LilithSemi/systems
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
48 commits 1 branch 0 tags 248 KiB
  • Nix 100%
Find a file
Exact
Tristan Ross 79aa0b856b mail: keep the acme key across renewals for DANE 
A TLSA record hashes the public key, and lego makes a new key at every
renewal by default, so a published record would stop matching after about
60 days and DANE-checking servers would silently refuse delivery.
2026-08-27 22:55:54 -07:00
certs mesh: nebula, balthasar as lighthouse 2026-08-27 17:42:57 -07:00
devices/balthasar mail: keep the acme key across renewals for DANE 2026-08-27 22:55:54 -07:00
modules webmail: roundcube behind caddy 2026-08-27 22:50:11 -07:00
tests tests: vm test over the shared modules 2026-08-27 17:44:35 -07:00
.gitignore flake: skeleton, treefmt, deploy wiring 2026-08-27 17:40:01 -07:00
flake.lock mail: simple-nixos-mailserver for lilithsemi.com 2026-08-27 21:09:21 -07:00
flake.nix mail: simple-nixos-mailserver for lilithsemi.com 2026-08-27 21:09:21 -07:00
README.md docs: move the balthasar runbook into its device directory 2026-08-27 21:21:30 -07:00
systems.nix flake: skeleton, treefmt, deploy wiring 2026-08-27 17:40:01 -07:00

README.md

Lilith Semi - Systems

Infrastructure and systems for Lilith Semiconductor

Devices

Balthasar

EDIS Global US East box

  • Public entrypoint

Melchior

Switzerland on-prem box

Casper

Souther California on-prem box

Services

Public

  • git.lilithsemi.com, Forgejo, git over ssh + http(s)
  • mail.lilithsemi.com: mail, no frontent

Private

  • auth.magi.lilithsemi.com: SSO authentication
  • grafana.magi.lilithsemi.com: Grafana dashboard
  • chat.magi.lilithsemi.com: Mattermost
  • mail.magi.lilithsemi.com: Roundcube mail frontend
  • pass.magi.lilithsemi.com: Vaultwarden
  • vault.magi.lilithsemi.com: OpenBao
  • meet.magi.lilithsemi.com: Lasuite Meet
  • ledger.magi.lilithsemi.com: Hledger

Layout

Path Holds
flake.nix Inputs, system helpers, treefmt, devshell
systems.nix The host table
modules/ Shared modules. default.nix imports all of them
devices/<host>/ One host. default.nix imports the rest, README.md is its runbook
certs/ Public certificates only. Never a private key
tests/ NixOS VM tests, wired into nix flake check

A shared module with something to select gives an option under magi.*. A device turns on what it uses.

Working on it

nix develop
nix fmt
nix flake check

balthasar builds its own system, over SSH, not the workstation. See step 12 of devices/balthasar/README.md for the full reason and the command. deploy-rs is wired into the flake (self.deploy.nodes.balthasar) for the day an x86_64 builder exists on the network. It builds locally, so it cannot deploy balthasar yet. Do not use it.