nimmo/nixos-config

Watch

Fork 0

feat(chaos): migrate Newt, Rangarr, and Killarr #153

Merged

nimmo merged 1 commit from prepare-chaos-docker-stacks-migration into main

2026-08-09 14:36:18 +01:00

nimmo commented

2026-08-09 12:15:07 +01:00

Owner

Summary

Add independent OCI container modules for Rangarr and Killarr under modules/containers/.
Enable Newt, Rangarr, and Killarr on chaos.
Preserve the existing mutable Rangarr configuration mount at /srv/stacks/rangarr/config.yaml.
Split Newt SOPS data into host-scoped vega.yaml and chaos.yaml files.
Exclude stopped Listenarr from the migration.

Validation

nix flake check --no-write-lock-file passes for all NixOS configurations.
Chaos deployment completed successfully.
Verified newt, docker, docker-rangarr, and docker-killarr are active.
Verified Rangarr and Killarr are running with the copied 5630-byte configuration owned by UID/GID 65532 and mode 0600.
Verified the old Docker host has no running or stopped containers.
Verified Newt established its tunnel successfully.

Notes

Newt logged stale Wishlist target lookup errors before Wishlist was removed from Pangolin; the target is no longer part of this deployment.

Closes #152

## Summary - Add independent OCI container modules for Rangarr and Killarr under `modules/containers/`. - Enable Newt, Rangarr, and Killarr on chaos. - Preserve the existing mutable Rangarr configuration mount at `/srv/stacks/rangarr/config.yaml`. - Split Newt SOPS data into host-scoped `vega.yaml` and `chaos.yaml` files. - Exclude stopped Listenarr from the migration. ## Validation - `nix flake check --no-write-lock-file` passes for all NixOS configurations. - Chaos deployment completed successfully. - Verified `newt`, `docker`, `docker-rangarr`, and `docker-killarr` are active. - Verified Rangarr and Killarr are running with the copied 5630-byte configuration owned by UID/GID 65532 and mode 0600. - Verified the old Docker host has no running or stopped containers. - Verified Newt established its tunnel successfully. ## Notes Newt logged stale Wishlist target lookup errors before Wishlist was removed from Pangolin; the target is no longer part of this deployment. Closes #152

nimmo added this to the Chaos Docker Stack NixOS Migration milestone

2026-08-09 12:15:07 +01:00

nimmo added the

phase:cutover

phase:validation

host:chaos

labels

2026-08-09 12:15:07 +01:00

nimmo added 1 commit

2026-08-09 12:15:07 +01:00

feat(chaos): migrate Newt Rangarr and Killarr

Build and Push Attic Cache / test (pull_request) Successful in 1m22s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped

Details

AI pull-request review / review (pull_request) Successful in 4m19s

Details

ef11d03b19

nimmo commented

2026-08-09 12:19:27 +01:00

Author

Owner

Automated code review

Reviewed commit: ef11d03b197f63af64086fb019bd4e76a35decef

Verdict: Ready to merge

No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory.

Overall assessment

Migrates Newt, Rangarr, and Killarr to independent OCI container modules on the chaos host. Splits Newt SOPS secrets into host-scoped files (vega.yaml, chaos.yaml) and updates .sops.yaml creation rules. Introduces a hardcoded hostname fallback for secret paths and unpinned :latest image tags.

Blocking findings

None.

Important findings

None.

Suggestions

Hardcoded hostname fallback in shared module limits extensibility (modules/services/newt.nix:37; high confidence)
default = if config.networking.hostName == "vega" then ../../secrets/newt/vega.yaml else ../../secrets/newt/chaos.yaml;
Impact: Tightly couples a shared module to specific hostnames. Adding Newt to a third host requires modifying the shared module rather than relying on convention or options.
Suggested fix: Derive the SOPS path dynamically from config.networking.hostName (e.g., "../../secrets/newt/${config.networking.hostName}.yaml") and update .sops.yaml with a wildcard or explicit rule for new hosts.
Unpinned OCI container images reduce deployment determinism (modules/containers/rangarr.nix:29; high confidence)
image = "judochinx/rangarr:latest";
Impact: Using :latest tags means containers may pull different versions on rebuild, potentially introducing breaking changes or inconsistent behavior across deployments.
Suggested fix: Pin images to specific version tags or content-addressable digests for reproducible builds.
Unpinned OCI container images reduce deployment determinism (modules/containers/killarr.nix:28; high confidence)
image = "judochinx/killarr:latest";
Impact: Using :latest tags means containers may pull different versions on rebuild, potentially introducing breaking changes or inconsistent behavior across deployments.
Suggested fix: Pin images to specific version tags or content-addressable digests for reproducible builds.
Missing port configuration for Rangarr and Killarr containers (modules/containers/rangarr.nix:28; medium confidence)
virtualisation.oci-containers.containers.rangarr = { image = ...; volumes = ...; environment = ...; };
Impact: No ports are published. If external or LAN access is required, the services will be unreachable unless routed through an internal proxy like Newt/Pangolin.
Suggested fix: Verify network requirements and add explicit ports mappings if external access is needed, or document that they are strictly internal-only.

Tests and validation

No configured deterministic checks.

Questions

Are Rangarr and Killarr intended to be accessed exclusively through internal routing (e.g., Newt/Pangolin), given the absence of published ports in their OCI container definitions?
Is the hardcoded hostname fallback in newt.nix sufficient for future hosts, or should the secret path be derived dynamically from config.networking.hostName?

Review limitations

Review is based solely on the provided diff and repository context; runtime behavior and network topology assumptions cannot be fully verified without live deployment logs or architecture diagrams.
SOPS key material and encrypted values are not decrypted or validated beyond structural inspection of .sops.yaml rules and file headers.

Diff coverage

.sops.yaml: reviewed — included in a context-limited batch
hosts/chaos/default.nix: reviewed — included in a context-limited batch
modules/containers/killarr.nix: reviewed — included in a context-limited batch
modules/containers/rangarr.nix: reviewed — included in a context-limited batch
modules/services/newt.nix: reviewed — included in a context-limited batch
secrets/README.md: reviewed — included in a context-limited batch
secrets/newt.yaml: reviewed — included in a context-limited batch
secrets/newt/chaos.yaml: reviewed — included in a context-limited batch
secrets/newt/vega.yaml: reviewed — included in a context-limited batch

Review metadata

Reviewer: forgejo-ai-review v1
Model: qwen3.6:35b-a3b-q8_0
Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md
Commits considered: 1
Previous automated review: none found
Findings: 4

## Automated code review Reviewed commit: `ef11d03b197f63af64086fb019bd4e76a35decef` ## Verdict: Ready to merge No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory. ### Overall assessment Migrates Newt, Rangarr, and Killarr to independent OCI container modules on the chaos host. Splits Newt SOPS secrets into host-scoped files (vega.yaml, chaos.yaml) and updates .sops.yaml creation rules. Introduces a hardcoded hostname fallback for secret paths and unpinned `:latest` image tags. ### Blocking findings None. ### Important findings None. ### Suggestions - **Hardcoded hostname fallback in shared module limits extensibility** (modules/services/newt.nix:37; high confidence) default = if config.networking.hostName == "vega" then ../../secrets/newt/vega.yaml else ../../secrets/newt/chaos.yaml; Impact: Tightly couples a shared module to specific hostnames. Adding Newt to a third host requires modifying the shared module rather than relying on convention or options. Suggested fix: Derive the SOPS path dynamically from config.networking.hostName (e.g., "../../secrets/newt/${config.networking.hostName}.yaml") and update .sops.yaml with a wildcard or explicit rule for new hosts. - **Unpinned OCI container images reduce deployment determinism** (modules/containers/rangarr.nix:29; high confidence) image = "judochinx/rangarr:latest"; Impact: Using :latest tags means containers may pull different versions on rebuild, potentially introducing breaking changes or inconsistent behavior across deployments. Suggested fix: Pin images to specific version tags or content-addressable digests for reproducible builds. - **Unpinned OCI container images reduce deployment determinism** (modules/containers/killarr.nix:28; high confidence) image = "judochinx/killarr:latest"; Impact: Using :latest tags means containers may pull different versions on rebuild, potentially introducing breaking changes or inconsistent behavior across deployments. Suggested fix: Pin images to specific version tags or content-addressable digests for reproducible builds. - **Missing port configuration for Rangarr and Killarr containers** (modules/containers/rangarr.nix:28; medium confidence) virtualisation.oci-containers.containers.rangarr = { image = ...; volumes = ...; environment = ...; }; Impact: No ports are published. If external or LAN access is required, the services will be unreachable unless routed through an internal proxy like Newt/Pangolin. Suggested fix: Verify network requirements and add explicit ports mappings if external access is needed, or document that they are strictly internal-only. ### Tests and validation - No configured deterministic checks. ### Questions - Are Rangarr and Killarr intended to be accessed exclusively through internal routing (e.g., Newt/Pangolin), given the absence of published ports in their OCI container definitions? - Is the hardcoded hostname fallback in newt.nix sufficient for future hosts, or should the secret path be derived dynamically from config.networking.hostName? ### Review limitations - Review is based solely on the provided diff and repository context; runtime behavior and network topology assumptions cannot be fully verified without live deployment logs or architecture diagrams. - SOPS key material and encrypted values are not decrypted or validated beyond structural inspection of .sops.yaml rules and file headers. ### Diff coverage - `.sops.yaml`: **reviewed** — included in a context-limited batch - `hosts/chaos/default.nix`: **reviewed** — included in a context-limited batch - `modules/containers/killarr.nix`: **reviewed** — included in a context-limited batch - `modules/containers/rangarr.nix`: **reviewed** — included in a context-limited batch - `modules/services/newt.nix`: **reviewed** — included in a context-limited batch - `secrets/README.md`: **reviewed** — included in a context-limited batch - `secrets/newt.yaml`: **reviewed** — included in a context-limited batch - `secrets/newt/chaos.yaml`: **reviewed** — included in a context-limited batch - `secrets/newt/vega.yaml`: **reviewed** — included in a context-limited batch <details><summary>Review metadata</summary> - Reviewer: forgejo-ai-review v1 - Model: qwen3.6:35b-a3b-q8_0 - Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md - Commits considered: 1 - Previous automated review: none found - Findings: 4 </details>

nimmo merged commit 2972c42146 into main

2026-08-09 14:36:18 +01:00

nimmo deleted branch prepare-chaos-docker-stacks-migration

2026-08-09 14:36:18 +01:00

nimmo referenced this pull request from a commit

2026-08-09 14:36:20 +01:00

Merge pull request 'feat(chaos): migrate Newt, Rangarr, and Killarr' (#153) from prepare-chaos-docker-stacks-migration into main