servers

NixOS definitions and workflow tools for my servers. You are on one right now. You just got served.

(30 of 183) commits shown
legacy, forge: drop Pushover; the monitor alerts on /healthz (b660c34)
BT  ·  2026-10-11
8a27f49
main
forge: /healthz on infra.rtw.run for the monitor (b660c34)
BT  ·  2026-10-11
c7126d6
pin nixpkgs to align with app packages
BT  ·  2026-10-11
3d6a231
legacy: drop the TERM=xterm override; modules/shell.nix installs ghostty terminfo (d76e0c1)
BT  ·  2026-10-11
3a40a28
shell: ghostty terminfo and fish-like interactive bash on every host (d76e0c1)
BT  ·  2026-10-11
905b74b
deploy(sovrn): mx99's PDS origins are *.pds99, derived from its MX name (6bb1d7e)
BT  ·  2026-10-10
5405b6b
deploy(sovrn): cells' Stalwart domain is sovrn.internal; fleet.mailDomain is now zone (9cbbce8)
BT  ·  2026-10-10
cc97bab
deploy(sovrn): relay sends no reports, its DSNs go direct (b1f7229)
BT  ·  2026-10-09
57d4fa9
check-dns: expect SPF (v=spf1 a -all) on the backup relay; normalise quoted TXT from dig (b1f7229)
BT  ·  2026-10-09
8419232
deploy(sovrn): TLSA checks, migrate to devenv
BT  ·  2026-10-09
41d963f
just update-dns: converge the sovrn.at zone on the fleet through the Marque record (plan, confirm, goat putRecord with swapRecord, re-check)
BT  ·  2026-10-09
9696768
check-dns: failures in red, passes in green (terminal only; NO_COLOR respected)
BT  ·  2026-10-09
6515072
just check-dns: compare the sovrn.at zone (Marque record, nameservers, DNSSEC) with hosts.json and sovrn's fleet.nix
BT  ·  2026-10-09
572a729
deploy(sovrn): inbound DANE on mx99
BT  ·  2026-10-09
368154a
docs: provider firewall runbook (inbound rules per host and why; netcup's UDP reply rules for DNS, NTP, pyzor)
BT  ·  2026-10-08
c4d4afb
netcup: back to UDP upstream for unbound (reverts 0e9be99)
BT  ·  2026-10-08
41715a6
netcup: unbound queries upstream over TCP (netcup's policy drops UDP DNS replies; the relay's resolver got no answers, bug d4988da)
BT  ·  2026-10-08
0e9be99
deploy: mx99 sovrn 17c7b74 (Stalwart resolves through a local unbound; spam filter 31 s -> 0.1 s, bug d4988da)
BT  ·  2026-10-08
fac7738
plan: correct the Phase 9 note on sovrnd's /metrics (it doesn't exist yet)
BT  ·  2026-10-08
525594a
just: run colmena, nvd and nixos-anywhere through the dev shell, so recipes work from any shell
BT  ·  2026-10-08
f9f4a88
fleet: Phase 11, migration complete
BT  ·  2026-10-08
3a9f888
plan: record Phase 10 (automatic restore, live rehearsal on mx99)
BT  ·  2026-10-08
ef1b759
deploy: mx99 rebuilt on a new CAX11 (Primary IPs moved), restored from eu-mx99; sovrn 9c9ee66 (sovrnd waits for ZDS keys) (plan Phase 10)
BT  ·  2026-10-08
5493a4f
deploy: sovrn c6bfc5b (automatic restore, freshen-backups) on mx99 (generation 6); nothing restarted
BT  ·  2026-10-08
1d73e5d
plan: record Phase 9 (mx99 on the fleet, live acceptance)
BT  ·  2026-10-08
a9b4242
deploy: sovrn fcd22d7 (backupMx = mxb.eu.sovrn.at) on mx99 (generation 5)
BT  ·  2026-10-08
4de75d8
deploy: sovrn 6efaf8b (PDS health gate waits for the instance to listen) on mx99 (generation 4, built on mx99)
BT  ·  2026-10-08
67c1f54
deploy: sovrn c2db915 (first login no longer refused for a missing service record) on mx99 (generation 3)
BT  ·  2026-10-08
82984b7
deploy: sovrn afba45d (CellDiskFullSoon over 6h for staging cells) on infra.mymood.at (generation 18); mx99 unchanged
BT  ·  2026-10-08
5be4c1a
deploy: sovrn 2883fe7 (freshness probe waits for Litestream's socket) on mx99 (generation 2); infra.mymood.at unchanged
BT  ·  2026-10-07
5892661

An additional 153 commits exist. Clone the repo to review them.