Merge pull request 'media-pc' (#48) from media-pc into master

Reviewed-on: #48

.github/workflows/flake-check.yaml

@@ -1,14 +0,0 @@
-name: Run nix flake check
-on:
-  push:
-  pull_request:
-
-jobs:
-  flake-check:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/catthehacker/ubuntu:runner-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v27
-      - run: nix flake check

.github/workflows/flake-update.yaml

@@ -1,27 +0,0 @@
----
-name: Periodic flake update
-on:  # yamllint disable-line rule:truthy
-  schedule:
-    - cron: "0 0 * * *"
-
-permissions:
-  contents: write
-
-jobs:
-  flake-update:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/catthehacker/ubuntu:runner-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          ref: master
-      - uses: cachix/install-nix-action@v27
-      - name: configure git
-        run: |
-          git config --global user.name 'torjus-bot'
-          git config --global user.email 'torjus-bot@git.t-juice.club'
-      - name: flake update
-        run: nix flake update --commit-lock-file
-      - name: push
-        run: git push

.mcp.json.example

@@ -2,21 +2,21 @@
   "mcpServers": {
     "nixpkgs-options": {
       "command": "nix",
-      "args": ["run", "git+https://git.t-juice.club/torjus/labmcp#nixpkgs-search", "--", "options", "serve"],
+      "args": ["run", "git+https://code.t-juice.club/torjus/labmcp#nixpkgs-search", "--", "options", "serve"],
       "env": {
         "NIXPKGS_SEARCH_DATABASE": "sqlite:///run/user/1000/labmcp/nixpkgs-search.db"
       }
     },
     "nixpkgs-packages": {
       "command": "nix",
-      "args": ["run", "git+https://git.t-juice.club/torjus/labmcp#nixpkgs-search", "--", "packages", "serve"],
+      "args": ["run", "git+https://code.t-juice.club/torjus/labmcp#nixpkgs-search", "--", "packages", "serve"],
       "env": {
         "NIXPKGS_SEARCH_DATABASE": "sqlite:///run/user/1000/labmcp/nixpkgs-search.db"
       }
     },
     "lab-monitoring": {
       "command": "nix",
-      "args": ["run", "git+https://git.t-juice.club/torjus/labmcp#lab-monitoring", "--", "serve", "--enable-silences"],
+      "args": ["run", "git+https://code.t-juice.club/torjus/labmcp#lab-monitoring", "--", "serve", "--enable-silences"],
       "env": {
         "PROMETHEUS_URL": "https://prometheus.home.2rjus.net",
         "ALERTMANAGER_URL": "https://alertmanager.home.2rjus.net",
@@ -29,7 +29,7 @@
       "command": "nix",
       "args": [
         "run",
-        "git+https://git.t-juice.club/torjus/homelab-deploy",
+        "git+https://code.t-juice.club/torjus/homelab-deploy",
         "--",
         "mcp",
         "--nats-url", "nats://nats1.home.2rjus.net:4222",
@@ -39,7 +39,7 @@
     },
     "git-explorer": {
       "command": "nix",
-      "args": ["run", "git+https://git.t-juice.club/torjus/labmcp#git-explorer", "--", "serve"],
+      "args": ["run", "git+https://code.t-juice.club/torjus/labmcp#git-explorer", "--", "serve"],
       "env": {
         "GIT_REPO_PATH": "/home/torjus/git/nixos-servers"
       }

docs/plans/bare-metal-actions-runner.md

@@ -0,0 +1,155 @@
+# Bare Metal Forgejo Actions Runner on nix-cache02
+
+## Goal
+
+Add a second Forgejo Actions runner instance on nix-cache02 that executes jobs directly on the host (bare metal). This allows CI builds to populate the nix binary cache automatically, reducing reliance on manually triggered builds before deployments.
+
+## Motivation
+
+Currently the workflow for updating a flake input (e.g. nixos-exporter) is:
+
+1. Update flake lock
+2. Push to master
+3. Manually trigger a build on nix-cache02 (or wait for the scheduled builder)
+4. Deploy to hosts
+
+With a bare metal runner, repos like nixos-exporter can have CI workflows that run `nix build`, and those derivations automatically end up in the cache (served by harmonia). By the time hosts auto-upgrade, everything is already cached.
+
+## Design
+
+### Two Runner Instances
+
+- **actions1** (existing) — Container-based, available to all Forgejo repos. Unchanged.
+- **actions2** (new) — Host-based, restricted to trusted repos only via Forgejo runner scoping.
+
+### Trusted Repos
+
+Repos that should be allowed to use the bare metal runner:
+
+- `torjus/nixos-servers`
+- `torjus/nixos-exporter`
+- `torjus/nixos` (gunter/magicman configs)
+- Other repos with nix builds that benefit from cache population (add as needed)
+
+Restriction is configured in the Forgejo web UI when registering the runner — scope it to specific repos or the org.
+
+### Label Configuration
+
+The new instance would use a host label:
+
+```nix
+labels = [ "native:host" ];
+```
+
+Workflow files in trusted repos would target this with `runs-on: native`.
+
+### Host Packages
+
+The runner needs nix and basic tools available:
+
+```nix
+hostPackages = with pkgs; [
+  bash
+  coreutils
+  curl
+  gawk
+  gitMinimal
+  gnused
+  nodejs
+  wget
+  nix
+];
+```
+
+## Security Analysis
+
+### What the runner CAN access
+
+- **Nix store** — Can read and write derivations. This is the whole point; harmonia serves the store to all hosts.
+- **Network** — Full network access during job execution.
+- **World-readable files** — Standard for any process on the system.
+
+### What the runner CANNOT access
+
+- **Cache signing key** — `/run/secrets/cache-secret` is mode `0400` root-owned. Harmonia signs derivations on serve, not on store write.
+- **Vault AppRole credentials** — `/var/lib/vault/approle/` is root-owned.
+- **Other vault secrets** — All in `/run/secrets/` with restrictive permissions.
+
+### Mitigations
+
+- **Trusted repos only** — Forgejo runner scoping restricts which repos can submit jobs. Only repos we control should have access.
+- **DynamicUser** — The runner uses systemd DynamicUser, so no persistent user account. Each invocation gets an ephemeral UID.
+- **Separate instance** — Container-based jobs (untrusted repos) remain on actions1 and never get host access.
+
+### Accepted Risks
+
+- A compromised trusted repo could inject bad derivations into the nix store/cache. This is an accepted risk since those repos already have deploy access to production hosts.
+- Jobs can consume host resources (CPU, memory, disk). The `runner.capacity` setting limits concurrent jobs.
+
+## Implementation
+
+### 1. NixOS Configuration
+
+**File:** `hosts/nix-cache02/actions-runner.nix`
+
+Add a second instance alongside the existing overrides:
+
+```nix
+{ pkgs, ... }:
+{
+  # ... existing actions1 overrides ...
+
+  services.gitea-actions-runner.instances.actions2 = {
+    enable = true;
+    name = "nix-cache02-native";
+    url = "https://code.t-juice.club";
+    tokenFile = "/run/secrets/forgejo-runner-token-native";
+    labels = [ "native:host" ];
+    hostPackages = with pkgs; [
+      bash coreutils curl gawk gitMinimal gnused nodejs wget nix
+    ];
+    settings = {
+      runner.capacity = 4;
+      cache = {
+        enabled = true;
+        dir = "/var/lib/gitea-runner/actions2/cache";
+      };
+    };
+  };
+}
+```
+
+### 2. Vault Secret
+
+The native runner needs its own registration token (separate from actions1):
+
+- Add `hosts/nix-cache02/forgejo-runner-token-native` to `terraform/vault/secrets.tf`
+- Add `forgejo_runner_token_native` variable to `terraform/vault/variables.tf`
+- Add vault secret config in `actions-runner.nix` pointing to the new path
+
+### 3. Forgejo Setup
+
+1. Generate a new runner token in Forgejo, scoped to trusted repos only
+2. Store in Vault: `bao kv put secret/hosts/nix-cache02/forgejo-runner-token-native token=<token>`
+3. Set the tfvar and run `tofu apply` in `terraform/vault/`
+
+### 4. Example Workflow
+
+In a trusted repo (e.g. nixos-exporter):
+
+```yaml
+name: Build
+on: [push]
+jobs:
+  build:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build
+```
+
+## Open Questions
+
+- Should `hostPackages` include additional tools (e.g. `cachix`, `nix-prefetch-*`)?
+- Should we set resource limits on the runner (systemd MemoryMax, CPUQuota)?
+- Do we want a separate capacity for the native runner vs container runner, or is 4 fine for both?

docs/plans/pn51-stability.md

@@ -169,6 +169,14 @@ These appear on both units and can be ignored:
 - Journal corruption confirmed on next boot
 - No pstore data captured
 
+### 2026-03-12: pn02 Memtest86 — 38 Passes, Zero Errors
+
+- Ran memtest86 for ~109 hours (4.5 days), completing 38 full passes
+- **Zero errors found** — RAM appears healthy
+- Makes hardware-induced memory corruption less likely as the sole cause of crashes
+- Memtest cannot rule out CPU cache errors, PCIe/IOMMU issues, or kernel bugs triggered by platform quirks
+- **Next step**: Boot back into NixOS with sched_ext disabled to test the kernel scheduler hypothesis
+
 ### 2026-03-07: pn01 Status
 
 - pn01 has had **zero crashes** since initial setup on Feb 21
@@ -193,18 +201,18 @@ These appear on both units and can be ignored:
 
 **pn02 is unreliable.** After exhausting mitigations (fTPM disabled, BIOS updated, WiFi/BT disabled, ErP disabled, amdgpu blacklisted, processor.max_cstate=1, NMI watchdog, rasdaemon), the unit still crashes every few days. 26 reboots in 30 days (7 unclean crashes + daily auto-upgrade reboots).
 
-The pstore crash dumps from March reveal a new dimension: at least some crashes are **kernel scheduler bugs in sched_ext**, not just silent hardware-level freezes. The `set_next_task_scx` and `pick_next_task_fair` crash sites, combined with the dbus-daemon segfault before one crash, suggest possible memory corruption that manifests in the scheduler. It's unclear whether this is:
+The pstore crash dumps from March reveal a new dimension: at least some crashes are **kernel scheduler bugs in sched_ext**, not just silent hardware-level freezes. The `set_next_task_scx` and `pick_next_task_fair` crash sites, combined with the dbus-daemon segfault before one crash, suggest possible memory corruption that manifests in the scheduler. Memtest86 ran 38 passes (109 hours) with zero errors, making option 2 less likely. Remaining possibilities:
 1. A sched_ext kernel bug exposed by the PN51's hardware quirks (unstable TSC, C-state behavior)
-2. Hardware-induced memory corruption that happens to hit scheduler data structures
+2. ~~Hardware-induced memory corruption that happens to hit scheduler data structures~~ — unlikely after clean memtest
 3. A pure software bug in the 6.12.74 kernel's sched_ext implementation
 
 **pn01 is stable** — zero crashes in 30 days of continuous operation. Both units have identical kernel and NixOS configuration (minus pn02's diagnostic mitigations), so the difference points toward a hardware defect specific to the pn02 board.
 
 ## Next Steps
 
-- **pn02 memtest**: Run memtest86 for 24h+ (available in systemd-boot menu). The crash signatures (userspace segfaults before kernel panics, corrupted pointers in scheduler structures) are consistent with intermittent RAM errors that a quick pass wouldn't catch. If memtest finds errors, swap the DIMM.
-- **pn02**: Consider scrapping or repurposing for non-critical workloads that tolerate random reboots (auto-recovery via hardware watchdog is now working)
-- **pn02 investigation**: Could try disabling sched_ext (`boot.kernelParams = [ "sched_ext.enabled=0" ]` or equivalent) to test whether the crashes stop — would help distinguish kernel bug from hardware defect
+- **~~pn02 memtest~~**: ~~Run memtest86 for 24h+~~ — Done (2026-03-12): 38 passes over 109 hours, zero errors. RAM is not the issue.
+- **pn02 sched_ext test**: Disable sched_ext (`boot.kernelParams = [ "sched_ext.enabled=0" ]` or equivalent) and run for 1-2 weeks to test whether the crashes stop — would help distinguish kernel bug from hardware defect
+- **pn02**: If sched_ext disable doesn't help, consider scrapping or repurposing for non-critical workloads that tolerate random reboots (auto-recovery via hardware watchdog is working)
 - **pn01**: Continue monitoring. If it remains stable long-term, it is viable for light workloads
 - If pn01 eventually crashes, apply the same mitigations (amdgpu blacklist, max_cstate=1) to see if they help
 - For the Incus hypervisor plan: likely need different hardware. Evaluating GMKtec G3 (Intel) as an alternative. Note: mixed Intel/AMD cluster complicates live migration

flake.lock

@@ -7,18 +7,18 @@
         ]
       },
       "locked": {
-        "lastModified": 1739310461,
-        "narHash": "sha256-GscftfATX84Aae9FObrQOe+hr5MsEma2Fc5fdzuu3hA=",
+        "lastModified": 1773079666,
+        "narHash": "sha256-midgZRnFEybsH3uJazCJcF9i5Tm5hYVH7+oDLAFpLtU=",
         "ref": "master",
-        "rev": "53915cec6356be1a2d44ac2cbd0a71b32d679e6f",
-        "revCount": 7,
+        "rev": "d8c08778f941a459fccae932e3768f9b9fe1783d",
+        "revCount": 11,
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/alerttonotify"
+        "url": "https://code.t-juice.club/torjus/alerttonotify"
       },
       "original": {
         "ref": "master",
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/alerttonotify"
+        "url": "https://code.t-juice.club/torjus/alerttonotify"
       }
     },
     "homelab-deploy": {
@@ -28,18 +28,18 @@
         ]
       },
       "locked": {
-        "lastModified": 1771488195,
-        "narHash": "sha256-2kMxqdDyPluRQRoES22Y0oSjp7pc5fj2nRterfmSIyc=",
+        "lastModified": 1773081467,
+        "narHash": "sha256-K22nYBq4FXe/1NJ/wg0uUbFrutgw2j9axbA/1NvvK8E=",
         "ref": "master",
-        "rev": "2d26de50559d8acb82ea803764e138325d95572c",
-        "revCount": 37,
+        "rev": "713d1e7584c1e076fcf8e6248e2d022027832e86",
+        "revCount": 38,
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/homelab-deploy"
+        "url": "https://code.t-juice.club/torjus/homelab-deploy"
       },
       "original": {
         "ref": "master",
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/homelab-deploy"
+        "url": "https://code.t-juice.club/torjus/homelab-deploy"
       }
     },
     "nixos-exporter": {
@@ -49,17 +49,17 @@
         ]
       },
       "locked": {
-        "lastModified": 1770593543,
-        "narHash": "sha256-hT8Rj6JAwGDFvcxWEcUzTCrWSiupCfBa57pBDnM2C5g=",
+        "lastModified": 1773081113,
+        "narHash": "sha256-99hs9Gvzc+M9hSTY7zSHL7TmhPkOYZ/9li9OhN3kXWc=",
         "ref": "refs/heads/master",
-        "rev": "5aa5f7275b7a08015816171ba06d2cbdc2e02d3e",
-        "revCount": 15,
+        "rev": "79900ae92df5607235f6ddb28eda67270d996819",
+        "revCount": 16,
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/nixos-exporter"
+        "url": "https://code.t-juice.club/torjus/nixos-exporter"
       },
       "original": {
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/nixos-exporter"
+        "url": "https://code.t-juice.club/torjus/nixos-exporter"
       }
     },
     "nixpkgs": {

flake.nix

@@ -6,15 +6,15 @@
     nixpkgs-unstable.url = "github:nixos/nixpkgs?ref=nixos-unstable";
 
     alerttonotify = {
-      url = "git+https://git.t-juice.club/torjus/alerttonotify?ref=master";
+      url = "git+https://code.t-juice.club/torjus/alerttonotify?ref=master";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
     nixos-exporter = {
-      url = "git+https://git.t-juice.club/torjus/nixos-exporter";
+      url = "git+https://code.t-juice.club/torjus/nixos-exporter";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
     homelab-deploy = {
-      url = "git+https://git.t-juice.club/torjus/homelab-deploy?ref=master";
+      url = "git+https://code.t-juice.club/torjus/homelab-deploy?ref=master";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
   };
@@ -227,6 +227,24 @@
             ./hosts/nrec-nixos01
           ];
         };
+        nrec-nixos02 = nixpkgs.lib.nixosSystem {
+          inherit system;
+          specialArgs = {
+            inherit inputs self;
+          };
+          modules = commonModules ++ [
+            ./hosts/nrec-nixos02
+          ];
+        };
+        media1 = nixpkgs.lib.nixosSystem {
+          inherit system;
+          specialArgs = {
+            inherit inputs self;
+          };
+          modules = commonModules ++ [
+            ./hosts/media1
+          ];
+        };
         openstack-template = nixpkgs.lib.nixosSystem {
           inherit system;
           specialArgs = {

hosts/media1/configuration.nix

@@ -0,0 +1,84 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../system
+  ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "media1";
+  networking.domain = "home.2rjus.net";
+  networking.useNetworkd = true;
+  networking.useDHCP = false;
+  networking.firewall.enable = false;
+  services.resolved.enable = true;
+  networking.nameservers = [
+    "10.69.13.5"
+    "10.69.13.6"
+  ];
+
+  systemd.network.enable = true;
+  systemd.network.networks."10-lan" = {
+    matchConfig.Name = "enp*";
+    address = [
+      "10.69.31.51/24"
+    ];
+    routes = [
+      { Gateway = "10.69.31.1"; }
+    ];
+    linkConfig.RequiredForOnline = "routable";
+  };
+
+  time.timeZone = "Europe/Oslo";
+
+  homelab.host = {
+    tier = "prod";
+    priority = "low";
+    role = "media";
+  };
+
+  # Intel N100 (Alder Lake-N) graphics
+  hardware.graphics = {
+    enable = true;
+    extraPackages = with pkgs; [
+      intel-media-driver # VA-API driver for Broadwell+
+    ];
+  };
+
+  # NFS for media access
+  environment.systemPackages = with pkgs; [
+    nfs-utils
+  ];
+  services.rpcbind.enable = true;
+
+  systemd.mounts = [
+    {
+      type = "nfs";
+      mountConfig = {
+        Options = "ro,soft,noatime";
+      };
+      what = "nas.home.2rjus.net:/mnt/hdd-pool/media";
+      where = "/mnt/nas/media";
+    }
+  ];
+
+  systemd.automounts = [
+    {
+      wantedBy = [ "multi-user.target" ];
+      automountConfig = {
+        TimeoutIdleSec = "5min";
+      };
+      where = "/mnt/nas/media";
+    }
+  ];
+
+  vault.enable = true;
+
+  system.stateVersion = "25.11";
+}

hosts/media1/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+    ./media-desktop.nix
+  ];
+}

hosts/media1/hardware-configuration.nix

@@ -0,0 +1,33 @@
+# Do not modify this file!  It was generated by 'nixos-generate-config'
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/0e1f61fd-18c6-4114-942e-f113a1e4b347";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/03C8-7DFE";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/0871bf99-9db6-4cd7-b307-3cebbb0a4e60"; }
+    ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/media1/media-desktop.nix

@@ -0,0 +1,120 @@
+{
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  kodiPkg = pkgs.kodi-wayland.withPackages (p: [
+    p.jellycon
+    p.sendtokodi
+    p.inputstream-adaptive
+  ]);
+
+  hyprlandConfig = ''
+    # Monitor — auto-detect, native resolution
+    monitor = , preferred, auto, 1
+
+    # Launch Kodi and Firefox on login
+    exec-once = ${lib.getExe' kodiPkg "kodi"}
+    exec-once = ${lib.getExe pkgs.firefox}
+
+    # Workspace rules — Kodi on 1, Firefox on 2
+    windowrulev2 = workspace 1 silent, class:^(kodi)$
+    windowrulev2 = workspace 2 silent, class:^(firefox)$
+    windowrulev2 = fullscreen, class:^(kodi)$
+    windowrulev2 = fullscreen, class:^(firefox)$
+
+    # Start on workspace 1 (Kodi)
+    workspace = 1, default:true
+
+    # Switch workspaces with Super+1/2
+    bind = SUPER, 1, workspace, 1
+    bind = SUPER, 2, workspace, 2
+
+    # No gaps, no borders — TV setup
+    general {
+      gaps_in = 0
+      gaps_out = 0
+      border_size = 0
+    }
+
+    decoration {
+      rounding = 0
+    }
+
+    # Disable animations for snappy switching
+    animations {
+      enabled = false
+    }
+
+    misc {
+      # Disable Hyprland logo/splash
+      disable_hyprland_logo = true
+      disable_splash_rendering = true
+    }
+  '';
+in
+{
+  # Hyprland compositor with UWSM for proper dbus/systemd session management
+  programs.hyprland = {
+    enable = true;
+    withUWSM = true;
+    portalPackage = pkgs.xdg-desktop-portal-hyprland;
+  };
+
+  # greetd for auto-login — UWSM starts Hyprland as a systemd session
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "uwsm start hyprland-uwsm.desktop";
+        user = "kodi";
+      };
+    };
+  };
+
+  # Deploy Hyprland config to kodi user's XDG config dir
+  systemd.tmpfiles.rules = [
+    "d /home/kodi/.config/hypr 0755 kodi kodi -"
+  ];
+  environment.etc."skel/hypr/hyprland.conf".text = hyprlandConfig;
+  system.activationScripts.hyprlandConfig = lib.stringAfter [ "users" ] ''
+    install -D -o kodi -g kodi -m 0644 /dev/stdin /home/kodi/.config/hypr/hyprland.conf <<'HYPRCONF'
+    ${hyprlandConfig}
+    HYPRCONF
+  '';
+
+  # Kodi user
+  users.users.kodi = {
+    isNormalUser = true;
+    home = "/home/kodi";
+    group = "kodi";
+    extraGroups = [
+      "video"
+      "audio"
+      "input"
+    ];
+  };
+  users.groups.kodi = { };
+
+  # Packages available on the system
+  environment.systemPackages = [
+    kodiPkg
+    pkgs.firefox
+    pkgs.yt-dlp
+  ];
+
+  # PipeWire for audio (HDMI passthrough support)
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+  };
+
+  # Allow VA-API hardware decode in Firefox
+  environment.sessionVariables = {
+    MOZ_ENABLE_WAYLAND = "1";
+    LIBVA_DRIVER_NAME = "iHD";
+  };
+}

hosts/nix-cache02/actions-runner.nix

@@ -0,0 +1,16 @@
+{ ... }:
+{
+  # Fetch runner token from Vault
+  vault.secrets.forgejo-runner-token = {
+    secretPath = "hosts/nix-cache02/forgejo-runner-token";
+    extractKey = "token";
+    mode = "0444";
+    services = [ "gitea-runner-actions1" ];
+  };
+
+  # Override token source and runner capacity
+  services.gitea-actions-runner.instances.actions1 = {
+    tokenFile = "/run/secrets/forgejo-runner-token";
+    settings.runner.capacity = 4;
+  };
+}

hosts/nix-cache02/default.nix

@@ -3,6 +3,8 @@
     ./configuration.nix
     ./builder.nix
     ./scheduler.nix
+    ./actions-runner.nix
     ../../services/nix-cache
+    ../../services/actions-runner
   ];
 }

hosts/nrec-nixos01/configuration.nix

@@ -34,6 +34,11 @@
     autoResize = true;
   };
 
+  fileSystems."/var/lib/forgejo/data/packages" = {
+    device = "/dev/disk/by-uuid/25a84568-b36a-47b3-a6d0-b959209cfdaf";
+    fsType = "ext4";
+  };
+
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/vda";
   networking.hostName = "nrec-nixos01";
@@ -65,7 +70,7 @@
 
   services.caddy = {
     enable = true;
-    virtualHosts."nrec-nixos01.t-juice.club" = {
+    virtualHosts."code.t-juice.club" = {
       extraConfig = ''
         reverse_proxy 127.0.0.1:3000
       '';

hosts/nrec-nixos02/configuration.nix

@@ -0,0 +1,85 @@
+{ lib, pkgs, ... }:
+
+{
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = lib.mkForce "no";
+      PasswordAuthentication = false;
+    };
+  };
+
+  users.users.nixos = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    shell = pkgs.zsh;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwfb2jpKrBnCw28aevnH8HbE5YbcMXpdaVv2KmueDu6 torjus@gunter"
+    ];
+  };
+  security.sudo.wheelNeedsPassword = false;
+  programs.zsh.enable = true;
+
+  homelab.dns.enable = false;
+  homelab.monitoring.enable = false;
+  homelab.host.labels.ansible = "false";
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+    autoResize = true;
+  };
+
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/vda";
+  networking.hostName = "nrec-nixos02";
+  networking.useNetworkd = true;
+  networking.useDHCP = false;
+  services.resolved.enable = true;
+
+  systemd.network.enable = true;
+  systemd.network.networks."ens3" = {
+    matchConfig.Name = "ens3";
+    networkConfig.DHCP = "ipv4";
+    linkConfig.RequiredForOnline = "routable";
+  };
+  time.timeZone = "Europe/Oslo";
+
+  networking.firewall.enable = true;
+  networking.firewall.allowedTCPPorts = [
+    22
+    80
+    443
+  ];
+
+  nix.settings.substituters = [
+    "https://cache.nixos.org"
+  ];
+  nix.settings.trusted-public-keys = [
+    "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+  ];
+
+  services.pocket-id = {
+    enable = true;
+    settings = {
+      APP_URL = "https://oidc.t-juice.club";
+      TRUST_PROXY = true;
+      ANALYTICS_DISABLED = true;
+      VERSION_CHECK_DISABLED = true;
+      HOST = "127.0.0.1";
+    };
+  };
+
+  services.caddy = {
+    enable = true;
+    virtualHosts."oidc.t-juice.club" = {
+      extraConfig = ''
+        reverse_proxy 127.0.0.1:1411
+      '';
+    };
+  };
+
+  zramSwap.enable = true;
+
+  system.stateVersion = "25.11";
+}

hosts/nrec-nixos02/default.nix

@@ -0,0 +1,9 @@
+{ modulesPath, ... }:
+{
+  imports = [
+    ./configuration.nix
+    ../../system/packages.nix
+    ../../services/actions-runner
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+}

hosts/pn02/configuration.nix

@@ -15,7 +15,7 @@
   boot.loader.systemd-boot.memtest86.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
   boot.blacklistedKernelModules = [ "amdgpu" ];
-  boot.kernelParams = [ "panic=10" "nmi_watchdog=1" "processor.max_cstate=1" ];
+  boot.kernelParams = [ "panic=10" "nmi_watchdog=1" "processor.max_cstate=1" "sched_ext.enabled=0" ];
   boot.kernel.sysctl."kernel.softlockup_panic" = 1;
   boot.kernel.sysctl."kernel.hardlockup_panic" = 1;
 

services/actions-runner/default.nix

@@ -0,0 +1,37 @@
+{ config, lib, pkgs, ... }:
+{
+  # Trust podman interfaces so containers can reach the runner's cache service.
+  # "podman+" is a wildcard matching any interface starting with "podman".
+  networking.firewall.trustedInterfaces = [ "podman+" ];
+
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    dockerSocket.enable = true;
+  };
+
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+
+    instances.actions1 = {
+      enable = true;
+      name = config.networking.hostName;
+      url = "https://code.t-juice.club";
+      tokenFile = lib.mkDefault "/var/lib/forgejo-runner/token";
+      labels = [
+        "nix:docker://code.t-juice.club/torjus/runner-images/nix:latest"
+        "node-bookworm:docker://node:lts-bookworm-slim"
+        "alpine:docker://alpine:latest"
+        "golang:docker://code.t-juice.club/torjus/runner-images/golang:latest"
+      ];
+      settings = {
+        runner.capacity = lib.mkDefault 2;
+        cache = {
+          enabled = true;
+          dir = "/var/lib/gitea-runner/actions1/cache";
+        };
+        container.privileged = false;
+      };
+    };
+  };
+}

services/forgejo/default.nix

@@ -1,16 +1,19 @@
-{ ... }:
+{ pkgs, ... }:
 {
   services.forgejo = {
+    package = pkgs.forgejo;
     enable = true;
     database.type = "sqlite3";
+    lfs.enable = true;
     settings = {
       server = {
-        DOMAIN = "nrec-nixos01.t-juice.club";
-        ROOT_URL = "https://nrec-nixos01.t-juice.club/";
+        DOMAIN = "code.t-juice.club";
+        ROOT_URL = "https://code.t-juice.club/";
         HTTP_ADDR = "127.0.0.1";
         HTTP_PORT = 3000;
       };
       service.DISABLE_REGISTRATION = true;
+      "service.explore".REQUIRE_SIGNIN_VIEW = true;
       session.COOKIE_SECURE = true;
     };
   };

services/ns/resolver.nix

@@ -38,6 +38,12 @@
         do-udp = "yes";
         do-tcp = "yes";
         extended-statistics = true;
+
+        # Recover faster from upstream failures (e.g. ISP outage)
+        # Default 900s is too long - keeps marking servers as bad
+        infra-host-ttl = 120;
+        # Clean up stale TLS connections faster (default 60s)
+        tcp-reuse-timeout = 15;
       };
       remote-control = {
         control-enable = true;

terraform/vault/hosts-generated.tf

@@ -63,6 +63,11 @@ locals {
         "secret/data/hosts/pn02/*",
       ]
     }
+    "media1" = {
+      paths = [
+        "secret/data/hosts/media1/*",
+      ]
+    }
 
   }
 

terraform/vault/secrets.tf

@@ -145,6 +145,12 @@ locals {
       password_length = 64
     }
 
+    # Forgejo runner token for nix-cache02
+    "hosts/nix-cache02/forgejo-runner-token" = {
+      auto_generate = false
+      data          = { token = var.forgejo_runner_token }
+    }
+
     # Loki push authentication (used by Promtail on all hosts)
     "shared/loki/push-auth" = {
       auto_generate   = true

terraform/vault/variables.tf

@@ -109,3 +109,10 @@ variable "sonarr_api_key" {
   sensitive   = true
 }
 
+variable "forgejo_runner_token" {
+  description = "Forgejo Actions runner token for nix-cache02"
+  type        = string
+  default     = "PLACEHOLDER"
+  sensitive   = true
+}
+