hippocampus: headscale: change localaddress

Flake lock file updates:

• Updated input 'home-manager':
    'github:nix-community/home-manager/6cee0821577643e0b34e2c5d9a90d0b1b5cdca70' (2026-02-07)
  → 'github:nix-community/home-manager/2de7205ce6e10b031151033e69b7ef89708dc282' (2026-04-13)
• Updated input 'lix-module':
    'b90bf629bb.tar.gz?narHash=sha256-YMLrcBpf0TR5r/eaqm8lxzFPap2TxCor0ZGcK3a7%2Bb8%3D' (2025-01-18)
  → 'b90bf629bb.tar.gz?narHash=sha256-YMLrcBpf0TR5r/eaqm8lxzFPap2TxCor0ZGcK3a7%2Bb8%3D&rev=b90bf629bbd835e61f1317b99e12f8c831017006' (2025-01-18)
• Updated input 'me-emacs':
    'git+https://git.syzygial.cc/Syzygial/EmacsConfig.git?ref=refs/heads/master&rev=a82da456bdd9064a0395252935a66c8e2864a4db' (2026-01-20)
  → 'git+https://git.syzygial.cc/Syzygial/EmacsConfig.git?ref=refs/heads/master&rev=cce76e2f8f4372dd3391a76daa53c1a89b89bc40' (2026-03-03)
• Updated input 'microvm':
    'github:astro/microvm.nix/68c9f9c6ca91841f04f726a298c385411b7bfcd5' (2026-02-05)
  → 'github:astro/microvm.nix/c0a53823dbf7eb166c2fa7dc2d1e0d6cb2be7562' (2026-04-12)
• Updated input 'microvm/spectrum':
    'git+https://spectrum-os.org/git/spectrum?ref=refs/heads/main&rev=c5d5786d3dc938af0b279c542d1e43bce381b4b9' (2025-10-03)
  → 'git+https://spectrum-os.org/git/spectrum?ref=refs/heads/main&rev=fe39e122d898f66e89ffa17d4f4209989ccb5358' (2026-02-27)
• Updated input 'nix-darwin':
    'github:LnL7/nix-darwin/0d7874ef7e3ba02d58bebb871e6e29da36fa1b37' (2026-02-04)
  → 'github:LnL7/nix-darwin/06648f4902343228ce2de79f291dd5a58ee12146' (2026-04-01)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/00c21e4c93d963c50d4c0c89bfa84ed6e0694df2' (2026-02-04)
  → 'github:NixOS/nixpkgs/4c1018dae018162ec878d42fec712642d214fdfa' (2026-04-09)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/17eea6f3816ba6568b8c81db8a4e6ca438b30b7c' (2026-02-03)
  → 'github:Mic92/sops-nix/d4971dd58c6627bfee52a1ad4237637c0a2fb0cd' (2026-04-13)
• Updated input 'sops-nix/nixpkgs':
    'github:NixOS/nixpkgs/6308c3b21396534d8aaeac46179c14c439a89b8a' (2026-01-30)
  → 'github:NixOS/nixpkgs/13043924aaa7375ce482ebe2494338e058282925' (2026-04-11)

flake.lock

@@ -94,11 +94,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770476834,
-        "narHash": "sha256-cyxgVsNfHnJ4Zn6G1EOzfTXbjTy7Ds9zMOsZaX7VZWs=",
+        "lastModified": 1776114641,
+        "narHash": "sha256-VJMt3n9zGRzupzvlhcKIz4SpWflKh0rWfYTgmkmun0Q=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "6cee0821577643e0b34e2c5d9a90d0b1b5cdca70",
+        "rev": "2de7205ce6e10b031151033e69b7ef89708dc282",
         "type": "github"
       },
       "original": {
@@ -135,7 +135,7 @@
         "narHash": "sha256-YMLrcBpf0TR5r/eaqm8lxzFPap2TxCor0ZGcK3a7+b8=",
         "rev": "b90bf629bbd835e61f1317b99e12f8c831017006",
         "type": "tarball",
-        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/b90bf629bbd835e61f1317b99e12f8c831017006.tar.gz"
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/b90bf629bbd835e61f1317b99e12f8c831017006.tar.gz?rev=b90bf629bbd835e61f1317b99e12f8c831017006"
       },
       "original": {
         "type": "tarball",
@@ -150,11 +150,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768875255,
-        "narHash": "sha256-H2fNon/y6RH+PlMxGY6X/7Qvty+LVCrjCkw8Ee15Iis=",
+        "lastModified": 1772550819,
+        "narHash": "sha256-K6TvujvSSv+pDPAXqdabd7g9wFIkOdvHOeeFohou42A=",
         "ref": "refs/heads/master",
-        "rev": "a82da456bdd9064a0395252935a66c8e2864a4db",
-        "revCount": 89,
+        "rev": "cce76e2f8f4372dd3391a76daa53c1a89b89bc40",
+        "revCount": 94,
         "type": "git",
         "url": "https://git.syzygial.cc/Syzygial/EmacsConfig.git"
       },
@@ -171,11 +171,11 @@
         "spectrum": "spectrum"
       },
       "locked": {
-        "lastModified": 1770310890,
-        "narHash": "sha256-lyWAs4XKg3kLYaf4gm5qc5WJrDkYy3/qeV5G733fJww=",
+        "lastModified": 1775996588,
+        "narHash": "sha256-klBp+NIkJJtFHKFEHaMqwDHSK09UufDL6RJoxUZOL5Q=",
         "owner": "astro",
         "repo": "microvm.nix",
-        "rev": "68c9f9c6ca91841f04f726a298c385411b7bfcd5",
+        "rev": "c0a53823dbf7eb166c2fa7dc2d1e0d6cb2be7562",
         "type": "github"
       },
       "original": {
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770184146,
-        "narHash": "sha256-DsqnN6LvXmohTRaal7tVZO/AKBuZ02kPBiZKSU4qa/k=",
+        "lastModified": 1775037210,
+        "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "0d7874ef7e3ba02d58bebb871e6e29da36fa1b37",
+        "rev": "06648f4902343228ce2de79f291dd5a58ee12146",
         "type": "github"
       },
       "original": {
@@ -223,11 +223,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1770197578,
-        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
+        "lastModified": 1775710090,
+        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
+        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
         "type": "github"
       },
       "original": {
@@ -239,11 +239,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1769740369,
-        "narHash": "sha256-xKPyJoMoXfXpDM5DFDZDsi9PHArf2k5BJjvReYXoFpM=",
+        "lastModified": 1775888245,
+        "narHash": "sha256-nwASzrRDD1JBEu/o8ekKYEXm/oJW6EMCzCRdrwcLe90=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6308c3b21396534d8aaeac46179c14c439a89b8a",
+        "rev": "13043924aaa7375ce482ebe2494338e058282925",
         "type": "github"
       },
       "original": {
@@ -270,11 +270,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1770145881,
-        "narHash": "sha256-ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=",
+        "lastModified": 1776119890,
+        "narHash": "sha256-Zm6bxLNnEOYuS/SzrAGsYuXSwk3cbkRQZY0fJnk8a5M=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c",
+        "rev": "d4971dd58c6627bfee52a1ad4237637c0a2fb0cd",
         "type": "github"
       },
       "original": {
@@ -286,11 +286,11 @@
     "spectrum": {
       "flake": false,
       "locked": {
-        "lastModified": 1759482047,
-        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
+        "lastModified": 1772189877,
+        "narHash": "sha256-i1p90Rgssb//aNiTDFq46ZG/fk3LmyRLChtp/9lddyA=",
         "ref": "refs/heads/main",
-        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
-        "revCount": 996,
+        "rev": "fe39e122d898f66e89ffa17d4f4209989ccb5358",
+        "revCount": 1255,
         "type": "git",
         "url": "https://spectrum-os.org/git/spectrum"
       },

machines/hippocampus/configuration.nix

@@ -90,7 +90,7 @@
   services.printing.enable = true;
 
   # Enable sound with pipewire.
-  hardware.pulseaudio.enable = false;
+  services.pulseaudio.enable = false;
   security.rtkit.enable = true;
   services.pipewire = {
     enable = true;
@@ -126,7 +126,8 @@
   environment.systemPackages = with pkgs; [
     firefox
 
-    screen
+    tmux
+    tio
     btop
     htop
     

machines/hippocampus/modules/containerHeadscale.nix

@@ -25,6 +25,8 @@
         authKeyFile = "/var/tailauth";
         extraUpFlags = ["--login-server" "${authServer}"];
       };
+      # Resolves https://github.com/NixOS/nixpkgs/issues/430756
+      systemd.services.tailscaled-autoconnect.serviceConfig.Type = lib.mkForce "simple";
     };
   };
 
@@ -59,19 +61,19 @@ in {
   };
 
   config = {
-    networking.bridges = {
-      "br0" = {
-        interfaces = [];
-      };
-    };
-    networking.interfaces.br0.ipv4.addresses = [{
-      address = "10.0.0.1";
-      prefixLength = 24;
-    }];
+#    networking.bridges = {
+#      "br0" = {
+#        interfaces = [];
+#      };
+#    };
+#    networking.interfaces.br0.ipv4.addresses = [{
+#      address = "10.0.0.1";
+#      prefixLength = 24;
+#    }];
     networking.nat = {
       enable = true;
       # Check for hostBridge use vb instead of ve
-      internalInterfaces = (map (n: "vb-${n}") (attrNames cfg.containers)) ++ ["br0"];
+      internalInterfaces = (map (n: "ve-${n}") (attrNames cfg.containers));
       externalInterface = "enp0s25";
       enableIPv6 = true;
     };

machines/hippocampus/oci/Wireguard.ContainerFile

@@ -1,5 +1,17 @@
 FROM alpine:3.16
-RUN apk add --no-cache bash wireguard-tools jq curl git ncurses
+RUN apk add --no-cache bash jq curl git ncurses \
+    bc \
+    coredns \
+    grep \
+    iproute2 \
+    iptables \
+    ip6tables \
+    iputils \
+    kmod \
+    net-tools \
+    nftables \
+    openresolv \
+    wireguard-tools
 RUN git clone https://github.com/pia-foss/manual-connections /manual-connections
 WORKDIR /manual-connections
-CMD bash -c "/manual-connections/run_setup.sh && watch -n 60 curl ip.me"
+CMD bash -c "/manual-connections/run_setup.sh && watch -n 1800 curl ip.me"

machines/hippocampus/oci/jelly.nix

@@ -31,7 +31,7 @@
             "radarr"
             "jellyseerr"
             "bazarr"
-            "readarr"
+            # "readarr"
             "prowlarr"
           ];
           environment = {
@@ -220,26 +220,26 @@
           ];
         };
 
-        readarr = {
-          image = "linuxserver/readarr:nightly";
-          volumes = [
-            "${dataDir}:/data"
-            "${configDir}/readarr:/config"
-          ];
-          ports = [
-            "8787:8787"
-          ];
-          environment = baseEnv // {
-            
-          };
-          extraOptions = [
-            "--pull=newer"
-            "--network" "container:wireguard"
-          ];
-          dependsOn = [
-            "prowlarr"
-          ];
-        };
+#        readarr = {
+#          image = "linuxserver/readarr:nightly";
+#          volumes = [
+#            "${dataDir}:/data"
+#            "${configDir}/readarr:/config"
+#          ];
+#          ports = [
+#            "8787:8787"
+#          ];
+#          environment = baseEnv // {
+#            
+#          };
+#          extraOptions = [
+#            "--pull=newer"
+#            "--network" "container:wireguard"
+#          ];
+#          dependsOn = [
+#            "prowlarr"
+#          ];
+#        };
 
         prowlarr = {
           image = "linuxserver/prowlarr:nightly";

machines/hippocampus/riscv.nix

@@ -1,6 +1,7 @@
 { config, pkgs, lib, ... }: {
+  # TODO: rename to emulation?
   boot.binfmt.emulatedSystems = [
-    "riscv64-linux"
+    "riscv64-linux" "aarch64-linux"
   ];
   boot.binfmt.preferStaticEmulators = true;
 }

machines/hippocampus/servers/private/grafana.nix

@@ -2,7 +2,7 @@
 
 {
   services.grafana = {
-    enable = true;
+    enable = false;
 
     settings.server = {
       http_addr = "0.0.0.0";

machines/hippocampus/servers/private/miniio.nix

@@ -5,8 +5,9 @@
     autoStart = true;
 
     privateNetwork = true;
-    hostBridge = "br0";
-    localAddress = "10.0.0.${toString (10+n)}/24";
+    #hostBridge = "br0";
+    hostAddress = "10.${toString (10+n)}.0.0";
+    localAddress = "10.${toString (10+n)}.0.1";
     
     # If true it registers a new node very time
     # need to find where it stores the state

machines/hippocampus/servers/public/headscale.nix

@@ -6,6 +6,7 @@
     enable = true;
     # 7000 port addresses are for internal network
     port = 7000;
+    address = "0.0.0.0"; # Access within nixos-containers
     settings = {
       server_url = "https://headscale.syzygial.cc";
       # TODO: Generate keys??
@@ -40,7 +41,7 @@
   services.caddy.virtualHosts = {
     "headscale.syzygial.cc" = {
       extraConfig = ''
-        reverse_proxy localhost:7000
+        reverse_proxy 0.0.0.0:7000
       '';
     };
   };

machines/hippocampus/servers/public/matrix/bots/discord.nix

@@ -73,7 +73,7 @@ in {
         #   .System - Whether the user is an official system user
         #   .Webhook - Whether the user is a webhook and is not an application
         #   .Application - Whether the user is an application
-        displayname_template = "{{if .Webhook}}Webhook{{else}}{{or .GlobalName .Username}}{{if .Bot}} (bot){{end}}{{end}}";
+        displayname_template = "{{if .Webhook}}Webhook{{else}}{{or .GlobalName .Username}}{{if .Bot}} (bot){{end}}{{end}} (Discord DM)";
         # Displayname template for Discord channels (bridged as rooms, or spaces when type=4).
         # Available variables:
         #   .Name - Channel name, or user displayname (pre-formatted with displayname_template) in DMs.
@@ -202,7 +202,7 @@ in {
         # instead of users having to find an access token and run `login-matrix`
         # manually.
         login_shared_secret_map = {
-          "glia.club" = "$MAUTRIX_DISCORD_DOUBLE_PUPPET";
+          "glia.club" = "as_token:$MAUTRIX_DISCORD_DOUBLE_PUPPET";
         };
 
         # The prefix for commands. Only required in non-management rooms.

machines/hippocampus/servers/public/nextcloud.nix

@@ -13,7 +13,7 @@ in {
   
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud32;
+    package = pkgs.nextcloud33;
     hostName = "localhost";
     settings = {
       trusted_domains = [
@@ -41,7 +41,7 @@ in {
       objectstore.s3 = {
         enable = true;
         bucket = "nextcloud";
-        autocreate = false;
+        verify_bucket_exists = false;
         key = "nextcloud";
         secretFile = config.sops.secrets."nextcloud/s3secret".path;
         region = "us-east-1";
@@ -78,7 +78,7 @@ in {
       ffmpeg_7-headless
       # required for recognize app
       nodejs_20 # runtime and installation requirement
-      nodejs_20.pkgs.node-pre-gyp # installation requirement
+      node-pre-gyp # installation requirement
       util-linux # runtime requirement for taskset
     ];
   };

machines/hippocampus/servers/public/tandoor.nix

@@ -10,10 +10,12 @@ in {
       SECRET_KEY = config.sops.secrets.tandoor-secret.path;
       DB_ENGINE = "django.db.backends.postgresql";
       POSTGRES_HOST = "127.0.0.1";
-      POSTGRES_PORT = config.services.postgresql.port;
+      POSTGRES_PORT = config.services.postgresql.settings.port;
       POSTGRES_USER = tandoor_user;
       POSTGRES_DB = tandoor_user;
+      MEDIA_ROOT = "/var/lib/tandoor-recipes/media";
       ENABLE_SIGNUP = "1";
+      ALLOWED_HOSTS = "tandoor.syzygial.cc";
     };
   };