alexion/dotfiles
Archived
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(copyparty): add NixOS guest #46

Merged
alexion merged 1 commits from feat/copyparty-guest into main 2026-08-16 20:37:02 -04:00
Conversation 4 Commits 1 Files Changed 6 +395 -6
alexion commented 2026-08-16 15:16:02 -04:00
Owner
Copy Link

Summary

  • add a repo-local Copyparty service module using pkgs.copyparty-min, my.serviceUid "copyparty", and the storage group
  • add a host-agnostic Copyparty guest that consumes the shared SOPS password secret
  • enable the guest on Pikachu on VLAN 20 with explicit MAC 02:23:20:39:23:01
  • mount /pikachu/data/copyparty, /pikachu/__inbox, and /pikachu/media into the guest
  • serve /inbox and /media with full alexion access and no anonymous access

Validation

  • focused nix eval checks for guest placement, service options, volume permissions, package, and SOPS secret metadata
  • Copyparty config smoke test with a dummy password
  • nix eval .#nixosConfigurations.pikachu.config.warnings
  • nix build .#nixosConfigurations.pikachu.config.system.build.toplevel --no-link
  • nix flake check

Review

  • independent risk, standards, intent, evidence, and documentation reviews found no blocking findings after fixes
  • non-blocking runtime follow-up: after deployment, verify anonymous denial and authenticated access against the live guest

— Claude

## Summary - add a repo-local Copyparty service module using `pkgs.copyparty-min`, `my.serviceUid "copyparty"`, and the `storage` group - add a host-agnostic Copyparty guest that consumes the shared SOPS password secret - enable the guest on Pikachu on VLAN 20 with explicit MAC `02:23:20:39:23:01` - mount `/pikachu/data/copyparty`, `/pikachu/__inbox`, and `/pikachu/media` into the guest - serve `/inbox` and `/media` with full `alexion` access and no anonymous access ## Validation - focused `nix eval` checks for guest placement, service options, volume permissions, package, and SOPS secret metadata - Copyparty config smoke test with a dummy password - `nix eval .#nixosConfigurations.pikachu.config.warnings` - `nix build .#nixosConfigurations.pikachu.config.system.build.toplevel --no-link` - `nix flake check` ## Review - independent risk, standards, intent, evidence, and documentation reviews found no blocking findings after fixes - non-blocking runtime follow-up: after deployment, verify anonymous denial and authenticated access against the live guest — Claude
alexion commented 2026-08-16 19:39:34 -04:00
Author
Owner
Copy Link

Updated after review feedback:

  • moved deployment-specific Copyparty volume choices out of guests/copyparty.nix and into hosts/pikachu/default.nix
  • kept guests/copyparty.nix as host-agnostic wiring that translates host-selected volumes into guest mounts and service options
  • recorded the guest/host split gotcha in AGENTS.md
  • reran focused evals, Pikachu toplevel build, nix flake check, and targeted intent/standards/documentation review

— Claude

Updated after review feedback: - moved deployment-specific Copyparty volume choices out of `guests/copyparty.nix` and into `hosts/pikachu/default.nix` - kept `guests/copyparty.nix` as host-agnostic wiring that translates host-selected volumes into guest mounts and service options - recorded the guest/host split gotcha in `AGENTS.md` - reran focused evals, Pikachu toplevel build, `nix flake check`, and targeted intent/standards/documentation review — Claude
alexion commented 2026-08-16 20:08:34 -04:00
Author
Owner
Copy Link

Updated again during live testing:

  • added opt-in host mount creation to my.guest
  • changed Copyparty state bind mount to create /pikachu/data/copyparty before container@copyparty starts
  • left served storage roots as explicit must-exist paths
  • fixed the SOPS owner issue by making the shared password secret root:storage 0440 on the host

Live retry command on Pikachu should be:

git fetch origin
git reset --hard origin/feat/copyparty-guest
sudo systemctl reset-failed container@copyparty.service
sudo nixos-rebuild switch --flake .#pikachu

— Claude

Updated again during live testing: - added opt-in host mount creation to `my.guest` - changed Copyparty state bind mount to create `/pikachu/data/copyparty` before `container@copyparty` starts - left served storage roots as explicit must-exist paths - fixed the SOPS owner issue by making the shared password secret `root:storage 0440` on the host Live retry command on Pikachu should be: ```bash git fetch origin git reset --hard origin/feat/copyparty-guest sudo systemctl reset-failed container@copyparty.service sudo nixos-rebuild switch --flake .#pikachu ``` — Claude
alexion commented 2026-08-16 20:31:12 -04:00
Author
Owner
Copy Link

Updated the PR with the corrected shared Copyparty password secret after live testing showed the previous value was the wrong age secret material.

— Claude

Updated the PR with the corrected shared Copyparty password secret after live testing showed the previous value was the wrong age secret material. — Claude
alexion added 1 commit 2026-08-16 20:31:13 -04:00
feat(copyparty): add NixOS guest 409a3cbc7f
alexion force-pushed feat/copyparty-guest from 98f0ac304d to 409a3cbc7f 2026-08-16 20:31:13 -04:00 Compare
alexion commented 2026-08-16 20:35:50 -04:00
Author
Owner
Copy Link

Live validation on Pikachu passed:

  • nixos-rebuild switch --flake .#pikachu deployed the Copyparty guest after the branch update
  • container@copyparty.service and in-guest copyparty.service are healthy
  • login with the shared alexion password works
  • anonymous access does not expose the configured volumes
  • /inbox and /media appear with the intended behavior
  • /pikachu/data/copyparty is created automatically by the guest mount setup

Remaining post-deploy human task is the UniFi DHCP reservation for MAC 02:23:20:39:23:01.

— Claude

Live validation on Pikachu passed: - `nixos-rebuild switch --flake .#pikachu` deployed the Copyparty guest after the branch update - `container@copyparty.service` and in-guest `copyparty.service` are healthy - login with the shared `alexion` password works - anonymous access does not expose the configured volumes - `/inbox` and `/media` appear with the intended behavior - `/pikachu/data/copyparty` is created automatically by the guest mount setup Remaining post-deploy human task is the UniFi DHCP reservation for MAC `02:23:20:39:23:01`. — Claude
alexion merged commit 409a3cbc7f into main 2026-08-16 20:37:02 -04:00
alexion deleted branch feat/copyparty-guest 2026-08-16 20:37:02 -04:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
alexion
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: alexion/dotfiles#46
Delete Branch "feat/copyparty-guest"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?