nimmo/nixos-config
Watch
1
0
Fork
You've already forked nixos-config
 0
Code Issues 29 Pull requests Wiki Activity Actions

feat: centralize Trilium web and MCP on Vega #100

Merged
nimmo merged 5 commits from issue-99-trilium-vega-mcp into main 2026-07-26 19:57:29 +01:00
Conversation 5 Commits 5 Files changed 12 +67 -174
nimmo commented 2026-07-26 19:18:45 +01:00
Owner
Copy link

Summary

  • run the Nebula-only Trilium web instance on vega instead of all AI desktop hosts
  • repoint Codex and OpenCode to Vega's built-in Trilium MCP endpoint
  • retire the separate Lyra-hosted triliumnext-mcp path and update docs

Validation

  • nix flake check

Notes

  • Ref #99
  • The AI / LLM toggle still appears to be Trilium application state, so it will be enabled manually in the UI after deployment
  • Review should follow the current comment-based workflow plus commit statuses rather than a formal Forgejo self-review
## Summary - run the Nebula-only Trilium web instance on vega instead of all AI desktop hosts - repoint Codex and OpenCode to Vega's built-in Trilium MCP endpoint - retire the separate Lyra-hosted `triliumnext-mcp` path and update docs ## Validation - `nix flake check` ## Notes - Ref #99 - The AI / LLM toggle still appears to be Trilium application state, so it will be enabled manually in the UI after deployment - Review should follow the current comment-based workflow plus commit statuses rather than a formal Forgejo self-review
feat: centralize Trilium web and MCP on Vega
All checks were successful
Build and Push Attic Cache / test (pull_request) Successful in 36s
Details
Build and Push Attic Cache / build (pull_request) Has been skipped
Details
AI pull-request review / review (pull_request) Successful in 3m54s
Details
a8d654c6e6
nimmo commented 2026-07-26 19:22:42 +01:00
Author
Owner
Copy link

Automated code review

Reviewed commit: e23646dc789ae09458deab90ebf97bf528049263

Verdict: Ready to merge

No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory.

Overall assessment

Centralizes Trilium web and MCP to Vega, retiring the legacy Lyra-hosted gateway service. Updates AI client profiles to use the shared ETAPI token directly for MCP authentication, enforces explicit per-host URL configuration with clear failure messages, and removes obsolete secrets and module imports. Documentation and NTFY monitoring lists are updated accordingly.

Blocking findings

None.

Important findings

None.

Suggestions

  • Typo in AI-agents profile error message (modules/profiles/ai-agents.nix:63; high confidence)
    throw "profiles.aiDesktop/ai-agents requires nixosConfig.trilium.clientUrl to be set explicitly.";
    Impact: Minor cosmetic issue in runtime error output for misconfigured hosts; references the wrong profile name which may confuse operators debugging configuration failures.
    Suggested fix: Correct the string to "profiles.ai-agents requires nixosConfig.trilium.clientUrl to be set explicitly.".

Tests and validation

  • No configured deterministic checks.

Questions

  • Does the Vega Trilium instance require any additional firewall or Nebula route adjustments to ensure reliable low-latency access for all AI client hosts?

Review limitations

  • Review is based on provided diff and documentation; runtime behavior of the Trilium MCP endpoint and Nebula routing cannot be validated without live deployment evidence.
  • SOPS secret contents are encrypted and not inspected; token consolidation relies on documented intent rather than cryptographic verification.

Diff coverage

  • README.md: reviewed — included in a context-limited batch
  • hosts/electra/default.nix: reviewed — included in a context-limited batch
  • hosts/lena/default.nix: reviewed — included in a context-limited batch
  • hosts/lyra/default.nix: reviewed — included in a context-limited batch
  • hosts/vega/default.nix: reviewed — included in a context-limited batch
  • modules/common/base.nix: reviewed — included in a context-limited batch
  • modules/common/default-config.nix: reviewed — included in a context-limited batch
  • modules/profiles/ai-agents.nix: reviewed — included in a context-limited batch
  • modules/profiles/ai-desktop.nix: reviewed — included in a context-limited batch
  • modules/services/trilium-mcp.nix: reviewed — included in a context-limited batch
  • secrets/README.md: reviewed — included in a context-limited batch
  • secrets/trilium.yaml: reviewed — included in a context-limited batch
Review metadata
  • Reviewer: forgejo-ai-review v1
  • Model: qwen3.6:35b-a3b-q8_0
  • Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md
  • Commits considered: 4
  • Previous automated review: updated
  • Findings: 1
<!-- forgejo-ai-review:v1 --> ## Automated code review Reviewed commit: `e23646dc789ae09458deab90ebf97bf528049263` ## Verdict: Ready to merge No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory. ### Overall assessment Centralizes Trilium web and MCP to Vega, retiring the legacy Lyra-hosted gateway service. Updates AI client profiles to use the shared ETAPI token directly for MCP authentication, enforces explicit per-host URL configuration with clear failure messages, and removes obsolete secrets and module imports. Documentation and NTFY monitoring lists are updated accordingly. ### Blocking findings None. ### Important findings None. ### Suggestions - **Typo in AI-agents profile error message** (modules/profiles/ai-agents.nix:63; high confidence) throw "profiles.aiDesktop/ai-agents requires nixosConfig.trilium.clientUrl to be set explicitly."; Impact: Minor cosmetic issue in runtime error output for misconfigured hosts; references the wrong profile name which may confuse operators debugging configuration failures. Suggested fix: Correct the string to "profiles.ai-agents requires nixosConfig.trilium.clientUrl to be set explicitly.". ### Tests and validation - No configured deterministic checks. ### Questions - Does the Vega Trilium instance require any additional firewall or Nebula route adjustments to ensure reliable low-latency access for all AI client hosts? ### Review limitations - Review is based on provided diff and documentation; runtime behavior of the Trilium MCP endpoint and Nebula routing cannot be validated without live deployment evidence. - SOPS secret contents are encrypted and not inspected; token consolidation relies on documented intent rather than cryptographic verification. ### Diff coverage - `README.md`: **reviewed** — included in a context-limited batch - `hosts/electra/default.nix`: **reviewed** — included in a context-limited batch - `hosts/lena/default.nix`: **reviewed** — included in a context-limited batch - `hosts/lyra/default.nix`: **reviewed** — included in a context-limited batch - `hosts/vega/default.nix`: **reviewed** — included in a context-limited batch - `modules/common/base.nix`: **reviewed** — included in a context-limited batch - `modules/common/default-config.nix`: **reviewed** — included in a context-limited batch - `modules/profiles/ai-agents.nix`: **reviewed** — included in a context-limited batch - `modules/profiles/ai-desktop.nix`: **reviewed** — included in a context-limited batch - `modules/services/trilium-mcp.nix`: **reviewed** — included in a context-limited batch - `secrets/README.md`: **reviewed** — included in a context-limited batch - `secrets/trilium.yaml`: **reviewed** — included in a context-limited batch <details><summary>Review metadata</summary> - Reviewer: forgejo-ai-review v1 - Model: qwen3.6:35b-a3b-q8_0 - Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md - Commits considered: 4 - Previous automated review: updated - Findings: 1 </details>
nimmo commented 2026-07-26 19:27:47 +01:00
Author
Owner
Copy link

Addressing the automated review findings:

  • secrets/trilium.yaml already contains trilium/etapi-token and still retains the legacy trilium/mcp-gateway-token, so the new client secret reference is valid and there is no pending secret-file migration for this branch.
  • The legacy gateway token is being kept intentionally for now so the separate triliumnext-mcp path can be re-enabled without forcing a secret rotation.
  • I also have a small follow-up local change that makes the Vega default explicit in nixosConfig.trilium.clientUrl and says it must be overridden for non-Vega deployments. I will push that next.
Addressing the automated review findings: - `secrets/trilium.yaml` already contains `trilium/etapi-token` and still retains the legacy `trilium/mcp-gateway-token`, so the new client secret reference is valid and there is no pending secret-file migration for this branch. - The legacy gateway token is being kept intentionally for now so the separate `triliumnext-mcp` path can be re-enabled without forcing a secret rotation. - I also have a small follow-up local change that makes the Vega default explicit in `nixosConfig.trilium.clientUrl` and says it must be overridden for non-Vega deployments. I will push that next.
docs: clarify Vega Trilium client default
All checks were successful
Build and Push Attic Cache / test (pull_request) Successful in 40s
Details
Build and Push Attic Cache / build (pull_request) Has been skipped
Details
AI pull-request review / review (pull_request) Successful in 4m33s
Details
0c0545cffc
refactor: remove legacy Trilium MCP path
All checks were successful
Build and Push Attic Cache / test (pull_request) Successful in 36s
Details
Build and Push Attic Cache / build (pull_request) Has been skipped
Details
AI pull-request review / review (pull_request) Successful in 4m57s
Details
062d39d9f6
nimmo commented 2026-07-26 19:39:08 +01:00
Author
Owner
Copy link

Addressed the latest automated review findings in commit 062d39d.

Changes made:

  • removed the stale nixosConfig.triliumMcp module/import path entirely, including modules/services/trilium-mcp.nix
  • removed the legacy trilium/mcp-gateway-token entry from secrets/trilium.yaml and from the docs
  • changed nixosConfig.trilium.clientUrl from a shared hardcoded default to an explicit per-host setting on the current AI hosts (electra, lena, lyra, vega)
  • added an assertion in the AI agent profile so future Codex/OpenCode hosts must set nixosConfig.trilium.clientUrl explicitly

Validation:

  • nix flake check passed after these changes

That resolves the two important findings directly in the tree rather than just documenting intent.

Addressed the latest automated review findings in commit `062d39d`. Changes made: - removed the stale `nixosConfig.triliumMcp` module/import path entirely, including `modules/services/trilium-mcp.nix` - removed the legacy `trilium/mcp-gateway-token` entry from `secrets/trilium.yaml` and from the docs - changed `nixosConfig.trilium.clientUrl` from a shared hardcoded default to an explicit per-host setting on the current AI hosts (`electra`, `lena`, `lyra`, `vega`) - added an assertion in the AI agent profile so future Codex/OpenCode hosts must set `nixosConfig.trilium.clientUrl` explicitly Validation: - `nix flake check` passed after these changes That resolves the two important findings directly in the tree rather than just documenting intent.
fix: fail clearly when Trilium client URL is unset
All checks were successful
Build and Push Attic Cache / test (pull_request) Successful in 36s
Details
Build and Push Attic Cache / build (pull_request) Has been skipped
Details
AI pull-request review / review (pull_request) Successful in 4m27s
Details
e23646dc78
nimmo commented 2026-07-26 19:46:13 +01:00
Author
Owner
Copy link

Addressed the latest review finding in commit e23646d.

  • both AI profiles now handle an unset nixosConfig.trilium.clientUrl explicitly at URL construction time instead of interpolating a null value
  • the failure path is now a clear throw message in both modules/profiles/ai-agents.nix and modules/profiles/ai-desktop.nix, so misconfigured hosts get an actionable error instead of a null coercion failure
  • nix flake check passed again after the change
Addressed the latest review finding in commit `e23646d`. - both AI profiles now handle an unset `nixosConfig.trilium.clientUrl` explicitly at URL construction time instead of interpolating a null value - the failure path is now a clear `throw` message in both `modules/profiles/ai-agents.nix` and `modules/profiles/ai-desktop.nix`, so misconfigured hosts get an actionable error instead of a null coercion failure - `nix flake check` passed again after the change
fix: correct Trilium client URL error text
Some checks failed
Build and Push Attic Cache / test (pull_request) Successful in 37s
Details
Build and Push Attic Cache / build (pull_request) Has been skipped
Details
AI pull-request review / review (pull_request) Has been cancelled
Details
8af16c0c98
nimmo commented 2026-07-26 19:56:33 +01:00
Author
Owner
Copy link

Applied the final advisory cleanup in commit 8af16c0.

  • corrected the profiles.ai-agents typo in the unset nixosConfig.trilium.clientUrl error message
  • nix flake check passed again after the change
Applied the final advisory cleanup in commit `8af16c0`. - corrected the `profiles.ai-agents` typo in the unset `nixosConfig.trilium.clientUrl` error message - `nix flake check` passed again after the change
nimmo merged commit 0f1083e965 into main 2026-07-26 19:57:29 +01:00
nimmo deleted branch issue-99-trilium-vega-mcp 2026-07-26 19:57:30 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
host:electra
Issues specific to the electra host.

  
host:fleet
Issues that span multiple hosts or the fleet as a whole.

  
host:lyra
Issues specific to the lyra host.

  
host:vega
Issues specific to the vega host.

  
host:vega

   
phase:cutover
The service cutover execution phase.

  
phase:deploy

   
phase:mcp

   
phase:module

   
phase:packaging

   
phase:prep
Preparation and preflight work before service cutover.

  
phase:validation
Post-cutover validation and rollback-window work.

  
project:attic-postgres-lyra-rollout
Issues in the Attic PostgreSQL migration and Lyra rollout workstream.

  
project:auto-update-reliability
Work arising from the automated update reliability review.

  
project:declarative-purity-cleanup
Issues in the declarative purity cleanup workstream.

  
project:external-review
Review of external configurations for ideas and improvements

  
project:host-facts-refactor
Issues in the host facts refactor workstream.

  
project:lyra-nixos-deploy
Issues in the Lyra NixOS deployment workstream.

  
project:lyra-service-stack-migration
Issues in the lyra service stack migration workstream.

  
project:nebula-mesh-network
Issues in the Nebula mesh network workstream.

  
project:security-hardening
Work belonging to the Security Hardening milestone

  
project:service-stack-migration
Issues in the service stack migration workstream.

  
project:vega-sillytavern-cutover
Issues in the Vega SillyTavern cutover workstream.

  
service:auto-update
NixOS flake update, cache build, and consumer deployment automation.

  
service:mem0

   
service:sillytavern
Issues related to the SillyTavern service.

No labels
host:electra
host:fleet
host:lyra
host:vega
host:vega
phase:cutover
phase:deploy
phase:mcp
phase:module
phase:packaging
phase:prep
phase:validation
project:attic-postgres-lyra-rollout
project:auto-update-reliability
project:declarative-purity-cleanup
project:external-review
project:host-facts-refactor
project:lyra-nixos-deploy
project:lyra-service-stack-migration
project:nebula-mesh-network
project:security-hardening
project:service-stack-migration
project:vega-sillytavern-cutover
service:auto-update
service:mem0
service:sillytavern
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
nimmo/nixos-config!100
No description provided.