Enable docker-report (Trilium) sync and atticd alerts on vega #230

New issue

Closed

opened 2026-09-19 08:21:25 +01:00 by nimmo · 0 comments

nimmo commented

2026-09-19 08:21:25 +01:00

Owner

Context

Vega currently lacks two service-coverage items that lyra already has:

docker-report (Trilium) sync: vega's non-declarative Docker stacks under /srv/stacks are not documented in Trilium; lyra already runs this.
atticd failure alerting: vega runs Attic, but atticd is not in the ntfy service-failure monitor (nor was it on lyra yet).

Scope

Import modules/services/docker-report.nix on vega so its /srv/stacks document under the shared Trilium tree (option a: shared ETAPI token + parent note + stacks dir).
Add vega as a SOPS recipient of secrets/docker-report.yaml and update the .sops.yaml creation rule for that secret.
Add atticd to services.serviceFailureMonitor.services on vega and lyra — atticd.nix (unlike most service modules, e.g. jellyfin/immich/tdarr) does not self-register.
Provision the app at /srv/services/docker-report on vega (cloned from nimmo/docker-report); config.json renders from sops at activation (vega can now decrypt it).

Completion criteria

nix flake check green (all 6 hosts)
Vega is a recipient of secrets/docker-report.yaml (verified against the canonical .sops.yaml key)
App provisioned on vega (14 files, nimmo:users 755, config.json deferred to sops)
Vega canary: sudo nixos-rebuild test --flake .#vega (secret decrypts on vega; service + timer active)
First Trilium sync + no-op follow-up (live write: notes under the shared parent note + # TRILIUM METADATA injected into /srv/stacks/*.yml)
Vega live from main via auto-update

Risk / blast radius

The first Trilium sync is a live write (creates/updates Trilium notes and injects headers into vega's compose files under /srv/stacks). Vega is pull-only from main, so none of this is live on vega until the associated PR merges. Vega's canary is a non-persistent nixos-rebuild test with an auto-update hold, per AGENTS.md.

## Context Vega currently lacks two service-coverage items that lyra already has: - **docker-report (Trilium) sync**: vega's non-declarative Docker stacks under `/srv/stacks` are not documented in Trilium; lyra already runs this. - **atticd failure alerting**: vega runs Attic, but `atticd` is not in the ntfy service-failure monitor (nor was it on lyra yet). ## Scope - Import `modules/services/docker-report.nix` on vega so its `/srv/stacks` document under the shared Trilium tree (option a: shared ETAPI token + parent note + stacks dir). - Add vega as a SOPS recipient of `secrets/docker-report.yaml` and update the `.sops.yaml` creation rule for that secret. - Add `atticd` to `services.serviceFailureMonitor.services` on vega and lyra — `atticd.nix` (unlike most service modules, e.g. jellyfin/immich/tdarr) does not self-register. - Provision the app at `/srv/services/docker-report` on vega (cloned from `nimmo/docker-report`); `config.json` renders from sops at activation (vega can now decrypt it). ## Completion criteria - [x] `nix flake check` green (all 6 hosts) - [x] Vega is a recipient of `secrets/docker-report.yaml` (verified against the canonical `.sops.yaml` key) - [x] App provisioned on vega (14 files, `nimmo:users 755`, `config.json` deferred to sops) - [ ] Vega canary: `sudo nixos-rebuild test --flake .#vega` (secret decrypts on vega; service + timer active) - [ ] First Trilium sync + no-op follow-up (live write: notes under the shared parent note + `# TRILIUM METADATA` injected into `/srv/stacks/*.yml`) - [ ] Vega live from `main` via auto-update ## Risk / blast radius The first Trilium sync is a **live write** (creates/updates Trilium notes and injects headers into vega's compose files under `/srv/stacks`). Vega is pull-only from `main`, so none of this is live on vega until the associated PR merges. Vega's canary is a non-persistent `nixos-rebuild test` with an auto-update hold, per AGENTS.md.

nimmo added the

phase:deploy

host:lyra

host:vega

labels

2026-09-19 08:21:25 +01:00

nimmo referenced this issue from a pull request that will close it,

2026-09-19 08:23:09 +01:00

feat(vega): docker-report (Trilium) sync + atticd alerts #231

nimmo closed this issue

2026-09-19 08:30:41 +01:00