-fn condition(icon: Option<&str>) -> &'static str {
-    match icon.unwrap_or_default() {
-        "clear-day" => "sunny",
-        "clear-night" => "clear-night",
-        "rain" => "rainy",
-        "snow" => "snowy",
-        "sleet" => "snowy-rainy",
-        "wind" => "windy",
-        "fog" => "fog",
-        "partly-cloudy-day" | "partly-cloudy-night" => "partlycloudy",
-        _ => "cloudy",
-    }
-}
-
-fn post_to_ha(client: &Client, ha_url: &str, weather: &Weather) -> Result<()> {
-    for (entity_id, payload) in weather_updates(weather) {
-        let response = client
-            .post(format!("{ha_url}/api/states/{entity_id}"))
-            .json(&payload)
-            .send()
-            .with_context(|| format!("failed to post {entity_id}"))?;
-        ensure_success(response.status(), &entity_id)?;
-    }
-    Ok(())
-}
-
-fn ensure_success(status: StatusCode, entity_id: &str) -> Result<()> {
-    if status.is_success() {
-        Ok(())
-    } else {
-        bail!("Home Assistant rejected {entity_id} update with {status}")
-    }
-}
-
-#[allow(clippy::too_many_lines)]
-fn weather_updates(weather: &Weather) -> Vec<(String, Value)> {
-    let current = &weather.current;
-    let mut updates = vec![
-        sensor(
-            "sensor.van_weather_condition",
-            Some(json!(condition(current.icon.as_deref()))),
-            json!({"friendly_name": "Van Weather Condition"}),
-        ),
-        sensor(
-            "sensor.van_weather_temperature",
-            current.temperature.map(|value| json!(value)),
-            json!({"unit_of_measurement": "°F", "device_class": "temperature"}),
-        ),
-        sensor(
-            "sensor.van_weather_apparent_temperature",
-            current.apparent_temperature.map(|value| json!(value)),
-            json!({"unit_of_measurement": "°F", "device_class": "temperature"}),
-        ),
-        sensor(
-            "sensor.van_weather_humidity",
-            Some(json!(percent(current.humidity))),
-            json!({"unit_of_measurement": "%", "device_class": "humidity"}),
-        ),
-        sensor(
-            "sensor.van_weather_pressure",
-            current.pressure.map(|value| json!(value)),
-            json!({"unit_of_measurement": "mbar", "device_class": "pressure"}),
-        ),
-        sensor(
-            "sensor.van_weather_wind_speed",
-            current.wind_speed.map(|value| json!(value)),
-            json!({"unit_of_measurement": "mph", "device_class": "wind_speed"}),
-        ),
-        sensor(
-            "sensor.van_weather_wind_bearing",
-            current.wind_bearing.map(|value| json!(value)),
-            json!({"unit_of_measurement": "°"}),
-        ),
-        sensor(
-            "sensor.van_weather_visibility",
-            current.visibility.map(|value| json!(value)),
-            json!({"unit_of_measurement": "mi"}),
-        ),
-        sensor(
-            "sensor.van_weather_uv_index",
-            current.uv_index.map(|value| json!(value)),
-            json!({"friendly_name": "Van Weather UV Index", "icon": "mdi:sun-wireless"}),
-        ),
-        sensor(
-            "sensor.van_weather_ozone",
-            current.ozone.map(|value| json!(value)),
-            json!({"unit_of_measurement": "DU", "icon": "mdi:earth"}),
-        ),
-        sensor(
-            "sensor.van_weather_nearest_storm_distance",
-            current.nearest_storm_distance.map(|value| json!(value)),
-            json!({"unit_of_measurement": "mi", "icon": "mdi:weather-lightning"}),
-        ),
-        sensor(
-            "sensor.van_weather_nearest_storm_bearing",
-            current.nearest_storm_bearing.map(|value| json!(value)),
-            json!({"unit_of_measurement": "°", "icon": "mdi:weather-lightning"}),
-        ),
-        sensor(
-            "sensor.van_weather_precip_probability",
-            Some(json!(percent(current.precip_probability))),
-            json!({"unit_of_measurement": "%", "icon": "mdi:weather-rainy"}),
-        ),
-        sensor(
-            "sensor.van_weather_cloud_cover",
-            Some(json!(percent(current.cloud_cover))),
-            json!({"unit_of_measurement": "%", "icon": "mdi:weather-cloudy"}),
-        ),
-    ]
-    .into_iter()
-    .flatten()
-    .collect::<Vec<_>>();
-
-    let daily = weather
-        .daily
-        .iter()
-        .map(|forecast| {
-            json!({
-                "datetime": forecast.datetime.to_rfc3339(),
-                "condition": forecast.condition,
-                "temperature": forecast.temperature,
-                "templow": forecast.templow,
-                "precipitation_probability": percent(forecast.precipitation_probability),
-            })
-        })
-        .collect::<Vec<_>>();
-    updates.push((
-        "sensor.van_weather_forecast_daily".to_owned(),
-        json!({"state": daily.len(), "attributes": {"forecast": daily}}),
-    ));
-
-    let hourly = weather
-        .hourly
-        .iter()
-        .map(|forecast| {
-            json!({
-                "datetime": forecast.datetime.to_rfc3339(),
-                "condition": forecast.condition,
-                "temperature": forecast.temperature,
-                "precipitation_probability": percent(forecast.precipitation_probability),
-            })
-        })
-        .collect::<Vec<_>>();
-    updates.push((
-        "sensor.van_weather_forecast_hourly".to_owned(),
-        json!({"state": hourly.len(), "attributes": {"forecast": hourly}}),
-    ));
-    updates
-}
-
-fn sensor(entity_id: &str, state: Option<Value>, attributes: Value) -> Option<(String, Value)> {
-    state.map(|state| {
-        let mut payload = serde_json::Map::new();
-        payload.insert("state".to_owned(), state);
-        payload.insert("attributes".to_owned(), attributes);
-        (entity_id.to_owned(), Value::Object(payload))
-    })
-}
-
-#[allow(clippy::cast_possible_truncation)]
-fn percent(value: Option<f64>) -> i64 {
-    // Preserve Python's int(probability * 100) behavior for Home Assistant.
-    (value.unwrap_or_default() * 100.0) as i64
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn maps_conditions_for_home_assistant() {
-        assert_eq!(condition(Some("clear-day")), "sunny");
-        assert_eq!(condition(Some("sleet")), "snowy-rainy");
-        assert_eq!(condition(Some("partly-cloudy-night")), "partlycloudy");
-        assert_eq!(condition(Some("unexpected")), "cloudy");
-        assert_eq!(condition(None), "cloudy");
-    }
-
-    #[test]
-    fn parses_api_response_and_builds_compatible_payloads() {
-        let response: ApiResponse = serde_json::from_value(json!({
-            "currently": {
-                "temperature": 72.5,
-                "humidity": 0.67,
-                "icon": "clear-day",
-                "precipProbability": 0.129,
-                "cloudCover": 0.4,
-                "summary": "Fine"
-            },
-            "daily": {"data": [{
-                "time": 1_700_000_000,
-                "icon": "rain",
-                "temperatureHigh": 75.0,
-                "temperatureLow": 52.0,
-                "precipProbability": 0.8
-            }]},
-            "hourly": {"data": [{
-                "time": 1_700_000_000,
-                "icon": "fog",
-                "temperature": 61.0,
-                "precipProbability": 0.05
-            }]}
-        }))
-        .unwrap();
-
-        let weather = parse_weather(response);
-        let updates = weather_updates(&weather);
-        let find = |id: &str| updates.iter().find(|(entity, _)| entity == id).unwrap();
-
-        assert_eq!(find("sensor.van_weather_condition").1["state"], "sunny");
-        assert_eq!(find("sensor.van_weather_humidity").1["state"], 67);
-        assert_eq!(find("sensor.van_weather_precip_probability").1["state"], 12);
-        assert_eq!(find("sensor.van_weather_forecast_daily").1["state"], 1);
-        assert_eq!(
-            find("sensor.van_weather_forecast_daily").1["attributes"]["forecast"][0]["condition"],
-            "rainy"
-        );
-        assert_eq!(find("sensor.van_weather_forecast_hourly").1["state"], 1);
-    }
-
-    #[test]
-    fn omits_missing_optional_current_sensors_but_keeps_percentage_sensors() {
-        let weather = parse_weather(ApiResponse::default());
-        let updates = weather_updates(&weather);
-
-        assert!(
-            !updates
-                .iter()
-                .any(|(id, _)| id == "sensor.van_weather_temperature")
-        );
-        assert_eq!(
-            updates
-                .iter()
-                .find(|(id, _)| id == "sensor.van_weather_humidity")
-                .unwrap()
-                .1["state"],
-            0
-        );
-    }
-
-    #[test]
-    fn masks_coordinates_to_about_eleven_kilometres() {
-        assert!((mask_coordinate(37.7749) - 37.8).abs() < f64::EPSILON);
-        assert!((mask_coordinate(-122.4194) - (-122.4)).abs() < f64::EPSILON);
-    }
-}

systems/bob/default.nix

@@ -6,16 +6,15 @@
     "${inputs.self}/users/steve"
     "${inputs.self}/common/global"
     "${inputs.self}/common/optional/docker.nix"
-    "${inputs.self}/common/optional/monitoring-agent.nix"
-    "${inputs.self}/common/optional/nvidia.nix"
     "${inputs.self}/common/optional/scanner.nix"
+    "${inputs.self}/common/optional/monitoring-agent.nix"
     "${inputs.self}/common/optional/steam.nix"
     "${inputs.self}/common/optional/syncthing_base.nix"
     "${inputs.self}/common/optional/systemd-boot.nix"
-    "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/update.nix"
     "${inputs.self}/common/optional/yubikey.nix"
-    "${inputs.self}/common/optional/zfs"
+    "${inputs.self}/common/optional/zerotier.nix"
+    "${inputs.self}/common/optional/nvidia.nix"
     ./hardware.nix
     ./syncthing.nix
     ./llms.nix

systems/brain/default.nix

@@ -7,9 +7,8 @@
     "${inputs.self}/common/optional/ssh_decrypt.nix"
     "${inputs.self}/common/optional/syncthing_base.nix"
     "${inputs.self}/common/optional/systemd-boot.nix"
-    "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/update.nix"
-    "${inputs.self}/common/optional/zfs"
+    "${inputs.self}/common/optional/zerotier.nix"
     ./docker
     ./hardware.nix
     ./programs.nix

systems/brain/services/home_assistant.nix

@@ -1,7 +1,5 @@
 { pkgs, ... }:
 {
-  networking.firewall.allowedTCPPorts = [ 8123 ];
-
   users = {
     users.hass = {
       isSystemUser = true;
@@ -13,7 +11,9 @@
   services = {
     home-assistant = {
       enable = true;
+      openFirewall = true;
       config = {
+        http.server_port = 8123;
         homeassistant = {
           time_zone = "America/New_York";
           unit_system = "us_customary";
@@ -21,7 +21,6 @@
           packages = {
             victron_modbuss = "!include ${./home_assistant/victron_modbuss.yaml}";
             battery_sensors = "!include ${./home_assistant/battery_sensors.yaml}";
-            energy_meters = "!include ${./home_assistant/energy_meters.yaml}";
             gps_location = "!include ${./home_assistant/gps_location.yaml}";
             heater = "!include ${./home_assistant/heater.yaml}";
             van_weather = "!include ${./home_assistant/van_weather_template.yaml}";
@@ -74,11 +73,10 @@
           uiprotect # for ubiquiti integration
           unifi-discovery # for ubiquiti integration
           jsonpath # for rest sensors
-          monarchmoneycommunity # for monarch
+          typedmonarchmoney # for monarch
         ];
       extraComponents = [ "isal" ];
       customComponents = with pkgs.home-assistant-custom-components; [
-        garmin_connect
         pirate-weather
       ];
 
@@ -86,7 +84,7 @@
     esphome = {
       enable = true;
       openFirewall = true;
-      address = "0.0.0.0";
+      address = "192.168.90.35";
     };
   };
 }

systems/brain/services/home_assistant/energy_meters.yaml

@@ -1,71 +0,0 @@
-template:
-  - sensor:
-      - name: "JK0 Energy In Clean"
-        unique_id: jk0_energy_in_clean
-        unit_of_measurement: "kWh"
-        device_class: energy
-        state_class: total_increasing
-        availability: >-
-          {{ is_number(states('sensor.jk0_energy_in')) }}
-        state: >-
-          {{ states('sensor.jk0_energy_in') | float }}
-
-      - name: "JK0 Energy Out Clean"
-        unique_id: jk0_energy_out_clean
-        unit_of_measurement: "kWh"
-        device_class: energy
-        state_class: total_increasing
-        availability: >-
-          {{ is_number(states('sensor.jk0_energy_out')) }}
-        state: >-
-          {{ states('sensor.jk0_energy_out') | float }}
-
-      - name: "JK1 Energy In Clean"
-        unique_id: jk1_energy_in_clean
-        unit_of_measurement: "kWh"
-        device_class: energy
-        state_class: total_increasing
-        availability: >-
-          {{ is_number(states('sensor.jk1_energy_in')) }}
-        state: >-
-          {{ states('sensor.jk1_energy_in') | float }}
-
-      - name: "JK1 Energy Out Clean"
-        unique_id: jk1_energy_out_clean
-        unit_of_measurement: "kWh"
-        device_class: energy
-        state_class: total_increasing
-        availability: >-
-          {{ is_number(states('sensor.jk1_energy_out')) }}
-        state: >-
-          {{ states('sensor.jk1_energy_out') | float }}
-
-      - name: "Solar Yield Clean"
-        unique_id: solar_yield_clean
-        unit_of_measurement: "kWh"
-        device_class: energy
-        state_class: total_increasing
-        availability: >-
-          {{ is_number(states('sensor.solar_yield_daily')) }}
-        state: >-
-          {{ states('sensor.solar_yield_daily') | float }}
-
-      - name: "DC Load Energy Clean"
-        unique_id: dc_load_energy_clean
-        unit_of_measurement: "kWh"
-        device_class: energy
-        state_class: total_increasing
-        availability: >-
-          {{ is_number(states('sensor.dc_load_energy_daily')) }}
-        state: >-
-          {{ states('sensor.dc_load_energy_daily') | float }}
-
-      - name: "DC Charger Energy Clean"
-        unique_id: dc_charger_energy_clean
-        unit_of_measurement: "kWh"
-        device_class: energy
-        state_class: total_increasing
-        availability: >-
-          {{ is_number(states('sensor.dc_charger_energy')) }}
-        state: >-
-          {{ states('sensor.dc_charger_energy') | float }}

systems/brain/services/postgress.nix

@@ -19,7 +19,7 @@
       local all  richie   trust
       host  all  richie   127.0.0.1/32    trust
       host  all  richie   ::1/128         trust
-      host  all  richie   100.64.0.0/10 trust
+      host  all  richie   192.168.90.1/24 trust
       host  all  richie   192.168.99.1/24 trust
 
       local vaninventory vaninventory trust
@@ -28,7 +28,7 @@
       local hass     hass     trust
 
       # ipv4
-      host  hass     hass     100.64.0.0/10 trust
+      host  hass     hass     192.168.90.1/24 trust
       host  hass     hass     127.0.0.1/32 trust
 
       # ipv6

systems/brain/services/van_weather.nix

@@ -1,10 +1,8 @@
 {
   pkgs,
+  inputs,
   ...
 }:
-let
-  van-weather = pkgs.callPackage ../../../rust/van_weather/package.nix { };
-in
 {
   systemd.services.van-weather = {
     description = "Van Weather Service";
@@ -15,9 +13,13 @@ in
     requires = [ "home-assistant.service" ];
     wantedBy = [ "multi-user.target" ];
 
+    environment = {
+      PYTHONPATH = "${inputs.self}/";
+    };
+
     serviceConfig = {
       Type = "simple";
-      ExecStart = "${van-weather}/bin/van-weather";
+      ExecStart = "${pkgs.my_python}/bin/python -m python.van_weather.main";
       EnvironmentFile = "/etc/van_weather.env";
       Restart = "on-failure";
       RestartSec = "5s";
@@ -27,6 +29,7 @@ in
       ProtectSystem = "strict";
       ProtectHome = "read-only";
       PrivateTmp = true;
+      ReadOnlyPaths = [ "${inputs.self}" ];
     };
   };
 }

systems/brain/syncthing.nix

@@ -3,7 +3,7 @@
 
   services.syncthing = {
     overrideFolders = false;
-    guiAddress = "0.0.0.0:8384";
+    guiAddress = "192.168.90.35:8384";
     settings = {
       "dotfiles" = {
         path = "/home/richie/dotfiles";

systems/jeeves/default.nix

@@ -1,4 +1,4 @@
-{ inputs, lib, ... }:
+{ inputs, ... }:
 let
   vars = import ./vars.nix;
 in
@@ -13,21 +13,19 @@ in
     "${inputs.self}/common/optional/monitoring-agent.nix"
     "${inputs.self}/common/optional/ssh_decrypt.nix"
     "${inputs.self}/common/optional/syncthing_base.nix"
-    "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/update.nix"
-    "${inputs.self}/common/optional/zfs"
+    "${inputs.self}/common/optional/zerotier.nix"
     ./monitoring
     ./docker
     ./services
+    ./web_services
     ./hardware.nix
-    ./networking
+    ./networking.nix
     ./programs.nix
     ./runners
     ./syncthing.nix
   ];
 
-  nix.settings.system-features = lib.mkAfter [ "gccarch-x86-64-v3" ];
-
   services = {
     openssh.ports = [ 629 ];
 
@@ -38,13 +36,7 @@ in
       EnvironmentFile = "${vars.secrets}/services/snapshot_manager";
     };
 
-    zerotierone = {
-      enable = true;
-      joinNetworks = [
-        "e4da7455b2ae64ca"
-        "a09acf02330d37b9"
-      ];
-    };
+    zerotierone.joinNetworks = [ "a09acf02330d37b9" ];
   };
 
   users.groups = {

systems/jeeves/docker/signal-cli-rest-api.nix

@@ -2,6 +2,9 @@ let
   vars = import ../vars.nix;
 in
 {
+  networking.firewall.allowedTCPPorts = [
+    8989
+  ];
   virtualisation.oci-containers.containers.signal_cli_rest_api = {
     image = "bbernhard/signal-cli-rest-api:0.199-dev";
     ports = [

systems/jeeves/monitoring/README.md

@@ -1,33 +0,0 @@
-# Monitoring
-
-## Vultr API metrics
-
-The `vultr-exporter` service reads its API token from:
-
-```text
-/zfs/storage/secrets/services/vultr-exporter
-```
-
-Create the file on Jeeves as root with the following contents:
-
-```text
-API_KEY=<Vultr API token>
-```
-
-The token needs read access to the Vultr Account and Billing APIs. Unrelated
-resource collectors are disabled in the packaged exporter.
-
-Restrict the file to root and ensure the public egress IP used by Jeeves is
-allowed for the token in the Vultr API settings:
-
-```console
-sudo chown root:root /zfs/storage/secrets/services/vultr-exporter
-sudo chmod 600 /zfs/storage/secrets/services/vultr-exporter
-```
-
-The exporter listens on `127.0.0.1:9188`; it is scraped by the local
-`prometheus-main` service every five minutes and is not exposed through the
-host firewall.
-
-Portal-1 exposes its node exporter only through `tailscale0` on port `9100`.
-Jeeves reaches it using the Portal-1 Tailscale hostname.

systems/jeeves/monitoring/dashboards/portal-1.json

@@ -1,798 +0,0 @@
-{
-  "annotations": {
-    "list": [
-      {
-        "builtIn": 1,
-        "datasource": {
-          "type": "grafana",
-          "uid": "-- Grafana --"
-        },
-        "enable": true,
-        "hide": true,
-        "iconColor": "rgba(0, 211, 255, 1)",
-        "name": "Annotations & Alerts",
-        "type": "dashboard"
-      }
-    ]
-  },
-  "editable": false,
-  "fiscalYearStartMonth": 0,
-  "graphTooltip": 1,
-  "links": [],
-  "panels": [
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prom-main"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "red",
-                "value": null
-              },
-              {
-                "color": "green",
-                "value": 1
-              }
-            ]
-          },
-          "mappings": [
-            {
-              "options": {
-                "0": {
-                  "color": "red",
-                  "index": 1,
-                  "text": "Offline"
-                },
-                "1": {
-                  "color": "green",
-                  "index": 0,
-                  "text": "Online"
-                }
-              },
-              "type": "value"
-            }
-          ]
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 4,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "area",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto",
-        "wideLayout": true
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "prom-main"
-          },
-          "editorMode": "code",
-          "expr": "up{job=\"node\",instance=\"portal-1\"}",
-          "instant": true,
-          "legendFormat": "",
-          "range": false,
-          "refId": "A"
-        }
-      ],
-      "title": "Node Exporter",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prom-main"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "yellow",
-                "value": 70
-              },
-              {
-                "color": "red",
-                "value": 90
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 5,
-        "x": 4,
-        "y": 0
-      },
-      "id": 2,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "area",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto",
-        "wideLayout": true
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "prom-main"
-          },
-          "editorMode": "code",
-          "expr": "100 * (1 - avg(rate(node_cpu_seconds_total{job=\"node\",instance=\"portal-1\",mode=\"idle\"}[5m])))",
-          "instant": true,
-          "legendFormat": "",
-          "range": false,
-          "refId": "A"
-        }
-      ],
-      "title": "CPU Used",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prom-main"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "yellow",
-                "value": 70
-              },
-              {
-                "color": "red",
-                "value": 90
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 5,
-        "x": 9,
-        "y": 0
-      },
-      "id": 3,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "area",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto",
-        "wideLayout": true
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "prom-main"
-          },
-          "editorMode": "code",
-          "expr": "100 * (1 - (node_memory_MemAvailable_bytes{job=\"node\",instance=\"portal-1\"} / node_memory_MemTotal_bytes{job=\"node\",instance=\"portal-1\"}))",
-          "instant": true,
-          "legendFormat": "",
-          "range": false,
-          "refId": "A"
-        }
-      ],
-      "title": "RAM Used",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prom-main"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "yellow",
-                "value": 70
-              },
-              {
-                "color": "red",
-                "value": 90
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 5,
-        "x": 14,
-        "y": 0
-      },
-      "id": 4,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "area",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto",
-        "wideLayout": true
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "prom-main"
-          },
-          "editorMode": "code",
-          "expr": "100 * (1 - (node_filesystem_avail_bytes{job=\"node\",instance=\"portal-1\",mountpoint=\"/\",fstype!=\"\"} / node_filesystem_size_bytes{job=\"node\",instance=\"portal-1\",mountpoint=\"/\",fstype!=\"\"}))",
-          "instant": true,
-          "legendFormat": "",
-          "range": false,
-          "refId": "A"
-        }
-      ],
-      "title": "Root Filesystem Used",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prom-main"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "unit": "short"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 5,
-        "x": 19,
-        "y": 0
-      },
-      "id": 5,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "area",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto",
-        "wideLayout": true
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "prom-main"
-          },
-          "editorMode": "code",
-          "expr": "node_load1{job=\"node\",instance=\"portal-1\"}",
-          "instant": true,
-          "legendFormat": "",
-          "range": false,
-          "refId": "A"
-        }
-      ],
-      "title": "Load (1m)",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prom-main"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "yellow",
-                "value": 70
-              },
-              {
-                "color": "red",
-                "value": 90
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 5
-      },
-      "id": 6,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "prom-main"
-          },
-          "editorMode": "code",
-          "expr": "100 * (1 - avg(rate(node_cpu_seconds_total{job=\"node\",instance=\"portal-1\",mode=\"idle\"}[5m])))",
-          "instant": false,
-          "legendFormat": "CPU used",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "CPU Usage",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prom-main"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "yellow",
-                "value": 70
-              },
-              {
-                "color": "red",
-                "value": 90
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 5
-      },
-      "id": 7,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "prom-main"
-          },
-          "editorMode": "code",
-          "expr": "100 * (1 - (node_memory_MemAvailable_bytes{job=\"node\",instance=\"portal-1\"} / node_memory_MemTotal_bytes{job=\"node\",instance=\"portal-1\"}))",
-          "instant": false,
-          "legendFormat": "RAM used",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "RAM Usage",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prom-main"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "yellow",
-                "value": 70
-              },
-              {
-                "color": "red",
-                "value": 90
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 13
-      },
-      "id": 8,
-      "options": {
-        "cellHeight": "sm",
-        "showHeader": true,
-        "sortBy": [
-          {
-            "desc": true,
-            "displayName": "Value"
-          }
-        ]
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "prom-main"
-          },
-          "editorMode": "code",
-          "expr": "100 * (1 - (node_filesystem_avail_bytes{job=\"node\",instance=\"portal-1\",fstype!~\"tmpfs|devtmpfs|overlay|squashfs\",mountpoint!~\"/run.*\"} / node_filesystem_size_bytes{job=\"node\",instance=\"portal-1\",fstype!~\"tmpfs|devtmpfs|overlay|squashfs\",mountpoint!~\"/run.*\"}))",
-          "format": "table",
-          "instant": true,
-          "legendFormat": "{{mountpoint}}",
-          "range": false,
-          "refId": "A"
-        }
-      ],
-      "title": "Filesystem Usage",
-      "type": "table"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prom-main"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "unit": "Bps"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 13
-      },
-      "id": 9,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "prom-main"
-          },
-          "editorMode": "code",
-          "expr": "sum(rate(node_disk_read_bytes_total{job=\"node\",instance=\"portal-1\",device!~\"loop.*|ram.*|fd.*\"}[5m]))",
-          "instant": false,
-          "legendFormat": "read",
-          "range": true,
-          "refId": "A"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "prom-main"
-          },
-          "editorMode": "code",
-          "expr": "sum(rate(node_disk_written_bytes_total{job=\"node\",instance=\"portal-1\",device!~\"loop.*|ram.*|fd.*\"}[5m]))",
-          "instant": false,
-          "legendFormat": "write",
-          "range": true,
-          "refId": "B"
-        }
-      ],
-      "title": "Disk Throughput",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prom-main"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "unit": "iops"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 21
-      },
-      "id": 10,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "prom-main"
-          },
-          "editorMode": "code",
-          "expr": "sum(rate(node_disk_reads_completed_total{job=\"node\",instance=\"portal-1\",device!~\"loop.*|ram.*|fd.*\"}[5m]))",
-          "instant": false,
-          "legendFormat": "reads",
-          "range": true,
-          "refId": "A"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "prom-main"
-          },
-          "editorMode": "code",
-          "expr": "sum(rate(node_disk_writes_completed_total{job=\"node\",instance=\"portal-1\",device!~\"loop.*|ram.*|fd.*\"}[5m]))",
-          "instant": false,
-          "legendFormat": "writes",
-          "range": true,
-          "refId": "B"
-        }
-      ],
-      "title": "Disk Operations",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prom-main"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "unit": "Bps"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 21
-      },
-      "id": 11,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "prom-main"
-          },
-          "editorMode": "code",
-          "expr": "sum(rate(node_network_receive_bytes_total{job=\"node\",instance=\"portal-1\",device!=\"lo\"}[5m]))",
-          "instant": false,
-          "legendFormat": "received",
-          "range": true,
-          "refId": "A"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "prom-main"
-          },
-          "editorMode": "code",
-          "expr": "sum(rate(node_network_transmit_bytes_total{job=\"node\",instance=\"portal-1\",device!=\"lo\"}[5m]))",
-          "instant": false,
-          "legendFormat": "sent",
-          "range": true,
-          "refId": "B"
-        }
-      ],
-      "title": "Network Traffic",
-      "type": "timeseries"
-    }
-  ],
-  "refresh": "30s",
-  "schemaVersion": 39,
-  "tags": [
-    "monitoring",
-    "portal-1",
-    "vultr"
-  ],
-  "templating": {
-    "list": []
-  },
-  "time": {
-    "from": "now-24h",
-    "to": "now"
-  },
-  "timepicker": {},
-  "timezone": "browser",
-  "title": "Portal-1 Host",
-  "uid": "portal-1-host",
-  "version": 1,
-  "weekStart": ""
-}

systems/jeeves/monitoring/default.nix

@@ -41,36 +41,29 @@ let
       {
         job_name = "node";
         static_configs = [
-          (mkTarget "jeeves" "jeeves.taile39c31.ts.net:9100")
-          (mkTarget "bob" "bob.taile39c31.ts.net:9100")
-          (mkTarget "portal-1" "portal-1.taile39c31.ts.net:9100")
+          (mkTarget "jeeves" "192.168.90.40:9100")
+          (mkTarget "bob" "192.168.90.25:9100")
         ];
       }
-      {
-        job_name = "vultr";
-        scrape_interval = "5m";
-        scrape_timeout = "45s";
-        static_configs = [ (mkTarget "vultr" "127.0.0.1:9188") ];
-      }
       {
         job_name = "process_grouped";
         static_configs = [
-          (mkTarget "jeeves" "jeeves.taile39c31.ts.net:9256")
-          (mkTarget "bob" "bob.taile39c31.ts.net:9256")
+          (mkTarget "jeeves" "192.168.90.40:9256")
+          (mkTarget "bob" "192.168.90.25:9256")
         ];
       }
       {
         job_name = "smartctl";
         static_configs = [
-          (mkTarget "jeeves" "jeeves.taile39c31.ts.net:9633")
-          (mkTarget "bob" "bob.taile39c31.ts.net:9633")
+          (mkTarget "jeeves" "192.168.90.40:9633")
+          (mkTarget "bob" "192.168.90.25:9633")
         ];
       }
       {
         job_name = "zfs";
         static_configs = [
-          (mkTarget "jeeves" "jeeves.taile39c31.ts.net:9134")
-          (mkTarget "bob" "bob.taile39c31.ts.net:9134")
+          (mkTarget "jeeves" "192.168.90.40:9134")
+          (mkTarget "bob" "192.168.90.25:9134")
         ];
       }
     ];
@@ -86,8 +79,8 @@ let
       {
         job_name = "process_pid";
         static_configs = [
-          (mkTarget "jeeves" "jeeves.taile39c31.ts.net:9257")
-          (mkTarget "bob" "bob.taile39c31.ts.net:9257")
+          (mkTarget "jeeves" "192.168.90.40:9257")
+          (mkTarget "bob" "192.168.90.25:9257")
         ];
       }
     ];
@@ -104,9 +97,7 @@ let
       after = [
         "zfs-media-database-prometheus.mount"
         "network.target"
-        "tailscaled-autoconnect.service"
       ];
-      wants = [ "tailscaled-autoconnect.service" ];
       requires = [ "zfs-media-database-prometheus.mount" ];
       wantedBy = [ "multi-user.target" ];
       unitConfig.RequiresMountsFor = [ dataDir ];
@@ -160,8 +151,6 @@ let
     };
 in
 {
-  imports = [ ./vultr-exporter.nix ];
-
   users = {
     groups.prometheus = { };
     users.prometheus = {

systems/jeeves/monitoring/vultr-exporter.nix

@@ -1,96 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}:
-let
-  vars = import ../vars.nix;
-
-  vultrExporter = pkgs.buildGoModule rec {
-    pname = "vultr-exporter";
-    version = "0-unstable-2025-10-14";
-
-    src = pkgs.fetchFromGitHub {
-      owner = "DazWilkin";
-      repo = "vultr-exporter";
-      rev = "d8b5d7107c2eda31566e6e895c8a67db32fdaf68";
-      hash = "sha256-3LpXh+mFMBRJfiY2ftELpM3AIE0LiZ9c6NFok0OeH5I=";
-    };
-
-    vendorHash = "sha256-qCHWmg6GxLIjqlf5UqRcuDRd1xqRFI3sl4ZduLajx+Y=";
-    subPackages = [ "cmd/server" ];
-
-    postPatch = ''
-      substituteInPlace cmd/server/main.go \
-        --replace-fail 'registry.MustRegister(collector.NewBlockStorageCollector(s, client, log))' "" \
-        --replace-fail 'registry.MustRegister(collector.NewKubernetesCollector(s, client, log))' "" \
-        --replace-fail 'registry.MustRegister(collector.NewLoadBalancerCollector(s, client, log))' "" \
-        --replace-fail 'registry.MustRegister(collector.NewReservedIPsCollector(s, client, log))' ""
-    '';
-
-    ldflags = [
-      "-s"
-      "-w"
-      "-X main.GitCommit=${src.rev}"
-      "-X main.OSVersion=NixOS"
-    ];
-
-    postInstall = ''
-      mv $out/bin/server $out/bin/vultr-exporter
-    '';
-
-    meta = {
-      description = "Prometheus exporter for Vultr account, billing, and bandwidth metrics";
-      homepage = "https://github.com/DazWilkin/vultr-exporter";
-      license = lib.licenses.asl20;
-      mainProgram = "vultr-exporter";
-    };
-  };
-in
-{
-  systemd.services.vultr-exporter = {
-    description = "Vultr Prometheus exporter";
-    documentation = [ "https://github.com/DazWilkin/vultr-exporter" ];
-    wants = [ "network-online.target" ];
-    after = [ "network-online.target" ];
-    wantedBy = [ "multi-user.target" ];
-
-    serviceConfig = {
-      ExecStart = "${lib.getExe vultrExporter} --endpoint=127.0.0.1:9188 --path=/metrics";
-      EnvironmentFile = "${vars.secrets}/services/vultr-exporter";
-      Restart = "on-failure";
-      RestartSec = "30s";
-
-      CapabilityBoundingSet = [ "" ];
-      DeviceAllow = [ "" ];
-      DynamicUser = true;
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateTmp = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectSystem = "strict";
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-      ];
-      UMask = "0077";
-    };
-  };
-}

systems/jeeves/networking.nix

@@ -8,6 +8,27 @@
     "net.bridge.bridge-nf-call-iptables" = 0;
   };
 
+  networking = {
+    hostName = "jeeves";
+    hostId = "0e15ce35";
+    firewall = {
+      enable = true;
+      interfaces.br-nix-builder = {
+        allowedTCPPorts = [ ];
+        allowedUDPPorts = [ ];
+      };
+      allowedTCPPorts = [
+        8070
+      ];
+    };
+    useNetworkd = true;
+    # Without this, unconfigured NICs get a catch-all DHCP network and
+    # join the LAN uninvited (how the dead atlantic card ended up
+    # ARP-poisoning 192.168.99.14). Every interface must be configured
+    # explicitly below.
+    useDHCP = false;
+  };
+
   systemd.network = {
     enable = true;
     wait-online = {

systems/jeeves/networking/default.nix

@@ -1,16 +0,0 @@
-{
-  imports = [
-    ./firewall.nix
-    ./interfaces.nix
-  ];
-  networking = {
-    hostName = "jeeves";
-    hostId = "0e15ce35";
-    useNetworkd = true;
-    # Without this, unconfigured NICs get a catch-all DHCP network and
-    # join the LAN uninvited (how the dead atlantic card ended up
-    # ARP-poisoning 192.168.99.14). Every interface must be configured
-    # explicitly below.
-    useDHCP = false;
-  };
-}

systems/jeeves/networking/firewall.nix

@@ -1,47 +0,0 @@
-let
-  ports = {
-    audiobookshelf = 8000;
-    ebook_searcher = 8070;
-    gems = 8002;
-    gitea_http = 6443;
-    gitea_ssh = 2223;
-    grafana = 3000;
-    jellyfin_http = 8096;
-    nix_binary_cache = 5000;
-    nornsight = 8001;
-    ollama = 11434;
-    open_webui = 8080;
-    postgresql = 5432;
-    share = 8091;
-    signal_cli = 8989;
-    syncthing = 8384;
-  };
-in
-{
-  networking.firewall = {
-    enable = true;
-    interfaces.br-nix-builder = {
-      allowedTCPPorts = [ ];
-      allowedUDPPorts = [ ];
-    };
-    interfaces.tailscale0.allowedTCPPorts = [
-      ports.audiobookshelf
-      ports.gems
-      ports.jellyfin_http
-      ports.nix_binary_cache
-      ports.nornsight
-      ports.share
-    ];
-    allowedTCPPorts = [
-      ports.ebook_searcher
-      ports.gitea_http
-      ports.gitea_ssh
-      ports.grafana
-      ports.ollama
-      ports.open_webui
-      ports.postgresql
-      ports.signal_cli
-      ports.syncthing
-    ];
-  };
-}

systems/jeeves/runners/nix_builder.nix

@@ -83,7 +83,6 @@ in
               useHostResolvConf = false;
             };
             nix.settings = {
-              system-features = lib.mkAfter [ "gccarch-x86-64-v3" ];
               trusted-substituters = [
                 "https://cache.nixos.org"
                 "https://cache.tmmworkshop.com"

systems/jeeves/scripts/zfs.sh

@@ -19,6 +19,7 @@ sudo zfs create media/temp -o sync=disabled -o redundant_metadata=none
 sudo zfs create media/secure -o encryption=aes-256-gcm -o keyformat=hex -o keylocation=file:///root/zfs.key
 sudo zfs create media/secure/docker -o compression=zstd-9
 sudo zfs create media/secure/github-runners -o compression=zstd-9 -o sync=disabled
+sudo zfs create media/secure/home_assistant -o compression=zstd-19
 sudo zfs create media/secure/notes -o copies=2
 sudo zfs create media/secure/postgres -o mountpoint=/zfs/media/database/postgres -o recordsize=16k -o primarycache=metadata
 sudo zfs create media/secure/postgres-wal -o mountpoint=/zfs/media/database/postgres-wal -o recordsize=32k -o primarycache=metadata -o special_small_blocks=32K -o compression=lz4 -o secondarycache=none -o logbias=latency

systems/jeeves/services/audiobookshelf.nix

@@ -6,7 +6,6 @@ in
   services.audiobookshelf = {
     enable = true;
     port = 8000;
-    host = "0.0.0.0";
   };
   systemd.services.audiobookshelf.serviceConfig.WorkingDirectory =
     lib.mkForce "${vars.docker_configs}/audiobookshelf";

systems/jeeves/services/gems.nix

@@ -36,7 +36,7 @@ in
       Type = "simple";
       User = "gems";
       Group = "gems";
-      ExecStart = "${pkgs.my_python}/bin/python -m python.gems.main --host 0.0.0.0 --port 8002";
+      ExecStart = "${pkgs.my_python}/bin/python -m python.gems.main --host 127.0.0.1 --port 8002";
       Restart = "on-failure";
       RestartSec = "5s";
       StandardOutput = "journal";

systems/jeeves/services/gitea.nix

@@ -2,6 +2,11 @@ let
   vars = import ../vars.nix;
 in
 {
+  networking.firewall.allowedTCPPorts = [
+    6443
+    2223
+  ];
+
   services.gitea = {
     enable = true;
     appName = "TMM Workshop";
@@ -22,14 +27,10 @@ in
       };
       service.DISABLE_REGISTRATION = true;
       server = {
-        DOMAIN = "gitea.tmmworkshop.com";
+        DOMAIN = "tmmworkshop.com";
         ROOT_URL = "https://gitea.tmmworkshop.com/";
         HTTP_PORT = 6443;
-        BUILTIN_SSH_SERVER_USER = "gitea";
-        SSH_USER = "gitea";
-        SSH_DOMAIN = "gitea.tmmworkshop.com";
         SSH_PORT = 2223;
-        SSH_LISTEN_HOST = "0.0.0.0";
         SSH_LISTEN_PORT = 2223;
         START_SSH_SERVER = true;
         PUBLIC_URL_DETECTION = "auto";

systems/jeeves/services/grafana.nix

@@ -6,6 +6,8 @@ let
   grafanaDataDir = "${vars.services}/grafana";
 in
 {
+  networking.firewall.allowedTCPPorts = [ 3000 ];
+
   services.grafana = {
     enable = true;
     dataDir = grafanaDataDir;
@@ -17,9 +19,9 @@ in
         secret_key = "$__file{${vars.secrets}/services/grafana/secret_key}";
       };
       server = {
-        http_addr = "0.0.0.0";
+        http_addr = "192.168.90.40";
         http_port = 3000;
-        root_url = "http://jeeves:3000/";
+        root_url = "http://192.168.90.40:3000/";
       };
     };
     provision = {

systems/jeeves/services/home_assistant.nix

@@ -0,0 +1,79 @@
+let
+  vars = import ../vars.nix;
+in
+{
+  users = {
+    users.hass = {
+      isSystemUser = true;
+      group = "hass";
+    };
+    groups.hass = { };
+  };
+
+  services = {
+    home-assistant = {
+      enable = true;
+      openFirewall = true;
+      configDir = vars.home_assistant;
+      config = {
+        http = {
+          server_port = 8123;
+          use_x_forwarded_for = true;
+          trusted_proxies = "127.0.0.1";
+        };
+        homeassistant = {
+          time_zone = "America/New_York";
+          unit_system = "us_customary";
+          temperature_unit = "F";
+        };
+        recorder = {
+          db_url = "postgresql://@/hass";
+          auto_purge = true;
+          purge_keep_days = 3650;
+          db_retry_wait = 15;
+        };
+        assist_pipeline = { };
+        backup = { };
+        bluetooth = { };
+        config = { };
+        dhcp = { };
+        energy = { };
+        history = { };
+        homeassistant_alerts = { };
+        image_upload = { };
+        logbook = { };
+        media_source = { };
+        mobile_app = { };
+        ssdp = { };
+        sun = { };
+        webhook = { };
+        zeroconf = { };
+        automation = "!include automations.yaml";
+        script = "!include scripts.yaml";
+        scene = "!include scenes.yaml";
+        group = "!include groups.yaml";
+      };
+      extraPackages =
+        python3Packages: with python3Packages; [
+          aioesphomeapi
+          aiounifi
+          bleak-esphome
+          esphome-dashboard-api
+          gtts
+          jellyfin-apiclient-python
+          psycopg2
+          pymetno
+          aio-ownet
+          rokuecp
+          uiprotect
+          wakeonlan
+        ];
+      extraComponents = [ "isal" ];
+    };
+    esphome = {
+      enable = true;
+      openFirewall = true;
+      address = "192.168.90.40";
+    };
+  };
+}

systems/jeeves/services/jellyfin.nix

@@ -4,6 +4,7 @@ in
 {
   services.jellyfin = {
     enable = true;
+    openFirewall = true;
     dataDir = "${vars.services}/jellyfin";
     cacheDir = "${vars.services}/jellyfin/cache";
   };

systems/jeeves/services/llms.nix

@@ -38,6 +38,7 @@ in
       "qwen3.5:35b"
     ];
     modelsDir = vars.ollama;
+    openFirewall = true;
   };
   systemd.services = {
     ollama.serviceConfig = {

systems/jeeves/services/nix_serve.nix

@@ -7,5 +7,6 @@ in
     package = pkgs.nix-serve-ng;
     enable = true;
     secretKeyFile = "${vars.secrets}/services/nix-cache/cache-priv-key.pem";
+    openFirewall = true;
   };
 }

systems/jeeves/services/open_webui.nix

@@ -2,6 +2,7 @@
   services.open-webui = {
     enable = true;
     host = "0.0.0.0";
+    openFirewall = true;
     environment = {
       ANONYMIZED_TELEMETRY = "False";
       DO_NOT_TRACK = "True";

systems/jeeves/services/postgress.nix

@@ -3,6 +3,8 @@ let
   vars = import ../vars.nix;
 in
 {
+  networking.firewall.allowedTCPPorts = [ 5432 ];
+
   # Symlink pg_wal to a ZFS dataset on the special (metadata) vdev for fast WAL writes
   # this is required for systemd sandboxing
   systemd.services.postgresql.serviceConfig.ReadWritePaths = [ "/zfs/media/database/postgres-wal" ];
@@ -25,12 +27,13 @@ in
       local all  richie   trust
       host  all  richie   127.0.0.1/32    trust
       host  all  richie   ::1/128         trust
-      host  all  richie   100.64.0.0/10 trust
+      host  all  richie   192.168.90.1/24 trust
       host  all  richie   192.168.99.1/24 trust
       host  all  richie   172.16.0.0/12   trust
 
 
       #type database DBuser origin-address auth-method
+      local hass     hass     trust
       local gitea    gitea    trust
 
       # signalbot
@@ -40,12 +43,12 @@ in
       local postgres  math   trust
       host  postgres  math   127.0.0.1/32    trust
       host  postgres  math   ::1/128         trust
-      host  postgres  math   100.64.0.0/10 trust
+      host  postgres  math   192.168.90.1/24 trust
 
       local data_science_dev  math   trust
       host  data_science_dev  math   127.0.0.1/32    trust
       host  data_science_dev  math   ::1/128         trust
-      host  data_science_dev  math   100.64.0.0/10 trust
+      host  data_science_dev  math   192.168.90.1/24 trust
     '';
 
     identMap = ''
@@ -54,6 +57,7 @@ in
         superuser_map      postgres  postgres
         # Let other names login as themselves
         superuser_map      richie    postgres
+        superuser_map      hass      hass
     '';
     ensureUsers = [
       {
@@ -77,6 +81,16 @@ in
           replication = true;
         };
       }
+      {
+        name = "hass";
+        ensureDBOwnership = true;
+        ensureClauses = {
+          login = true;
+          createrole = true;
+          createdb = true;
+          replication = true;
+        };
+      }
       {
         name = "gitea";
         ensureDBOwnership = true;
@@ -107,6 +121,7 @@ in
     ];
     ensureDatabases = [
       "data_science_dev"
+      "hass"
       "gitea"
       "math"
       "n8n"

systems/jeeves/services/transmission.nix

@@ -21,11 +21,11 @@ in
       message-level = 3;
       peer-port = 51413;
       rpc-bind-address = "0.0.0.0";
-      rpc-host-whitelist = "127.0.0.1,jeeves,jeeves.taile39c31.ts.net";
+      rpc-host-whitelist = "127.0.0.1,192.168.90.40";
       rpc-host-whitelist-enabled = true;
       rpc-port = 9091;
       rpc-whitelist-enabled = true;
-      rpc-whitelist = "127.0.0.1,100.*.*.*";
+      rpc-whitelist = "127.0.0.1,192.168.90.49";
       seed-queue-enabled = false;
     };
   };

systems/jeeves/services/validate_system.toml

@@ -1,6 +1,8 @@
 zpool = ["root_pool", "storage", "media"]
 services = [
     "audiobookshelf",
+    "haproxy",
     "docker",
+    "home-assistant",
     "jellyfin",
 ]

systems/jeeves/syncthing.nix

@@ -2,9 +2,11 @@ let
   vars = import ./vars.nix;
 in
 {
+  networking.firewall.allowedTCPPorts = [ 8384 ];
+
   services.syncthing = {
     overrideFolders = false;
-    guiAddress = "0.0.0.0:8384";
+    guiAddress = "192.168.90.40:8384";
     settings = {
       devices.davids-server.id = "7GXTDGR-AOXFW2O-K6J7NM3-XYZNRRW-AKHAFWM-GBOWUPQ-OA6JIWD-ER7RDQL"; # cspell:disable-line
       folders = {

systems/jeeves/vars.nix

@@ -8,6 +8,7 @@ in
   database = "${zfs_media}/database";
   docker = "${zfs_media}/docker";
   docker_configs = "${zfs_media}/docker/configs";
+  home_assistant = "${zfs_media}/home_assistant";
   notes = "${zfs_media}/notes";
   secrets = "${zfs_storage}/secrets";
   services = "${zfs_media}/services";

systems/jeeves/web_services/acme.nix

@@ -0,0 +1,75 @@
+let
+  domains = [
+    "audiobookshelf"
+    "cache"
+    "gitea"
+    "gems"
+    "jellyfin"
+    "share"
+  ];
+  extraDomains = [ "www.norn-sight.com" ];
+
+  makeCert = name: {
+    name = "${name}.tmmworkshop.com";
+    value = {
+      webroot = "/var/lib/acme/.challenges";
+      group = "acme";
+      reloadServices = [ "haproxy.service" ];
+    };
+  };
+
+  makeExtraCert = name: {
+    inherit name;
+    value = {
+      webroot = "/var/lib/acme/.challenges";
+      group = "acme";
+      reloadServices = [ "haproxy.service" ];
+    };
+  };
+
+  acmeServices =
+    map (domain: "acme-${domain}.tmmworkshop.com.service") domains
+    ++ map (domain: "acme-${domain}.service") extraDomains;
+in
+{
+  users.users.haproxy.extraGroups = [ "acme" ];
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "Richie@tmmworkshop.com";
+    certs = builtins.listToAttrs ((map makeCert domains) ++ (map makeExtraCert extraDomains));
+  };
+
+  # Minimal nginx to serve ACME HTTP-01 challenge files for HAProxy
+  services.nginx = {
+    enable = true;
+    virtualHosts."acme-challenge" = {
+      listen = [
+        {
+          addr = "127.0.0.1";
+          port = 8402;
+        }
+      ];
+      locations."/.well-known/acme-challenge/" = {
+        root = "/var/lib/acme/.challenges";
+      };
+    };
+  };
+
+  # Ensure the challenge directory exists with correct permissions
+  systemd.tmpfiles.rules = [
+    "d /var/lib/acme/.challenges 0750 acme acme - -"
+    "d /var/lib/acme/.challenges/.well-known 0750 acme acme - -"
+    "d /var/lib/acme/.challenges/.well-known/acme-challenge 0750 acme acme - -"
+  ];
+
+  users.users.nginx.extraGroups = [ "acme" ];
+
+  # HAProxy needs certs to exist before it can bind :443.
+  # NixOS's acme module generates self-signed placeholders on first boot
+  # via acme-<domain>.service — just make HAProxy wait for them.
+  systemd.services.haproxy = {
+    after = acmeServices;
+    wants = acmeServices;
+  };
+}

systems/jeeves/web_services/default.nix

@@ -0,0 +1,9 @@
+{ lib, ... }:
+{
+  imports =
+    let
+      files = builtins.attrNames (builtins.readDir ./.);
+      nixFiles = builtins.filter (name: lib.hasSuffix ".nix" name && name != "default.nix") files;
+    in
+    map (file: ./. + "/${file}") nixFiles;
+}

systems/jeeves/web_services/haproxy.cfg

@@ -22,8 +22,8 @@ defaults
 
 #Application Setup
 frontend ContentSwitching
-  bind [::]:80 v4v6
-  bind [::]:443 v4v6 ssl crt /var/lib/acme/audiobookshelf.tmmworkshop.com/full.pem crt /var/lib/acme/cache.tmmworkshop.com/full.pem crt /var/lib/acme/gems.tmmworkshop.com/full.pem crt /var/lib/acme/jellyfin.tmmworkshop.com/full.pem crt /var/lib/acme/share.tmmworkshop.com/full.pem crt /var/lib/acme/gitea.tmmworkshop.com/full.pem crt /var/lib/acme/www.norn-sight.com/full.pem
+  bind *:80 v4v6
+  bind *:443 v4v6 ssl crt /var/lib/acme/audiobookshelf.tmmworkshop.com/full.pem crt /var/lib/acme/cache.tmmworkshop.com/full.pem crt /var/lib/acme/gems.tmmworkshop.com/full.pem crt /var/lib/acme/jellyfin.tmmworkshop.com/full.pem crt /var/lib/acme/share.tmmworkshop.com/full.pem crt /var/lib/acme/gitea.tmmworkshop.com/full.pem crt /var/lib/acme/www.norn-sight.com/full.pem
   mode  http
 
   # ACME challenge routing (must be first)
@@ -110,14 +110,6 @@ frontend ContentSwitching
   use_backend gems  if host_gems
   use_backend norn_sight  if host_norn_sight
 
-# Proxy Gitea's built-in SSH server over Tailscale to Jeeves. Port 22 remains
-# available to Endlessh on Portal.
-frontend GiteaSSH
-  bind [::]:2223 v4v6
-  mode tcp
-  option tcplog
-  default_backend gitea_ssh
-
 # Stick-table only (no servers): tracks per-IP request rate to Gitea's compare
 # endpoint over a 5-minute window so the frontend can cap it at 1 per 5 min.
 backend st_compare
@@ -132,35 +124,31 @@ backend acme_challenge
 
 backend audiobookshelf_nodes
   mode http
-  server server jeeves:8000
+  server server 127.0.0.1:8000
 
 backend cache_nodes
   mode http
-  server server jeeves:5000
+  server server 127.0.0.1:5000
 
 backend jellyfin
   mode http
   option forwardfor
-  server jellyfin jeeves:8096
+  server jellyfin 127.0.0.1:8096
 
 backend share_nodes
   mode http
-  server server jeeves:8091
+  server server 127.0.0.1:8091
 
 backend gitea
   mode http
-  server server jeeves:6443
-
-backend gitea_ssh
-  mode tcp
-  server gitea jeeves:2223
+  server server 127.0.0.1:6443
 
 backend gems
   mode http
   option forwardfor
   timeout server 1h
-  server gems jeeves:8002
+  server gems 127.0.0.1:8002
 
 backend norn_sight
   mode http
-  server server jeeves:8001
+  server server 127.0.0.1:8001

systems/jeeves/web_services/haproxy.nix

@@ -0,0 +1,14 @@
+{
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  # Global robots.txt served by HAProxy for every vhost (see haproxy.cfg).
+  environment.etc."haproxy/robots.txt".source = ./robots.txt;
+
+  services.haproxy = {
+    enable = true;
+    config = builtins.readFile ./haproxy.cfg;
+  };
+}

systems/portal-1/README.md

@@ -1,83 +0,0 @@
-# portal_1
-
-Minimal NixOS target for a Vultr VM, installed with nixos-anywhere. The Nix
-flake target is `portal_1`; the machine hostname is `portal-1` because DNS
-hostnames cannot contain underscores.
-
-## Before deploying
-
-1. Confirm the VM's system disk is `/dev/vda`. If it is not, update both
-   references in `disk-config.nix`.
-2. Confirm the SSH public key in `default.nix` is the key that should have
-   administrator access.
-3. Boot the VM into a NixOS installer or another nixos-anywhere-compatible
-   Linux rescue environment with root SSH access. Keep this environment
-   running while completing the SOPS bootstrap below.
-
-## Bootstrap SOPS
-
-Use the rescue environment's SSH host key as the permanent portal identity.
-Replace `VM_IP` below:
-
-```console
-ssh root@VM_IP 'cat /etc/ssh/ssh_host_ed25519_key.pub' | \
-  nix shell nixpkgs#ssh-to-age --command ssh-to-age
-```
-
-This prints an `age1...` recipient; it does not copy the private key. Add the
-recipient to `.sops.yaml`:
-
-```yaml
-- &system_portal_1 age1...
-```
-
-Then add `*system_portal_1` to the age recipients for
-`users/secrets.yaml`. Re-encrypt the existing file for the new recipient and
-add the Tailscale key:
-
-```console
-nix shell nixpkgs#sops --command sops updatekeys users/secrets.yaml
-nix shell nixpkgs#sops --command sops users/secrets.yaml
-```
-
-Add the OAuth client secret from the `Auth Keys: Write` credential in the SOPS
-editor and save it:
-
-```yaml
-tailscale_auth_key: tskey-client-...
-```
-
-## Deploy
-
-From the repository root, replace `VM_IP` with the VM's public IP:
-
-```console
-nix run github:nix-community/nixos-anywhere -- \
-  --copy-host-keys --flake .#portal_1 root@VM_IP
-```
-
-This repartitions `/dev/vda`, so anything already on that disk is erased. The
-layout reserves 8 GiB for swap and assigns the remaining space to the root
-filesystem.
-
-`--copy-host-keys` preserves the same private SSH host key at
-`/etc/ssh/ssh_host_ed25519_key` on the installed system. SOPS-Nix converts that
-key to an age identity during activation. After the reboot, connect as
-`richie` and verify that automatic Tailscale enrollment succeeded:
-
-```console
-ssh -p 278 richie@VM_IP
-sudo tailscale status
-```
-
-The installed OpenSSH service listens on port 278. Port 22 is served by
-Endlessh and will not provide an SSH login.
-
-HAProxy uses the same frontend, routing, and rate-limiting configuration as
-Jeeves. Portal manages the ACME certificates for the existing public domains;
-their DNS records must resolve to Portal for HTTP-01 issuance and renewal.
-
-The application backends still use Jeeves' original `127.0.0.1` addresses.
-Replace them with the corresponding Tailscale addresses before directing
-application traffic through Portal. Ports 80 and 443 are allowed through the
-firewall.

systems/portal-1/default.nix

@@ -1,57 +0,0 @@
-{
-  inputs,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  imports = [
-    inputs.disko.nixosModules.disko
-    "${inputs.self}/users/richie"
-    "${inputs.self}/common/global"
-    "${inputs.self}/common/optional/tailscale.nix"
-    ./disk-config.nix
-    ./haproxy
-    ./monitoring.nix
-  ];
-
-  nixpkgs.hostPlatform = "x86_64-linux";
-
-  boot = {
-    # Avoid consuming the VM's limited memory for /tmp.
-    tmp.useTmpfs = false;
-
-    # The Vultr system disk and NIC are exposed as virtio devices.
-    initrd.availableKernelModules = [
-      "virtio_pci"
-      "virtio_blk"
-      "virtio_scsi"
-      "sd_mod"
-    ];
-  };
-
-  networking = {
-    hostName = "portal-1";
-    useDHCP = lib.mkDefault true;
-
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [ 278 ];
-    };
-  };
-
-  services.openssh.ports = [ 278 ];
-
-  environment.systemPackages = with pkgs; [
-    curl
-    htop
-    vim
-  ];
-
-  # The VM uses its regular swap instead of compressed RAM swap.
-  zramSwap.enable = false;
-
-  time.timeZone = "Etc/UTC";
-
-  system.stateVersion = "24.05";
-}

systems/portal-1/disk-config.nix

@@ -1,59 +0,0 @@
-{ ... }:
-{
-  # Vultr's first virtio disk is normally /dev/vda. Change this before
-  # deployment if the selected image exposes its system disk differently.
-  disko.devices.disk.main = {
-    type = "disk";
-    device = "/dev/vda";
-    content = {
-      type = "gpt";
-      partitions = {
-        bios = {
-          size = "1M";
-          type = "EF02";
-        };
-
-        ESP = {
-          size = "512M";
-          type = "EF00";
-          content = {
-            type = "filesystem";
-            format = "vfat";
-            mountpoint = "/boot";
-            mountOptions = [
-              "fmask=0077"
-              "dmask=0077"
-            ];
-          };
-        };
-
-        swap = {
-          size = "8G";
-          content = {
-            type = "swap";
-          };
-        };
-
-        root = {
-          size = "100%";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/";
-          };
-        };
-      };
-    };
-  };
-
-  # Install GRUB for both legacy BIOS and EFI-capable Vultr plans.
-  boot.loader = {
-    grub = {
-      enable = true;
-      devices = [ "/dev/vda" ];
-      efiSupport = true;
-      efiInstallAsRemovable = true;
-    };
-    efi.canTouchEfiVariables = false;
-  };
-}

systems/portal-1/haproxy/default.nix

@@ -1,89 +0,0 @@
-let
-  domains = [
-    "audiobookshelf"
-    "cache"
-    "gitea"
-    "gems"
-    "jellyfin"
-    "share"
-  ];
-  extraDomains = [ "www.norn-sight.com" ];
-
-  makeCert = name: {
-    name = "${name}.tmmworkshop.com";
-    value = {
-      webroot = "/var/lib/acme/.challenges";
-      group = "acme";
-      reloadServices = [ "haproxy.service" ];
-    };
-  };
-
-  makeExtraCert = name: {
-    inherit name;
-    value = {
-      webroot = "/var/lib/acme/.challenges";
-      group = "acme";
-      reloadServices = [ "haproxy.service" ];
-    };
-  };
-
-  acmeServices =
-    map (domain: "acme-${domain}.tmmworkshop.com.service") domains
-    ++ map (domain: "acme-${domain}.service") extraDomains;
-in
-{
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-    2223
-  ];
-
-  # Global robots.txt served by HAProxy for every vhost (see haproxy.cfg).
-  environment.etc."haproxy/robots.txt".source = ./robots.txt;
-
-  services = {
-    haproxy = {
-      enable = true;
-      config = builtins.readFile ./haproxy.cfg;
-    };
-    nginx = {
-      enable = true;
-      virtualHosts."acme-challenge" = {
-        listen = [
-          {
-            addr = "127.0.0.1";
-            port = 8402;
-          }
-        ];
-        locations."/.well-known/acme-challenge/" = {
-          root = "/var/lib/acme/.challenges";
-        };
-      };
-    };
-  };
-
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "Richie@tmmworkshop.com";
-    certs = builtins.listToAttrs ((map makeCert domains) ++ (map makeExtraCert extraDomains));
-  };
-
-  systemd = {
-    services.haproxy = {
-      # HAProxy needs the initial certificates and Tailscale connectivity before
-      # it can serve requests to its backends.
-      after = acmeServices ++ [ "tailscaled-autoconnect.service" ];
-      wants = acmeServices ++ [ "tailscaled-autoconnect.service" ];
-    };
-    tmpfiles.rules = [
-      "d /var/lib/acme/.challenges 0750 acme acme - -"
-      "d /var/lib/acme/.challenges/.well-known 0750 acme acme - -"
-      "d /var/lib/acme/.challenges/.well-known/acme-challenge 0750 acme acme - -"
-    ];
-  };
-
-  users.users = {
-    haproxy.extraGroups = [ "acme" ];
-    nginx.extraGroups = [ "acme" ];
-  };
-}

systems/portal-1/monitoring.nix

@@ -1,15 +0,0 @@
-{ config, ... }:
-{
-  networking.firewall.interfaces.tailscale0.allowedTCPPorts = [
-    config.services.prometheus.exporters.node.port
-  ];
-
-  services.prometheus.exporters.node = {
-    enable = true;
-    enabledCollectors = [
-      "pressure"
-      "processes"
-      "systemd"
-    ];
-  };
-}

systems/rhapsody-in-green/default.nix

@@ -8,9 +8,8 @@
     "${inputs.self}/common/optional/steam.nix"
     "${inputs.self}/common/optional/syncthing_base.nix"
     "${inputs.self}/common/optional/systemd-boot.nix"
-    "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/yubikey.nix"
-    "${inputs.self}/common/optional/zfs"
+    "${inputs.self}/common/optional/zerotier.nix"
     ./hardware.nix
     ./open_webui.nix
     ./programs.nix

tests/ebook_search/test_rerank.py

@@ -51,7 +51,7 @@ def test_config_defaults_enable_reranking(mocker: MockerFixture) -> None:
     config = load_rerank_config()
 
     assert config.enabled is True
-    assert config.base_url == "http://bob:8001"
+    assert config.base_url == "http://192.168.90.25:8001"
     assert config.model == "qwen3-reranker-06b"
     assert config.candidates == 24
     assert config.timeout_seconds == 30

users/richie/home/global.nix

@@ -1,7 +1,22 @@
+{ config, ... }:
 {
   imports = [
-    ./minimal.nix
+    ./cli
     ./programs.nix
     ./ssh_config.nix
   ];
+
+  programs = {
+    home-manager.enable = true;
+    git.enable = true;
+  };
+
+  home = {
+    username = "richie";
+    homeDirectory = "/home/${config.home.username}";
+    stateVersion = "24.05";
+    sessionVariables = {
+      FLAKE = "$HOME/dotfiles";
+    };
+  };
 }

users/richie/home/gui/vscode/settings.json

@@ -35,7 +35,7 @@
   "sqltools.connections": [
     {
       "previewLimit": 50,
-      "server": "jeeves.taile39c31.ts.net",
+      "server": "192.168.90.40",
       "port": 5432,
       "askForPassword": true,
       "driver": "PostgreSQL",

users/richie/home/minimal.nix

@@ -1,27 +0,0 @@
-{ config, pkgs, ... }:
-{
-  imports = [
-    ./cli
-  ];
-
-  programs = {
-    home-manager.enable = true;
-  };
-
-  home = {
-    username = "richie";
-    homeDirectory = "/home/${config.home.username}";
-    stateVersion = "24.05";
-    sessionVariables.FLAKE = "$HOME/dotfiles";
-    packages = with pkgs; [
-      # cli
-      btop
-      eza
-      ripgrep
-      starship
-      tmux
-      # networking
-      wget
-    ];
-  };
-}

users/richie/home/programs.nix

@@ -3,6 +3,8 @@
   home.packages = with pkgs; [
     # cli
     bat
+    btop
+    eza
     fd
     ffmpegthumbnailer
     fzf
@@ -16,6 +18,9 @@
     p7zip
     poppler
     rar
+    ripgrep
+    starship
+    tmux
     unzip
     yazi
     zoxide
@@ -32,25 +37,19 @@
     # networking
     iperf3
     nmap
+    wget
     # python
     ruff
     uv
     # nodejs
     nodejs
     # Rust packages
-    bacon
-    cargo
-    cargo-audit
-    cargo-generate
-    cargo-machete
-    cargo-update
-    cargo-watch
-    clippy
-    rust-analyzer
-    rustc
-    rustfmt
     trunk
     wasm-pack
+    cargo-watch
+    cargo-generate
+    cargo-audit
+    cargo-update
     # cpp
     clang-tools
     clang_20

users/richie/home/ssh_config.nix

@@ -4,7 +4,7 @@
     enableDefaultConfig = false;
     settings = {
       jeeves = {
-        HostName = "jeeves";
+        HostName = "192.168.90.40";
         User = "richie";
         IdentityFile = "~/.ssh/id_ed25519";
         Port = 629;
@@ -18,7 +18,7 @@
         Port = 2222;
       };
       brain = {
-        HostName = "brain";
+        HostName = "192.168.90.35";
         User = "richie";
         IdentityFile = "~/.ssh/id_ed25519";
         Port = 129;
@@ -31,30 +31,18 @@
         Port = 2222;
       };
       bob = {
-        HostName = "bob";
+        HostName = "192.168.90.25";
         User = "richie";
         IdentityFile = "~/.ssh/id_ed25519";
         Port = 262;
         DynamicForward = [ { port = 9050; } ];
       };
       rhapsody-in-green = {
-        HostName = "rhapsody-in-green";
+        HostName = "192.168.90.221";
         User = "richie";
         IdentityFile = "~/.ssh/id_ed25519";
         Port = 922;
       };
-      portal-1 = {
-        HostName = "portal-1";
-        User = "richie";
-        IdentityFile = "~/.ssh/id_ed25519";
-        Port = 278;
-      };
-      "gitea.tmmworkshop.com" = {
-        HostName = "gitea.tmmworkshop.com";
-        User = "gitea";
-        IdentityFile = "~/.ssh/id_ed25519";
-        Port = 2223;
-      };
     };
   };
 }

users/richie/systems/portal-1.nix

@@ -1,5 +0,0 @@
-{
-  imports = [
-    ../home/minimal.nix
-  ];
-}

users/secrets.yaml

@@ -1,64 +1,62 @@
 richie_password: ENC[AES256_GCM,data:DMi3M8aqrQ60APIofr8wJMh+VZ14hLRxz6jWZgzswr0pV/QVSX53ShBFr90ruO3mucOLYv0l+bI31covfqMAhXWBJp9wUgtC2Q==,iv:qgtn30hZfIL4dBnQSLkjbo7zPJA4m9TR0f52sTFc0v4=,tag:ydLbcGyXjv0fE+4b5ECX5w==,type:str]
 math_password: ENC[AES256_GCM,data:ykiSr3iBHrShJarEQSJ/zuXbCPcbW2oUpaAjblu1V15ufFKVSMZM94LlpMiCYtN9cYBLs98hcMeajJbvgbwT5emPHthy9+TJDw==,iv:1TJEUo0ishqFAZiUE1473yR3RT6Gbtqt4zM+C1a1KEk=,tag:pR6jyIj+bu3XaSx5yIHSmA==,type:str]
-tailscale_auth_key: ENC[AES256_GCM,data:SZEfpVnqA84AQLA/geGsPNZfsWBktlM3Zrm7OpuSS/hCWWEKtSIbRYyovH68h8tQJBQFpv18n4oXJe9eAr6Mog==,iv:x1m6XPS/h818qNRcO+uqYjgTfd/FkxHHaSHHJrLyrp4=,tag:eOpcJIhzUWFzXTuRdS9S6w==,type:str]
-tailscale_oauth_client_id: ENC[AES256_GCM,data:+cWxKlLIcJtsLhqmZUNLVDs=,iv:qrTjhLfu82pzbZnU6BrK1n+Ncbm2Cl3MMCSTKCJ6H8U=,tag:s/N5XpLwNH1gZ+LzbqRr2g==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEMjQvSzZSY08vRlI0dzBP
-            YytpVlpPSGFHaTI5b2xzUkFFdEY0bVhQdGgwClM3UmM1OElpcEZTcTB0NHpSZ2d6
-            aVBpcjVIaDk3Tko1cm4xYjdkYVQ1L1EKLS0tIE1aQW95U0JIVGc4MGloSXRXc3ZS
-            a3EvU1dJdmxOeVBIS28yT3dHd2ZEYWcKv5TIqRRQs3AXER1WHEx8wotyXr2Ktxsu
-            dwldwEHyDNqwf7UgGOZu7JueeZ7y2KC8KZ7ixIdrhVaoxuLEvCg7VA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBObHhkaFlnaG4zaTZtbkIw
+            TkxSQnMxbDNwUVo4R1VYRDNKVFRDUE9kb0ZjCnpWWElJUVNuNFBsMzZod1ZQY0Fa
+            VXgxNjZ0TUJ3cEt2OTFWL2dGY0txVHMKLS0tIHNQU3Rsanh4dkc3ZElsai9YMFdH
+            cXUzVmFxTUVIOWZVR2Fpa2crdWsrdlkKwdGLfbKWc25qfBKyd/cawiUWv9iepKHN
+            EOp/LdH2GbCfnQSVbxi28ukLHxWqOLdqMm8xSni/Of2PXvMnpdyCyQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1u8zj599elqqvcmhxn8zuwrufsz8w8w366d3ayrljjejljt2q45kq8mxw9c
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByaE5jb3p3VzZ1dE05Wmlx
-            c1ZoWGhTcTRHRE9oMWtkaCtBY1l1a2QyWWlvCk9MM2FmcEZubXR1REpOcHZ6aHVE
-            UEkzbllZdkxPYzlTMHNod3VWNnhoaTgKLS0tIGVCdEpqUzhFM0swRjVjb0Z6ckFN
-            UzlYb1U4UGJqWE9oczdlNVh1S1lqL3cKSKxaJFhun2ee45I1jC55YKNdfYB8MsS+
-            dgFOFCvn/4uEcUyKZbUf0STjbIZ5eMHl8NVRTupI4tftGiE559M5Wg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6R0djMTArVmFySE5DMnFr
+            WFdBUERFbE1HRVVFd0oyaXJ2eU5HUStBUFN3CnR3ckZ2bkpGZFFScHQwTlBZYTMv
+            cTBXbGVoTXlWczhId05QVjZDRzFqRjQKLS0tIDNIcVBydHYwTGRnVU1mWWk4WTlR
+            eVlwQWgxSG5SdmFrWTlOcFo5eXZONWMKgx4huoSnbkRq0wQbsYgsWUKDTxDGNvYR
+            anVMQg+c7PwDlk1V4JQZ4WrYLx63Ep5qDjGlN/Ssf2Vo6rAuuKetcA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1q47vup0tjhulkg7d6xwmdsgrw64h4ax3la3evzqpxyy4adsmk9fs56qz3y
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2U01jTVZQT1RRRU1nQmVv
-            Z0lnOGJLN1c0UkNLbnJjV29na3Rub0xzbXhNCjY0aFNuUnFDUnZheDRHT3R5L3Fv
-            ZkJ3QkF2RENKRVdUYjRzRXMrNklvN2cKLS0tIFJzK2o1MmVTWHZMWmVDWlgzeGY5
-            VDg4OGl0NGFYY2VNZGY5UkR1cVdWY0UK1qa3swdfgUw1tnnThRf1sl9f2zTP/d/d
-            iwcenOEryXatVMJjZVWrLC5C7MwtKz+pIBXa98yaSpCDLqjAMwOCPg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2QjZYejFYbCswQjdmaDA0
+            L2ZqUUhtYU12YlpISmxueHQzRG5YL0tQNXh3CndGamMwRzYvUzkvaE9DVnMwTkNC
+            cFMxczZuOUorS3dnVUpjaVdCUjhLZ2MKLS0tIGlDeGRGa3dRbWgzT3NVYjBaYUJ4
+            VW5yeFlvWUZ5MVpNZHA5M1VXR1hxU1kKqii08/MB2aabgP4RQs1ry8AxmFqB8Mn+
+            m7B0u64aziKXLSl0u471wqgD+YGRwNcajXT2pHCy8QWLznzvIMSrxA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1jhf7vm0005j60mjq63696frrmjhpy8kpc2d66mw044lqap5mjv4snmwvwm
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTREI2UEZwS0Y0SmEvK1F4
-            Y1hZZjRVWWxMT29mc3ZXcHFDclRUYi96LzA4CkIwZ2h4T2JQRW1OL2hmRTFHWkFY
-            RHZqQUFqU3hvNlRBZHRiSThPVUE3TG8KLS0tIHh0Z2tlNXREczJsa1g2ekZyZjBt
-            dW41aVA3VEVqa1NDMHM0T3FKZFNTN0kKGQPRUMSRtibFVFRZR/igsjgxgDo4ogga
-            dUHBRU65r41er+Wk3lKdtbXJX1g83K8ay7540hNXheOhxFi57trrzA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrSUc3VnllVDFZTm1jRnlP
+            ZDBqelhkeHliZ1VlcjVnblQyeFlWclZTWkZjCjhJQk5EWkVoQjdoMHg4Zko4OU1C
+            NWFnVTIwV3RYbTZSeWttaVRPbjNrMG8KLS0tIDZWUHJSbVVlR0lKUDRtc3VqOTc1
+            cGJ3NDBLem9FNUpnbStYRTlqQStHV2sKwxPe4nTULsU0mVeUh8mhr2KX9U0iT5dL
+            zvHldoQG6mZHgtHK6XI5AQJYf+zUW66OKqNSxAnn+BM20QkAQVZNVw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age13lmqgc3jvkyah5e3vcwmj4s5wsc2akctcga0lpc0x8v8du3fxprqp4ldkv
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrV1Z2MGNPK28wTStRSUZW
-            dmFMaUt5MENHeUpVcDVxQnZhd1o5RmJwOWwwCittaGNrcW1hV25VaGJaTEhZRFBJ
-            Y2toWEpFWFZYT0plb2lkTlJCS2Mwb3MKLS0tIHlkVjVESWFsbWlVQ0xVQ0llclF2
-            L1FMbC91YjJsR3BGRjJ0QVQ1MDdBbEUKNnOI9+H1LJcvVcwl9uQMmFp35y5RB+Zl
-            Mo3z3unweQtS+jiUn7RyVs5daG1E2tfihu2CQDWaktuCuunMpt3Wew==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0NU9ac2FuRHI1dkQycmc0
+            YlhGK29UeTdiZEZXcWtPUW4rMis4Z2NWYWpJCkVldEdMc3ZTaDFidHpaZk5mM283
+            bTd0RlN5SHVabGhjeXFnSThydnVoem8KLS0tIElWclYvTmtkb0wyNDlKT3ZEckwx
+            L2NObzZadlJ5d3MyeGRqKy95L3BOMFEKtoswi6r2TmCZzngUkiGQV5TTsuzisMFS
+            5QI0aQZwhexqUMvbPuajYKvcPj+D6a2xaxbL3TBRLjOrFmcp5J7/YA==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age1ufnewppysaq2wwcl4ugngjz8pfzc5a35yg7luq0qmuqvctajcycs5lf6k4
+          recipient: age1l272y8udvg60z7edgje42fu49uwt4x2gxn5zvywssnv9h2krms8s094m4k
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqR0hUT3hxTzRwTVhuTm9E
-            TUFtNFFCYWNUNUNVbHNaNXQ0aEVBa04vSEU0CkRPVzhuYUsrM0wxZjRDdkxvTVA2
-            UW9CSjlIQW5yenhaUi9mbEdLYlhWYk0KLS0tIGRXMm9Wa3l4UWxqcGl6ZlBZV3E0
-            Z3YrbUYrSmV0NHNTeTdhMkJEdytwSmMKGLpe5+p4FGJNHy6SVgnsDbEsiP0J8lW/
-            0+3X3LQoL0f1S2L5DjexF/H0NGvWjAPaGzDNB6V50VxGDabEIVqjvQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByUlVjM2xpc281bHZzOGVo
+            L3VEclhJZDd5SS9mazFiTk9DcmxMaWxPT213ClNPWERKQU03OWk0OEVIY05ib2VG
+            WXhiZDhuMDZ5ZmFPWHB5RTFKYmpkVzAKLS0tIGppUndCb25wb2dyV01YbENrWjdU
+            TmMvWVpobnl0eXBIOGQwMW5BSlhJTUkKzua1artJWbZlKfzv27xfZJeBpntBYwUf
+            c8i1gNlvRwkhFAlrWcKR65vgyxsO3rbkLJRkcwG/q4hHj9zBeC/K2A==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age1vyav6kxtvt3z4vtnkkjj38eu8hlts5m7ygyckhskvalg2gpjk52su53d0a
-    lastmodified: "2026-08-25T15:35:53Z"
-    mac: ENC[AES256_GCM,data:4/WuSmUb2ONlB56dgbwwekZ8h7E1vvPzPxYCvNM8N68nt1nb9JxoMeAX9PktmljAarYLQJd1O5+49ZEph3Gzx9LrwvWnm9asq0UeeJi08x7wdQDcawNFlBFzXF2qlgxU1JssNHZZOB+5nYH4t8vFzPTq/9BqoifPR2+pLBYhUQI=,iv:N/gVgeWT2/1bfHuR6TanyDBijWmXAqyACXpnwfwDuVA=,tag:pQ4ct4G7SARz2wyjOc7AKQ==,type:str]
+          recipient: age1ufnewppysaq2wwcl4ugngjz8pfzc5a35yg7luq0qmuqvctajcycs5lf6k4
+    lastmodified: "2026-06-29T20:19:44Z"
+    mac: ENC[AES256_GCM,data:GIvQxWt4tZGn0fyiXVtxGFQQoNcFUgilF+/PSz50exVrmzsS0XQUk/TIDFHaQR9jlJI50jqlyc1rBHgjnqC2oPHhPWaaVhgF18vQI55rGKdymNFjsHnaCkblFVdR1RJm0FSB2Ri6y5k8tfN3ywiwromJRz4NYzr1hbmr36azfg4=,iv:V3jspeYt/d2wy13gUrQmPGARm0hxwvSL/mocJAUofdw=,tag:vARoUzBWTJKkONDGoQdzNQ==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.3
+    version: 3.13.1