nrec-nixos01: enable Git LFS and hide explore page

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/flake-check.yaml

@@ -0,0 +1,14 @@
+name: Run nix flake check
+on:
+  push:
+  pull_request:
+
+jobs:
+  flake-check:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/catthehacker/ubuntu:runner-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: cachix/install-nix-action@v27
+      - run: nix flake check

.github/workflows/flake-update.yaml

@@ -0,0 +1,27 @@
+---
+name: Periodic flake update
+on:  # yamllint disable-line rule:truthy
+  schedule:
+    - cron: "0 0 * * *"
+
+permissions:
+  contents: write
+
+jobs:
+  flake-update:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/catthehacker/ubuntu:runner-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: master
+      - uses: cachix/install-nix-action@v27
+      - name: configure git
+        run: |
+          git config --global user.name 'torjus-bot'
+          git config --global user.email 'torjus-bot@git.t-juice.club'
+      - name: flake update
+        run: nix flake update --commit-lock-file
+      - name: push
+        run: git push

.mcp.json.example

@@ -2,21 +2,21 @@
   "mcpServers": {
     "nixpkgs-options": {
       "command": "nix",
-      "args": ["run", "git+https://code.t-juice.club/torjus/labmcp#nixpkgs-search", "--", "options", "serve"],
+      "args": ["run", "git+https://git.t-juice.club/torjus/labmcp#nixpkgs-search", "--", "options", "serve"],
       "env": {
         "NIXPKGS_SEARCH_DATABASE": "sqlite:///run/user/1000/labmcp/nixpkgs-search.db"
       }
     },
     "nixpkgs-packages": {
       "command": "nix",
-      "args": ["run", "git+https://code.t-juice.club/torjus/labmcp#nixpkgs-search", "--", "packages", "serve"],
+      "args": ["run", "git+https://git.t-juice.club/torjus/labmcp#nixpkgs-search", "--", "packages", "serve"],
       "env": {
         "NIXPKGS_SEARCH_DATABASE": "sqlite:///run/user/1000/labmcp/nixpkgs-search.db"
       }
     },
     "lab-monitoring": {
       "command": "nix",
-      "args": ["run", "git+https://code.t-juice.club/torjus/labmcp#lab-monitoring", "--", "serve", "--enable-silences"],
+      "args": ["run", "git+https://git.t-juice.club/torjus/labmcp#lab-monitoring", "--", "serve", "--enable-silences"],
       "env": {
         "PROMETHEUS_URL": "https://prometheus.home.2rjus.net",
         "ALERTMANAGER_URL": "https://alertmanager.home.2rjus.net",
@@ -29,7 +29,7 @@
       "command": "nix",
       "args": [
         "run",
-        "git+https://code.t-juice.club/torjus/homelab-deploy",
+        "git+https://git.t-juice.club/torjus/homelab-deploy",
         "--",
         "mcp",
         "--nats-url", "nats://nats1.home.2rjus.net:4222",
@@ -39,7 +39,7 @@
     },
     "git-explorer": {
       "command": "nix",
-      "args": ["run", "git+https://code.t-juice.club/torjus/labmcp#git-explorer", "--", "serve"],
+      "args": ["run", "git+https://git.t-juice.club/torjus/labmcp#git-explorer", "--", "serve"],
       "env": {
         "GIT_REPO_PATH": "/home/torjus/git/nixos-servers"
       }

CLAUDE.md

@@ -326,7 +326,7 @@ Use `nix flake show` or `nix develop -c ansible-inventory --graph` to list all h
 - `nixpkgs-unstable` - Unstable channel (available via overlay as `pkgs.unstable.<package>`)
 - `nixos-exporter` - NixOS module for exposing flake revision metrics (used to verify deployments)
 - `homelab-deploy` - NATS-based remote deployment tool for test-tier hosts
-- Custom packages from code.t-juice.club:
+- Custom packages from git.t-juice.club:
   - `alerttonotify` - Alert routing
 
 ### Network Architecture
@@ -355,7 +355,7 @@ Most hosts use OpenBao (Vault) for secrets:
 
 All hosts pull updates daily from:
 ```
-git+https://code.t-juice.club/torjus/nixos-servers.git
+git+https://git.t-juice.club/torjus/nixos-servers.git
 ```
 
 Configured in `/system/autoupgrade.nix`:

docs/plans/completed/native-forgejo-runner.md

@@ -1,181 +0,0 @@
-# Native Nix Forgejo Runner on nix-cache02
-
-## Goal
-
-Add a second Forgejo Actions runner instance on nix-cache02 that executes jobs directly on the host (no containers). This allows CI builds to populate the nix binary cache automatically, reducing reliance on manually triggered builds before deployments.
-
-## Motivation
-
-- **Nix store caching**: The container-based `nix` label runs in ephemeral Podman containers, losing all nix store paths between jobs. Native execution uses the host's persistent store, so builds reuse cached paths automatically.
-- **Binary cache integration**: nix-cache02 *is* the binary cache server (Harmonia). Paths built by CI are immediately available to all hosts.
-- **Faster deploy cycle**: Currently updating a flake input (e.g. nixos-exporter) requires pushing to master, then waiting for the scheduled builder or manually triggering a build. With a native runner, repos can have CI workflows that run `nix build`, and those derivations are in the cache by the time hosts auto-upgrade.
-- **NixOS config builds**: Enables future workflows that build `nixosConfigurations.*` from this repo, populating the cache as a side effect of CI.
-
-## Design
-
-### Two Runner Instances
-
-- **actions1** (existing) — Container-based, global runner available to all Forgejo repos. Unchanged.
-- **actions-native** (new) — Host-based, registered as a user-level runner under the `torjus` Forgejo account, so only repos owned by that user can target it.
-
-### Trusted Repos
-
-Repos that should be allowed to use the native runner:
-
-- `torjus/nixos-servers`
-- `torjus/nixos-exporter`
-- `torjus/nixos` (gunter/magicman configs)
-- Other repos with nix builds that benefit from cache population (add as needed)
-
-Restriction is configured in the Forgejo web UI when registering the runner — scope it to the user or specific repos.
-
-### Label Configuration
-
-```nix
-labels = [ "native-nix:host" ];
-```
-
-Workflow files in trusted repos target this with `runs-on: native-nix`.
-
-### Host Packages
-
-The runner needs nix and basic tools available on the host:
-
-```nix
-hostPackages = with pkgs; [
-  bash
-  coreutils
-  curl
-  gawk
-  git
-  gnused
-  nodejs
-  wget
-  nix
-];
-```
-
-## Security Analysis
-
-### What the runner CAN access
-
-- **Nix store** — Can read and write derivations. This is the whole point; harmonia serves the store to all hosts.
-- **Network** — Full network access during job execution.
-- **World-readable files** — Standard for any process on the system.
-
-### What the runner CANNOT access
-
-- **Cache signing key** — `/run/secrets/cache-secret` is mode `0400` root-owned. Harmonia signs derivations on serve, not on store write.
-- **Vault AppRole credentials** — `/var/lib/vault/approle/` is root-owned.
-- **Other vault secrets** — All in `/run/secrets/` with restrictive permissions.
-
-### Mitigations
-
-- **User-level runner** — Registered to the `torjus` user on Forgejo (not global), so only repos owned by that user can submit jobs.
-- **DynamicUser** — The runner uses systemd DynamicUser, so no persistent user account. Each invocation gets an ephemeral UID.
-- **Nix sandbox** — Nix builds already run sandboxed by default. Non-nix `run:` steps execute as the runner's system user but have no special privileges.
-- **Separate instance** — Container-based jobs (untrusted repos) remain on actions1 and never get host access.
-
-### Accepted Risks
-
-- A compromised trusted repo could inject bad derivations into the nix store/cache. This is an accepted risk since those repos already have deploy access to production hosts.
-- Jobs can consume host resources (CPU, memory, disk). The `runner.capacity` setting limits concurrent jobs.
-
-## Implementation
-
-### 1. Register runner on Forgejo and store token in Vault
-
-- In Forgejo web UI: go to user settings > Actions > Runners, create a new runner registration token.
-- Store the token in Vault via Terraform.
-
-**terraform/vault/variables.tf** — add variable:
-```hcl
-variable "forgejo_native_runner_token" {
-  description = "Forgejo Actions runner token for native nix runner on nix-cache02"
-  type        = string
-  default     = "PLACEHOLDER"
-  sensitive   = true
-}
-```
-
-**terraform/vault/secrets.tf** — add secret:
-```hcl
-"hosts/nix-cache02/forgejo-native-runner-token" = {
-  auto_generate = false
-  data          = { token = var.forgejo_native_runner_token }
-}
-```
-
-### 2. Add NixOS configuration for native runner instance
-
-Note: nix-cache02 already has an AppRole with access to `secret/data/hosts/nix-cache02/*` (defined in `terraform/vault/hosts-generated.tf`), so no approle changes are needed.
-
-**File:** `hosts/nix-cache02/actions-runner.nix`
-
-Add vault secret and runner instance alongside the existing overrides:
-
-```nix
-# Fetch native runner token from Vault
-vault.secrets.forgejo-native-runner-token = {
-  secretPath = "hosts/nix-cache02/forgejo-native-runner-token";
-  extractKey = "token";
-  mode = "0444";
-  services = [ "gitea-runner-actions-native" ];
-};
-
-# Native nix runner instance
-services.gitea-actions-runner.instances.actions-native = {
-  enable = true;
-  name = "${config.networking.hostName}-native";
-  url = "https://code.t-juice.club";
-  tokenFile = "/run/secrets/forgejo-native-runner-token";
-  labels = [ "native-nix:host" ];
-  hostPackages = with pkgs; [
-    bash coreutils curl gawk git gnused nodejs wget nix
-  ];
-  settings = {
-    runner.capacity = 4;
-    cache = {
-      enabled = true;
-      dir = "/var/lib/gitea-runner/actions-native/cache";
-    };
-  };
-};
-```
-
-### 3. Build and deploy
-
-1. Create feature branch
-2. Apply Terraform changes (variables + secrets + approle policy)
-3. Set the actual token value in `terraform.tfvars`
-4. Run `tofu apply` in `terraform/vault/`
-5. Build the NixOS configuration: `nix build .#nixosConfigurations.nix-cache02.config.system.build.toplevel`
-6. Deploy to nix-cache02
-7. Verify the native runner appears as online in Forgejo UI
-
-### 4. Test with a workflow
-
-In a trusted repo (e.g. nixos-exporter):
-
-```yaml
-name: Build
-on: [push]
-jobs:
-  build:
-    runs-on: native-nix
-    steps:
-      - uses: actions/checkout@v4
-      - run: nix build
-```
-
-## Future Work
-
-- **NixOS config CI**: Workflow that builds all `nixosConfigurations` on push to master, populating the binary cache.
-- **Nix store GC policy**: CI builds will accumulate store paths. Since this host is the binary cache, GC needs to be conservative — only delete paths not referenced by current system configurations. Defer to a follow-up.
-- **Resource limits**: Consider systemd MemoryMax/CPUQuota on the native runner if resource contention becomes an issue.
-- **Additional host packages**: Evaluate whether tools like `cachix` or `nix-prefetch-*` should be added.
-
-## Open Questions
-
-- Should `hostPackages` include additional tools beyond the basics listed above?
-- Do we want a separate capacity for the native runner vs container runner, or is 4 fine for both?

docs/plans/pn51-stability.md

@@ -169,14 +169,6 @@ These appear on both units and can be ignored:
 - Journal corruption confirmed on next boot
 - No pstore data captured
 
-### 2026-03-12: pn02 Memtest86 — 38 Passes, Zero Errors
-
-- Ran memtest86 for ~109 hours (4.5 days), completing 38 full passes
-- **Zero errors found** — RAM appears healthy
-- Makes hardware-induced memory corruption less likely as the sole cause of crashes
-- Memtest cannot rule out CPU cache errors, PCIe/IOMMU issues, or kernel bugs triggered by platform quirks
-- **Next step**: Boot back into NixOS with sched_ext disabled to test the kernel scheduler hypothesis
-
 ### 2026-03-07: pn01 Status
 
 - pn01 has had **zero crashes** since initial setup on Feb 21
@@ -201,18 +193,18 @@ These appear on both units and can be ignored:
 
 **pn02 is unreliable.** After exhausting mitigations (fTPM disabled, BIOS updated, WiFi/BT disabled, ErP disabled, amdgpu blacklisted, processor.max_cstate=1, NMI watchdog, rasdaemon), the unit still crashes every few days. 26 reboots in 30 days (7 unclean crashes + daily auto-upgrade reboots).
 
-The pstore crash dumps from March reveal a new dimension: at least some crashes are **kernel scheduler bugs in sched_ext**, not just silent hardware-level freezes. The `set_next_task_scx` and `pick_next_task_fair` crash sites, combined with the dbus-daemon segfault before one crash, suggest possible memory corruption that manifests in the scheduler. Memtest86 ran 38 passes (109 hours) with zero errors, making option 2 less likely. Remaining possibilities:
+The pstore crash dumps from March reveal a new dimension: at least some crashes are **kernel scheduler bugs in sched_ext**, not just silent hardware-level freezes. The `set_next_task_scx` and `pick_next_task_fair` crash sites, combined with the dbus-daemon segfault before one crash, suggest possible memory corruption that manifests in the scheduler. It's unclear whether this is:
 1. A sched_ext kernel bug exposed by the PN51's hardware quirks (unstable TSC, C-state behavior)
-2. ~~Hardware-induced memory corruption that happens to hit scheduler data structures~~ — unlikely after clean memtest
+2. Hardware-induced memory corruption that happens to hit scheduler data structures
 3. A pure software bug in the 6.12.74 kernel's sched_ext implementation
 
 **pn01 is stable** — zero crashes in 30 days of continuous operation. Both units have identical kernel and NixOS configuration (minus pn02's diagnostic mitigations), so the difference points toward a hardware defect specific to the pn02 board.
 
 ## Next Steps
 
-- **~~pn02 memtest~~**: ~~Run memtest86 for 24h+~~ — Done (2026-03-12): 38 passes over 109 hours, zero errors. RAM is not the issue.
-- **pn02 sched_ext test**: Disable sched_ext (`boot.kernelParams = [ "sched_ext.enabled=0" ]` or equivalent) and run for 1-2 weeks to test whether the crashes stop — would help distinguish kernel bug from hardware defect
-- **pn02**: If sched_ext disable doesn't help, consider scrapping or repurposing for non-critical workloads that tolerate random reboots (auto-recovery via hardware watchdog is working)
+- **pn02 memtest**: Run memtest86 for 24h+ (available in systemd-boot menu). The crash signatures (userspace segfaults before kernel panics, corrupted pointers in scheduler structures) are consistent with intermittent RAM errors that a quick pass wouldn't catch. If memtest finds errors, swap the DIMM.
+- **pn02**: Consider scrapping or repurposing for non-critical workloads that tolerate random reboots (auto-recovery via hardware watchdog is now working)
+- **pn02 investigation**: Could try disabling sched_ext (`boot.kernelParams = [ "sched_ext.enabled=0" ]` or equivalent) to test whether the crashes stop — would help distinguish kernel bug from hardware defect
 - **pn01**: Continue monitoring. If it remains stable long-term, it is viable for light workloads
 - If pn01 eventually crashes, apply the same mitigations (amdgpu blacklist, max_cstate=1) to see if they help
 - For the Incus hypervisor plan: likely need different hardware. Evaluating GMKtec G3 (Intel) as an alternative. Note: mixed Intel/AMD cluster complicates live migration

flake.lock

@@ -7,18 +7,18 @@
         ]
       },
       "locked": {
-        "lastModified": 1773079666,
-        "narHash": "sha256-midgZRnFEybsH3uJazCJcF9i5Tm5hYVH7+oDLAFpLtU=",
+        "lastModified": 1739310461,
+        "narHash": "sha256-GscftfATX84Aae9FObrQOe+hr5MsEma2Fc5fdzuu3hA=",
         "ref": "master",
-        "rev": "d8c08778f941a459fccae932e3768f9b9fe1783d",
-        "revCount": 11,
+        "rev": "53915cec6356be1a2d44ac2cbd0a71b32d679e6f",
+        "revCount": 7,
         "type": "git",
-        "url": "https://code.t-juice.club/torjus/alerttonotify"
+        "url": "https://git.t-juice.club/torjus/alerttonotify"
       },
       "original": {
         "ref": "master",
         "type": "git",
-        "url": "https://code.t-juice.club/torjus/alerttonotify"
+        "url": "https://git.t-juice.club/torjus/alerttonotify"
       }
     },
     "homelab-deploy": {
@@ -28,18 +28,18 @@
         ]
       },
       "locked": {
-        "lastModified": 1773081467,
-        "narHash": "sha256-K22nYBq4FXe/1NJ/wg0uUbFrutgw2j9axbA/1NvvK8E=",
+        "lastModified": 1771488195,
+        "narHash": "sha256-2kMxqdDyPluRQRoES22Y0oSjp7pc5fj2nRterfmSIyc=",
         "ref": "master",
-        "rev": "713d1e7584c1e076fcf8e6248e2d022027832e86",
-        "revCount": 38,
+        "rev": "2d26de50559d8acb82ea803764e138325d95572c",
+        "revCount": 37,
         "type": "git",
-        "url": "https://code.t-juice.club/torjus/homelab-deploy"
+        "url": "https://git.t-juice.club/torjus/homelab-deploy"
       },
       "original": {
         "ref": "master",
         "type": "git",
-        "url": "https://code.t-juice.club/torjus/homelab-deploy"
+        "url": "https://git.t-juice.club/torjus/homelab-deploy"
       }
     },
     "nixos-exporter": {
@@ -49,17 +49,17 @@
         ]
       },
       "locked": {
-        "lastModified": 1773081113,
-        "narHash": "sha256-99hs9Gvzc+M9hSTY7zSHL7TmhPkOYZ/9li9OhN3kXWc=",
+        "lastModified": 1770593543,
+        "narHash": "sha256-hT8Rj6JAwGDFvcxWEcUzTCrWSiupCfBa57pBDnM2C5g=",
         "ref": "refs/heads/master",
-        "rev": "79900ae92df5607235f6ddb28eda67270d996819",
-        "revCount": 16,
+        "rev": "5aa5f7275b7a08015816171ba06d2cbdc2e02d3e",
+        "revCount": 15,
         "type": "git",
-        "url": "https://code.t-juice.club/torjus/nixos-exporter"
+        "url": "https://git.t-juice.club/torjus/nixos-exporter"
       },
       "original": {
         "type": "git",
-        "url": "https://code.t-juice.club/torjus/nixos-exporter"
+        "url": "https://git.t-juice.club/torjus/nixos-exporter"
       }
     },
     "nixpkgs": {

flake.nix

@@ -6,15 +6,15 @@
     nixpkgs-unstable.url = "github:nixos/nixpkgs?ref=nixos-unstable";
 
     alerttonotify = {
-      url = "git+https://code.t-juice.club/torjus/alerttonotify?ref=master";
+      url = "git+https://git.t-juice.club/torjus/alerttonotify?ref=master";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
     nixos-exporter = {
-      url = "git+https://code.t-juice.club/torjus/nixos-exporter";
+      url = "git+https://git.t-juice.club/torjus/nixos-exporter";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
     homelab-deploy = {
-      url = "git+https://code.t-juice.club/torjus/homelab-deploy?ref=master";
+      url = "git+https://git.t-juice.club/torjus/homelab-deploy?ref=master";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
   };
@@ -227,24 +227,6 @@
             ./hosts/nrec-nixos01
           ];
         };
-        nrec-nixos02 = nixpkgs.lib.nixosSystem {
-          inherit system;
-          specialArgs = {
-            inherit inputs self;
-          };
-          modules = commonModules ++ [
-            ./hosts/nrec-nixos02
-          ];
-        };
-        media1 = nixpkgs.lib.nixosSystem {
-          inherit system;
-          specialArgs = {
-            inherit inputs self;
-          };
-          modules = commonModules ++ [
-            ./hosts/media1
-          ];
-        };
         openstack-template = nixpkgs.lib.nixosSystem {
           inherit system;
           specialArgs = {

hosts/media1/configuration.nix

@@ -1,84 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-
-{
-  imports = [
-    ./hardware-configuration.nix
-    ../../system
-  ];
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  networking.hostName = "media1";
-  networking.domain = "home.2rjus.net";
-  networking.useNetworkd = true;
-  networking.useDHCP = false;
-  networking.firewall.enable = false;
-  services.resolved.enable = true;
-  networking.nameservers = [
-    "10.69.13.5"
-    "10.69.13.6"
-  ];
-
-  systemd.network.enable = true;
-  systemd.network.networks."10-lan" = {
-    matchConfig.Name = "enp*";
-    address = [
-      "10.69.31.51/24"
-    ];
-    routes = [
-      { Gateway = "10.69.31.1"; }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-  };
-
-  time.timeZone = "Europe/Oslo";
-
-  homelab.host = {
-    tier = "prod";
-    priority = "low";
-    role = "media";
-  };
-
-  # Intel N100 (Alder Lake-N) graphics
-  hardware.graphics = {
-    enable = true;
-    extraPackages = with pkgs; [
-      intel-media-driver # VA-API driver for Broadwell+
-    ];
-  };
-
-  # NFS for media access
-  environment.systemPackages = with pkgs; [
-    nfs-utils
-  ];
-  services.rpcbind.enable = true;
-
-  systemd.mounts = [
-    {
-      type = "nfs";
-      mountConfig = {
-        Options = "ro,soft,noatime";
-      };
-      what = "nas.home.2rjus.net:/mnt/hdd-pool/media";
-      where = "/mnt/nas/media";
-    }
-  ];
-
-  systemd.automounts = [
-    {
-      wantedBy = [ "multi-user.target" ];
-      automountConfig = {
-        TimeoutIdleSec = "5min";
-      };
-      where = "/mnt/nas/media";
-    }
-  ];
-
-  vault.enable = true;
-
-  system.stateVersion = "25.11";
-}

hosts/media1/default.nix

@@ -1,7 +0,0 @@
-{ ... }:
-{
-  imports = [
-    ./configuration.nix
-    ./media-desktop.nix
-  ];
-}

hosts/media1/hardware-configuration.nix

@@ -1,33 +0,0 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/0e1f61fd-18c6-4114-942e-f113a1e4b347";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/03C8-7DFE";
-      fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/0871bf99-9db6-4cd7-b307-3cebbb0a4e60"; }
-    ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/media1/media-desktop.nix

@@ -1,166 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-let
-  kodiPkg = pkgs.kodi-wayland.withPackages (p: [
-    p.jellycon
-    p.sendtokodi
-    p.inputstream-adaptive
-  ]);
-
-  hyprlandConfig = ''
-    # Monitor — auto-detect, native resolution
-    monitor = , preferred, auto, 1
-
-    # Keyboard layout
-    input {
-      kb_layout = no
-    }
-
-    # Launch Kodi, Firefox, and kitty on login
-    exec-once = ${lib.getExe' kodiPkg "kodi"}
-    exec-once = ${lib.getExe pkgs.firefox}
-    exec-once = ${lib.getExe pkgs.kitty}
-
-    # Workspace rules — Kodi on 1, Firefox on 2, kitty on 3
-    windowrulev2 = workspace 1 silent, class:^(kodi)$
-    windowrulev2 = workspace 2 silent, class:^(firefox)$
-    windowrulev2 = workspace 3 silent, class:^(kitty)$
-    windowrulev2 = fullscreen, class:^(kodi)$
-    windowrulev2 = fullscreen, class:^(firefox)$
-    windowrulev2 = fullscreen, class:^(kitty)$
-
-    # Start on workspace 1 (Kodi)
-    workspace = 1, default:true
-
-    # Switch workspaces with Super+1/2/3
-    bind = SUPER, 1, workspace, 1
-    bind = SUPER, 2, workspace, 2
-    bind = SUPER, 3, workspace, 3
-
-    # No gaps, no borders — TV setup
-    general {
-      gaps_in = 0
-      gaps_out = 0
-      border_size = 0
-    }
-
-    decoration {
-      rounding = 0
-    }
-
-    # Disable animations for snappy switching
-    animations {
-      enabled = false
-    }
-
-    misc {
-      # Disable Hyprland logo/splash
-      disable_hyprland_logo = true
-      disable_splash_rendering = true
-    }
-  '';
-in
-{
-  # Hyprland compositor with UWSM for proper dbus/systemd session management
-  programs.hyprland = {
-    enable = true;
-    withUWSM = true;
-    portalPackage = pkgs.xdg-desktop-portal-hyprland;
-  };
-
-  # greetd for auto-login — UWSM starts Hyprland as a systemd session
-  services.greetd = {
-    enable = true;
-    settings = {
-      default_session = {
-        command = "uwsm start hyprland-uwsm.desktop";
-        user = "kodi";
-      };
-    };
-  };
-
-  # Deploy Hyprland config to kodi user's XDG config dir
-  systemd.tmpfiles.rules = [
-    "d /home/kodi/.config/hypr 0755 kodi kodi -"
-  ];
-  environment.etc."skel/hypr/hyprland.conf".text = hyprlandConfig;
-  system.activationScripts.hyprlandConfig = lib.stringAfter [ "users" ] ''
-    install -D -o kodi -g kodi -m 0644 /dev/stdin /home/kodi/.config/hypr/hyprland.conf <<'HYPRCONF'
-    ${hyprlandConfig}
-    HYPRCONF
-  '';
-
-  # Kodi user
-  users.users.kodi = {
-    isNormalUser = true;
-    home = "/home/kodi";
-    homeMode = "750";
-    group = "kodi";
-    extraGroups = [
-      "video"
-      "audio"
-      "input"
-    ];
-  };
-  users.groups.kodi = { };
-
-  # Allow promtail to read kodi logs
-  users.users.promtail.extraGroups = [ "kodi" ];
-  systemd.services.promtail.serviceConfig.ProtectHome = lib.mkForce "read-only";
-
-  # Packages available on the system
-  environment.systemPackages = [
-    kodiPkg
-    pkgs.firefox
-    pkgs.kitty
-    pkgs.yt-dlp
-  ];
-
-  # PipeWire for audio (HDMI passthrough support)
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    pulse.enable = true;
-    wireplumber.extraConfig."60-hdmi-default" = {
-      "monitor.alsa.rules" = [
-        {
-          matches = [{ "node.name" = "~alsa_output.pci-.*hdmi.*"; }];
-          actions.update-props = {
-            "priority.session" = 2000;
-            "priority.driver" = 2000;
-          };
-        }
-      ];
-    };
-  };
-
-  # Allow VA-API hardware decode in Firefox
-  environment.sessionVariables = {
-    MOZ_ENABLE_WAYLAND = "1";
-    LIBVA_DRIVER_NAME = "iHD";
-  };
-
-  # Ship Kodi logs to Loki
-  services.promtail.configuration.scrape_configs = [
-    {
-      job_name = "kodi";
-      static_configs = [
-        {
-          targets = [ "localhost" ];
-          labels = {
-            job = "kodi";
-            hostname = config.networking.hostName;
-            tier = config.homelab.host.tier;
-            role = config.homelab.host.role;
-            __path__ = "/home/kodi/.kodi/temp/kodi.log";
-          };
-        }
-      ];
-    }
-  ];
-}

hosts/nix-cache02/actions-runner.nix

@@ -1,51 +0,0 @@
-{ config, pkgs, ... }:
-{
-  # Fetch runner token from Vault
-  vault.secrets.forgejo-runner-token = {
-    secretPath = "hosts/nix-cache02/forgejo-runner-token";
-    extractKey = "token";
-    mode = "0444";
-    services = [ "gitea-runner-actions1" ];
-  };
-
-  # Override token source and runner capacity
-  services.gitea-actions-runner.instances.actions1 = {
-    tokenFile = "/run/secrets/forgejo-runner-token";
-    settings.runner.capacity = 4;
-  };
-
-  # Fetch native runner token from Vault
-  vault.secrets.forgejo-native-runner-token = {
-    secretPath = "hosts/nix-cache02/forgejo-native-runner-token";
-    extractKey = "token";
-    mode = "0444";
-    services = [ "gitea-runner-actions-native" ];
-  };
-
-  # Native nix runner instance (user-level, no containers)
-  services.gitea-actions-runner.instances.actions-native = {
-    enable = true;
-    name = "${config.networking.hostName}-native";
-    url = "https://code.t-juice.club";
-    tokenFile = "/run/secrets/forgejo-native-runner-token";
-    labels = [ "native-nix:host" ];
-    hostPackages = with pkgs; [
-      bash
-      coreutils
-      curl
-      gawk
-      git
-      gnused
-      nodejs
-      wget
-      nix
-    ];
-    settings = {
-      runner.capacity = 4;
-      cache = {
-        enabled = true;
-        dir = "/var/lib/gitea-runner/actions-native/cache";
-      };
-    };
-  };
-}

hosts/nix-cache02/builder.nix

@@ -16,11 +16,11 @@
 
     settings.repos = {
       nixos-servers = {
-        url = "git+https://code.t-juice.club/torjus/nixos-servers.git";
+        url = "git+https://git.t-juice.club/torjus/nixos-servers.git";
         defaultBranch = "master";
       };
       nixos = {
-        url = "git+https://code.t-juice.club/torjus/nixos.git";
+        url = "git+https://git.t-juice.club/torjus/nixos.git";
         defaultBranch = "master";
       };
     };

hosts/nix-cache02/default.nix

@@ -3,8 +3,6 @@
     ./configuration.nix
     ./builder.nix
     ./scheduler.nix
-    ./actions-runner.nix
     ../../services/nix-cache
-    ../../services/actions-runner
   ];
 }

hosts/nrec-nixos01/configuration.nix

@@ -34,11 +34,6 @@
     autoResize = true;
   };
 
-  fileSystems."/var/lib/forgejo/data/packages" = {
-    device = "/dev/disk/by-uuid/25a84568-b36a-47b3-a6d0-b959209cfdaf";
-    fsType = "ext4";
-  };
-
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/vda";
   networking.hostName = "nrec-nixos01";
@@ -70,7 +65,7 @@
 
   services.caddy = {
     enable = true;
-    virtualHosts."code.t-juice.club" = {
+    virtualHosts."nrec-nixos01.t-juice.club" = {
       extraConfig = ''
         reverse_proxy 127.0.0.1:3000
       '';

hosts/nrec-nixos02/configuration.nix

@@ -1,85 +0,0 @@
-{ lib, pkgs, ... }:
-
-{
-  services.openssh = {
-    enable = true;
-    settings = {
-      PermitRootLogin = lib.mkForce "no";
-      PasswordAuthentication = false;
-    };
-  };
-
-  users.users.nixos = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" ];
-    shell = pkgs.zsh;
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwfb2jpKrBnCw28aevnH8HbE5YbcMXpdaVv2KmueDu6 torjus@gunter"
-    ];
-  };
-  security.sudo.wheelNeedsPassword = false;
-  programs.zsh.enable = true;
-
-  homelab.dns.enable = false;
-  homelab.monitoring.enable = false;
-  homelab.host.labels.ansible = "false";
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/nixos";
-    fsType = "ext4";
-    autoResize = true;
-  };
-
-  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/vda";
-  networking.hostName = "nrec-nixos02";
-  networking.useNetworkd = true;
-  networking.useDHCP = false;
-  services.resolved.enable = true;
-
-  systemd.network.enable = true;
-  systemd.network.networks."ens3" = {
-    matchConfig.Name = "ens3";
-    networkConfig.DHCP = "ipv4";
-    linkConfig.RequiredForOnline = "routable";
-  };
-  time.timeZone = "Europe/Oslo";
-
-  networking.firewall.enable = true;
-  networking.firewall.allowedTCPPorts = [
-    22
-    80
-    443
-  ];
-
-  nix.settings.substituters = [
-    "https://cache.nixos.org"
-  ];
-  nix.settings.trusted-public-keys = [
-    "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-  ];
-
-  services.pocket-id = {
-    enable = true;
-    settings = {
-      APP_URL = "https://oidc.t-juice.club";
-      TRUST_PROXY = true;
-      ANALYTICS_DISABLED = true;
-      VERSION_CHECK_DISABLED = true;
-      HOST = "127.0.0.1";
-    };
-  };
-
-  services.caddy = {
-    enable = true;
-    virtualHosts."oidc.t-juice.club" = {
-      extraConfig = ''
-        reverse_proxy 127.0.0.1:1411
-      '';
-    };
-  };
-
-  zramSwap.enable = true;
-
-  system.stateVersion = "25.11";
-}

hosts/nrec-nixos02/default.nix

@@ -1,9 +0,0 @@
-{ modulesPath, ... }:
-{
-  imports = [
-    ./configuration.nix
-    ../../system/packages.nix
-    ../../services/actions-runner
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-}

hosts/pn02/configuration.nix

@@ -15,7 +15,7 @@
   boot.loader.systemd-boot.memtest86.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
   boot.blacklistedKernelModules = [ "amdgpu" ];
-  boot.kernelParams = [ "panic=10" "nmi_watchdog=1" "processor.max_cstate=1" "sched_ext.enabled=0" ];
+  boot.kernelParams = [ "panic=10" "nmi_watchdog=1" "processor.max_cstate=1" ];
   boot.kernel.sysctl."kernel.softlockup_panic" = 1;
   boot.kernel.sysctl."kernel.hardlockup_panic" = 1;
 

hosts/template2/bootstrap.nix

@@ -70,10 +70,10 @@ let
       echo "Waiting for network connectivity..."
 
       # Verify we can reach the git server via HTTPS (doesn't respond to ping)
-      if ! curl -s --connect-timeout 5 --max-time 10 https://code.t-juice.club >/dev/null 2>&1; then
-        echo "ERROR: Cannot reach code.t-juice.club via HTTPS"
+      if ! curl -s --connect-timeout 5 --max-time 10 https://git.t-juice.club >/dev/null 2>&1; then
+        echo "ERROR: Cannot reach git.t-juice.club via HTTPS"
         echo "Check network configuration and DNS settings"
-        log_to_loki "failed" "Network check failed - cannot reach code.t-juice.club"
+        log_to_loki "failed" "Network check failed - cannot reach git.t-juice.club"
         exit 1
       fi
 
@@ -134,7 +134,7 @@ let
       log_to_loki "building" "Starting nixos-rebuild boot"
 
       # Build and activate the host-specific configuration
-      FLAKE_URL="git+https://code.t-juice.club/torjus/nixos-servers.git?ref=$BRANCH#''${HOSTNAME}"
+      FLAKE_URL="git+https://git.t-juice.club/torjus/nixos-servers.git?ref=$BRANCH#''${HOSTNAME}"
 
       if nixos-rebuild boot --flake "$FLAKE_URL"; then
         echo "Successfully built configuration for $HOSTNAME"

services/actions-runner/default.nix

@@ -1,37 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  # Trust podman interfaces so containers can reach the runner's cache service.
-  # "podman+" is a wildcard matching any interface starting with "podman".
-  networking.firewall.trustedInterfaces = [ "podman+" ];
-
-  virtualisation.podman = {
-    enable = true;
-    dockerCompat = true;
-    dockerSocket.enable = true;
-  };
-
-  services.gitea-actions-runner = {
-    package = pkgs.forgejo-runner;
-
-    instances.actions1 = {
-      enable = true;
-      name = config.networking.hostName;
-      url = "https://code.t-juice.club";
-      tokenFile = lib.mkDefault "/var/lib/forgejo-runner/token";
-      labels = [
-        "nix:docker://code.t-juice.club/torjus/runner-images/nix:latest"
-        "node-bookworm:docker://node:lts-bookworm-slim"
-        "alpine:docker://alpine:latest"
-        "golang:docker://code.t-juice.club/torjus/runner-images/golang:latest"
-      ];
-      settings = {
-        runner.capacity = lib.mkDefault 2;
-        cache = {
-          enabled = true;
-          dir = "/var/lib/gitea-runner/actions1/cache";
-        };
-        container.privileged = false;
-      };
-    };
-  };
-}

services/forgejo/default.nix

@@ -1,17 +1,16 @@
-{ pkgs, ... }:
+{ ... }:
 {
   services.forgejo = {
-    package = pkgs.forgejo;
     enable = true;
     database.type = "sqlite3";
-    lfs.enable = true;
     settings = {
       server = {
-        DOMAIN = "code.t-juice.club";
-        ROOT_URL = "https://code.t-juice.club/";
+        DOMAIN = "nrec-nixos01.t-juice.club";
+        ROOT_URL = "https://nrec-nixos01.t-juice.club/";
         HTTP_ADDR = "127.0.0.1";
         HTTP_PORT = 3000;
       };
+      server.LFS_START_SERVER = true;
       service.DISABLE_REGISTRATION = true;
       "service.explore".REQUIRE_SIGNIN_VIEW = true;
       session.COOKIE_SECURE = true;

services/ns/external-hosts.nix

@@ -21,6 +21,9 @@
     # 30
     "gunter" = "10.69.30.105";
 
+    # 31
+    "media" = "10.69.31.50";
+
     # 99_MGMT
     "sw1" = "10.69.99.2";
   };

system/autoupgrade.nix

@@ -4,6 +4,6 @@
     enable = true;
     randomizedDelaySec = "1h";
     allowReboot = true;
-    flake = "git+https://code.t-juice.club/torjus/nixos-servers.git";
+    flake = "git+https://git.t-juice.club/torjus/nixos-servers.git";
   };
 }

system/homelab-deploy.nix

@@ -18,7 +18,7 @@ in
       role = hostCfg.role;
       natsUrl = "nats://nats1.home.2rjus.net:4222";
       nkeyFile = "/run/secrets/homelab-deploy-nkey";
-      flakeUrl = "git+https://code.t-juice.club/torjus/nixos-servers.git";
+      flakeUrl = "git+https://git.t-juice.club/torjus/nixos-servers.git";
       metrics.enable = true;
     };
 

system/monitoring/metrics.nix

@@ -32,7 +32,7 @@
     # Default port: 9971
     flake = {
       enable = true;
-      url = "git+https://code.t-juice.club/torjus/nixos-servers.git";
+      url = "git+https://git.t-juice.club/torjus/nixos-servers.git";
       nats = {
         enable = true;
         url = "nats://nats1.home.2rjus.net:4222";

system/nix.nix

@@ -14,7 +14,7 @@ let
       branch="$2"
       shift 2
 
-      exec nixos-rebuild "$action" --flake "git+https://code.t-juice.club/torjus/nixos-servers.git?ref=$branch" "$@"
+      exec nixos-rebuild "$action" --flake "git+https://git.t-juice.club/torjus/nixos-servers.git?ref=$branch" "$@"
     '';
   };
 in

terraform/vault/hosts-generated.tf

@@ -63,11 +63,6 @@ locals {
         "secret/data/hosts/pn02/*",
       ]
     }
-    "media1" = {
-      paths = [
-        "secret/data/hosts/media1/*",
-      ]
-    }
 
   }
 

terraform/vault/secrets.tf

@@ -145,17 +145,6 @@ locals {
       password_length = 64
     }
 
-    # Forgejo runner tokens for nix-cache02
-    "hosts/nix-cache02/forgejo-runner-token" = {
-      auto_generate = false
-      data          = { token = var.forgejo_runner_token }
-    }
-
-    "hosts/nix-cache02/forgejo-native-runner-token" = {
-      auto_generate = false
-      data          = { token = var.forgejo_native_runner_token }
-    }
-
     # Loki push authentication (used by Promtail on all hosts)
     "shared/loki/push-auth" = {
       auto_generate   = true

terraform/vault/variables.tf

@@ -109,17 +109,3 @@ variable "sonarr_api_key" {
   sensitive   = true
 }
 
-variable "forgejo_runner_token" {
-  description = "Forgejo Actions runner token for nix-cache02"
-  type        = string
-  default     = "PLACEHOLDER"
-  sensitive   = true
-}
-
-variable "forgejo_native_runner_token" {
-  description = "Forgejo Actions runner token for native nix runner on nix-cache02"
-  type        = string
-  default     = "PLACEHOLDER"
-  sensitive   = true
-}
-