nimmo/nixos-config

Watch

Fork 0

Migrate Karakeep to native NixOS on Vega #186

Merged

nimmo merged 11 commits from feat/karakeep-native-vega into main

2026-08-21 23:46:08 +01:00

nimmo commented

2026-08-21 23:34:06 +01:00

Owner

Closes #185

Summary

add native Karakeep and guarded one-time state import on Vega
separate service secrets from shared MCP client secrets
build Karakeep with Node 22 to avoid its Node 24 better-sqlite3 crash
restart Karakeep services when their SOPS environment changes
configure Lyra Ollama for two concurrent models and align Karakeep with embeddinggemma's 768 dimensions
retain media1 Docker data and stack intact for rollback

Validation

nix flake check
full Vega closure builds successfully
Vega just test: Karakeep web/workers/browser/Meilisearch healthy; state imported
public links.nimmog.uk endpoint reaches Vega through existing OIDC/Pangolin routing
Lyra Ollama /api/embed works with embeddinggemma
rebuilt Meilisearch vector index accepts Karakeep embeddings successfully

Closes #185 ## Summary - add native Karakeep and guarded one-time state import on Vega - separate service secrets from shared MCP client secrets - build Karakeep with Node 22 to avoid its Node 24 better-sqlite3 crash - restart Karakeep services when their SOPS environment changes - configure Lyra Ollama for two concurrent models and align Karakeep with embeddinggemma's 768 dimensions - retain media1 Docker data and stack intact for rollback ## Validation - `nix flake check` - full Vega closure builds successfully - Vega `just test`: Karakeep web/workers/browser/Meilisearch healthy; state imported - public `links.nimmog.uk` endpoint reaches Vega through existing OIDC/Pangolin routing - Lyra Ollama `/api/embed` works with embeddinggemma - rebuilt Meilisearch vector index accepts Karakeep embeddings successfully

nimmo added this to the Service Stack NixOS Migration milestone

2026-08-21 23:34:06 +01:00

nimmo added the

labels

2026-08-21 23:34:06 +01:00

nimmo added 9 commits

2026-08-21 23:34:06 +01:00

feat: stage native Karakeep service on Vega f90a85ca50

Refs #185

refactor: isolate Karakeep server secrets 54b6a6e1a2

chore: add Karakeep server secret 3843dd71ca

feat: add guarded Karakeep state import 8eebf6ef98

fix: bypass curl-cffi test regression on Vega bf9fb4ac1c

fix: build Karakeep with Node 22 6a1d8b82d1

fix: restart Karakeep after secret changes 2268f5fee0

perf: allow two Ollama models on Lyra 4cd7ab68cc

fix: align Karakeep embedding dimensions

AI pull-request review / review (pull_request) Successful in 1m37s

Details

Build and Push Attic Cache / test (pull_request) Successful in 1m59s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped

Details

Build and Push Attic Cache / notify-remediation (pull_request) Has been skipped

Details

7735937f39

nimmo commented

2026-08-21 23:35:45 +01:00

Author

Owner

Automated code review

Reviewed commit: 890f879411fce91d2c44d10707647ece63922bca

Verdict: Ready to merge

No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory.

Overall assessment

The PR migrates the Karakeep service from a Docker stack on media1 to a native NixOS service on Vega. It introduces a new modules/services/karakeep.nix module, separates server runtime secrets from MCP client credentials using SOPS, and implements a guarded one-time state import from the legacy Docker data. Additional changes include configuring Lyra's Ollama instance for two concurrent models to support Karakeep's embedding workload and pinning Node 22 for Karakeep due to a known better-sqlite3 crash on Node 24.

Blocking findings

None.

Important findings

None.

Suggestions

Hardcoded Node 22 pin should be tracked for removal (modules/services/karakeep.nix:56; high confidence)
default = pkgs.nodejs_22;
Impact: The comment explains the pin is due to a better-sqlite3 crash on Node 24. This is a temporary workaround that should be explicitly tracked so it doesn't become stale when Karakeep updates.
Suggested fix: Consider adding a TODO comment with a reference to the upstream issue or a specific version of Karakeep where this can be re-evaluated, or use a lib.warn if the version is below a certain threshold.

Tests and validation

No configured deterministic checks.

Questions

Has the one-time import process been tested with a realistic dataset from the media1 Docker stack to ensure data integrity?
Are there any known issues with the curl-cffi workaround that might affect other services on Vega if the scope is not strictly enforced?

Review limitations

I cannot run nix flake check or just test to validate the configuration.
I cannot verify the actual SOPS decryption or secret values.
I cannot confirm the live deployment status of the media1 Docker stack or the new native service.

Diff coverage

.sops.yaml: reviewed — included in a context-limited batch
README.md: reviewed — included in a context-limited batch
hosts/lyra/default.nix: reviewed — included in a context-limited batch
hosts/vega/default.nix: reviewed — included in a context-limited batch
modules/services/karakeep.nix: reviewed — included in a context-limited batch
secrets/README.md: reviewed — included in a context-limited batch
secrets/karakeep-server.yaml: reviewed — included in a context-limited batch

Review metadata

Reviewer: forgejo-ai-review v1
Model: qwen3.6:35b-a3b-q8_0
Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md
Commits considered: 11
Previous automated review: updated
Findings: 1

## Automated code review Reviewed commit: `890f879411fce91d2c44d10707647ece63922bca` ## Verdict: Ready to merge No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory. ### Overall assessment The PR migrates the Karakeep service from a Docker stack on media1 to a native NixOS service on Vega. It introduces a new `modules/services/karakeep.nix` module, separates server runtime secrets from MCP client credentials using SOPS, and implements a guarded one-time state import from the legacy Docker data. Additional changes include configuring Lyra's Ollama instance for two concurrent models to support Karakeep's embedding workload and pinning Node 22 for Karakeep due to a known `better-sqlite3` crash on Node 24. ### Blocking findings None. ### Important findings None. ### Suggestions - **Hardcoded Node 22 pin should be tracked for removal** (modules/services/karakeep.nix:56; high confidence) default = pkgs.nodejs_22; Impact: The comment explains the pin is due to a `better-sqlite3` crash on Node 24. This is a temporary workaround that should be explicitly tracked so it doesn't become stale when Karakeep updates. Suggested fix: Consider adding a TODO comment with a reference to the upstream issue or a specific version of Karakeep where this can be re-evaluated, or use a `lib.warn` if the version is below a certain threshold. ### Tests and validation - No configured deterministic checks. ### Questions - Has the one-time import process been tested with a realistic dataset from the media1 Docker stack to ensure data integrity? - Are there any known issues with the `curl-cffi` workaround that might affect other services on Vega if the scope is not strictly enforced? ### Review limitations - I cannot run `nix flake check` or `just test` to validate the configuration. - I cannot verify the actual SOPS decryption or secret values. - I cannot confirm the live deployment status of the media1 Docker stack or the new native service. ### Diff coverage - `.sops.yaml`: **reviewed** — included in a context-limited batch - `README.md`: **reviewed** — included in a context-limited batch - `hosts/lyra/default.nix`: **reviewed** — included in a context-limited batch - `hosts/vega/default.nix`: **reviewed** — included in a context-limited batch - `modules/services/karakeep.nix`: **reviewed** — included in a context-limited batch - `secrets/README.md`: **reviewed** — included in a context-limited batch - `secrets/karakeep-server.yaml`: **reviewed** — included in a context-limited batch <details><summary>Review metadata</summary> - Reviewer: forgejo-ai-review v1 - Model: qwen3.6:35b-a3b-q8_0 - Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md - Commits considered: 11 - Previous automated review: updated - Findings: 1 </details>

nimmo added 1 commit

2026-08-21 23:40:45 +01:00

refactor: scope Karakeep curl-cffi workaround

AI pull-request review / review (pull_request) Successful in 1m15s

Details

Build and Push Attic Cache / test (pull_request) Successful in 1m38s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped