Pin herdr v0.9.0 from the upstream flake (nixpkgs-unstable only has
0.7.1) and install it on straylight to host coding-agent terminals.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Update for the 26.05 bump and host changes: 8 hosts, orion is now a
server, straylight/svc added, vade on desktop-light, MCP modules,
and the current LUKS coverage.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Host-only 10.99.0.0/24 bridge with no uplink/NAT; firewall drops VM
traffic leaving the bridge so unikernel VMs can reach only the gateway
(mc-proxy). Implements Phase 2 mandatory-mediation networking.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Override the shared mcp.nix sandbox (PrivateDevices) on straylight so the
MCP agent can boot Nanos unikernel VMs under QEMU/KVM and manage TAP
devices for isolated networking.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add configs/mcp.nix (mcp user UID 850 + mcp-agent service) and open
firewall ports for DNS/mc-proxy/agent/master as straylight takes over
the master + MCIAS + MCNS core role from rift.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
BIOS boot with GRUB on /dev/xvda, MCP agent via systemd,
mc-proxy and MCNS as containers via MCP agent.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The LUKS device is named "luks-5c5e94fc-..." in hardware-configuration.nix
which already has the FIDO2 options. The "crypted" reference caused a build
error. Also fix duplicate attribute definitions and unnecessary config wrapper.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New root CA cert issued during Metacrypt vault rebuild. Same key
usage (Certificate Sign, CRL Sign), new validity period (2026-2046).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Same key, added CRL Sign to key usage extensions. Distributed to
all nodes and NixOS system trust store.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Use nixpkgs.hostPlatform module instead of deprecated system arg to lib.nixosSystem
- Rename services.logind.powerKey to services.logind.settings.Login.HandlePowerKey
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Rootless podman deeply caches the UID in storage, subuid mappings,
and systemd sessions. Changing it destroys all container state.
Reference: log/2026-04-03-uid-incident.md
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
kyleandClaude Fable 5.1
Kyle IsomandClaude Opus 4.8