- Add mcp flake input (git+ssh://git@git.wntrmute.dev/mc/mcp.git)
- Add mcp CLI to mcpkg.nix system packages (installed on all machines)
- Update mcp.nix to use Nix-managed mcp-agent binary path instead of
hardcoded /usr/local/bin/mcp-agent
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The previous commit removed the systemd service that stripped Tailscale's
~. DNS catch-all, breaking all DNS resolution — even when Tailscale is
disconnected. Restore it as fix-tailscale-dns, which restricts tailscale0
to only route ~scylla-hammerhead.ts.net queries.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The u2f udev rules set GROUP=plugdev on hidraw devices, but the
group didn't exist. Create it and add kyle to it so FIDO2 keys
are accessible without relying on logind uaccess ACLs.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace vendor-specific hidraw rule (3434) with libfido2 udev
package which covers all FIDO2 devices. Fixes FIDO2 key visibility
on orion.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Install mciasctl, mciasgrpcctl, mcrctl, and mcproxyctl via new
configs/mcpkg.nix module. Adds flake inputs for mcias, mcr, and
mc-proxy from git.wntrmute.dev.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove implicit reliance on temp iptables rules. All externally
accessible ports are now declared in NixOS config.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
All NixOS machines now trust the Metacircular platform CA. This
allows curl, browsers, and Go services to verify TLS certificates
issued by Metacrypt without --insecure or custom CA flags.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Link-level DNS from DHCP and Tailscale takes priority over global
nameservers in systemd-resolved. Use domain routing (~mcp.metacircular.net)
so resolved sends only internal zone queries to rift's CoreDNS.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
rift: sysctl to allow rootless containers to bind port 53, open
firewall for DNS queries from LAN clients.
vade: point nameservers at rift (LAN + Tailscale) for internal
service resolution via CoreDNS (MCNS precursor). Falls back to
1.1.1.1/8.8.8.8 via systemd-resolved.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
