The nightly sync failed every night with 'corrupted on transfer: md5
hashes differ' on gitea.db-journal: rclone copies the volatile SQLite
journal while Gitea rewrites/removes it. That IO error also made rclone
skip the delete phase, so the backup drifted out of sync. Exclude the
transient *.db-journal/-wal/-shm files.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
With the dedicated client_id the shared-project rate limits are gone, so
lift the pacing: tpslimit 10->25 and drive-pacer-min-sleep 100ms->10ms
(the old 100ms capped requests at ~10/s and would have throttled the
higher tpslimit anyway).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
When the runner is stopped mid-job (reboot, autoUpgrade, gitea restart),
its job container keeps running its `sleep 10800` entrypoint and is never
cleaned up, and unused images pile up. Add a 15-min timer that removes a
GITEA-ACTIONS-TASK-N container only when Gitea's DB reports that task as
finished (status 1/2/3/4); running/unknown tasks are left untouched. Also
prune unused actions networks/volumes and dangling images.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The nightly sync has failed since Jul 18 with RATE_LIMIT_EXCEEDED,
transferring 0 B. Limit transactions and pace Drive requests, and retry
a few times before giving up. This mitigates rather than fixes the cause
(the remote still uses rclone's shared default client_id).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The image ships /home/filebrowser/data/config.yaml, but mounting the host
directory there hides it and the app refuses to start. Seed it with
tmpfiles 'C' (create-if-missing) so it stays editable afterwards.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The image switched to the FILEBROWSER_* env scheme and now runs as
non-root (uid 1000), which broke two things:
- It binds :80 inside the container, which a non-root user may not do
("bind: permission denied" since the Jul 19 reboot). Allow it via
net.ipv4.ip_unprivileged_port_start=0 instead of running as root.
- It stores DB/config under /home/filebrowser/data, not /config, so the
old FB_DATABASE + /config mount were ignored and the database lived
inside the container (lost on every restart). Mount the host dir there
and give it to uid 1000.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The default docker package is marked insecure; the runner module already
supports Podman natively (DOCKER_HOST -> /run/podman/podman.sock, group
podman), and the socket + group are already present on the host.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Enable Gitea Actions in the container (GITEA__actions__ENABLED)
- Run dockerd alongside podman for job containers
- services.gitea-actions-runner: instance-wide runner "fileserver",
Docker labels, registered against the internal LAN URL; reads the
registration token from /data/secrets/gitea-runner-token
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
No longer in use. Drops the beets containers (cli/web), build +
autoimport services and timer, the beet CLI wrapper, /opt/dj-beets
tmpfiles entry, firewall port 8337, the Makefile copy step, and the
src/dj-beets tree (which contained a Beatport token) so the repo can
be made public safely.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- gateway: replace konnektor/api/auth/mailpit vhosts with
music.home.lindenfelser.de -> 10.202.82.195:80, LAN-only (403 otherwise)
- common: enable system.autoUpgrade, pulling config from Gitea main and
overriding nixpkgs to the nixos-25.11 tip for weekly package refresh;
reboot allowed in a 04:00-06:00 window
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Mount /data/filebrowser as /config and point FB_DATABASE at
/config/filebrowser.db so the user/share database survives
container recreations.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
konnektor-web is deployed and listening on 10.202.82.49:8082.
Replace the 503 placeholder with a real reverse_proxy.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Repoint konnektor.home.lindenfelser.de to a 503 placeholder
until konnektor-web is built. Add api.* and auth.* subdomains
pointing at konnektor-api (8080) and Zitadel (8081); auth
forwards Host header so Zitadel routes correctly. Add
mailpit.* restricted to LAN 10.202.82.0/24.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The rclone, SMB password and Troubleshooting sections were
present twice in the file. Drop the second copy.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drop k8s-server from flake, Makefile targets, modules
(kubernetes.nix, docker-registry.nix), install script and
hardware config. Remove related registry vhost, port 6443
and NAT rules from gateway.nix. Drop K8s-Server section
and dangling markdown wrapper from README.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Use podman ps instead of podman images to avoid pulling dangling
<none> entries and stale unused images.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace initialPassword with hashedPassword for danlin user, move
FileBrowser admin password to external environmentFile with restricted
secrets directory, update SSH authorized key, and bump nixpkgs to 25.11.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
danlin