nimmo/nixos-config

Watch

Fork 0

feat(nebula): cut over service endpoints to mesh #203

Merged

nimmo merged 4 commits from feat/issue-23-nebula-service-cutover into main

2026-09-08 10:23:44 +01:00

nimmo commented

2026-09-08 08:14:37 +01:00

Owner

Related to #23.

Summary

Route Synology NFS and Backrest endpoints through mass-storage.mesh.
Route the Engram Cloud client default through vega.mesh.
Make mesh-backed NFS mounts wait for Nebula before mounting.

The Desktop Ollama LAN endpoint and Vega lighthouse LAN bootstrap entry remain intentionally unchanged: the Desktop does not join Nebula, and the bootstrap mapping is LAN-only by design.

Validation

nix fmt
Evaluated Vega, Lyra, Chaos, and Lena NixOS configurations.
Confirmed evaluated Vega and Chaos mount options require and start after nebula@mesh.service.
From Vega, confirmed mass-storage.mesh is reachable and TCP ports 2049 (NFS) and 8008 (Backrest) are open.

Remaining evidence

A deployment and no-op follow-up on an affected host are still required before closing #23.

Related to #23. ## Summary - Route Synology NFS and Backrest endpoints through `mass-storage.mesh`. - Route the Engram Cloud client default through `vega.mesh`. - Make mesh-backed NFS mounts wait for Nebula before mounting. The Desktop Ollama LAN endpoint and Vega lighthouse LAN bootstrap entry remain intentionally unchanged: the Desktop does not join Nebula, and the bootstrap mapping is LAN-only by design. ## Validation - `nix fmt` - Evaluated Vega, Lyra, Chaos, and Lena NixOS configurations. - Confirmed evaluated Vega and Chaos mount options require and start after `nebula@mesh.service`. - From Vega, confirmed `mass-storage.mesh` is reachable and TCP ports 2049 (NFS) and 8008 (Backrest) are open. ## Remaining evidence A deployment and no-op follow-up on an affected host are still required before closing #23.

nimmo added this to the Nebula Mesh Network milestone

2026-09-08 08:14:37 +01:00

nimmo added the

project:nebula-mesh-network

host:fleet

labels

2026-09-08 08:14:38 +01:00

nimmo added 1 commit

2026-09-08 08:14:39 +01:00

feat(nebula): cut over service endpoints to mesh

AI pull-request review / review (pull_request) Successful in 1m25s

Details

Build and Push Attic Cache / test (pull_request) Successful in 1m37s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped

Details

Build and Push Attic Cache / notify-remediation (pull_request) Has been skipped

Details

Build and Push Attic Cache / record-remediation-notify-failure (pull_request) Has been skipped

Details

e5a264b2a4

nimmo commented

2026-09-08 08:16:05 +01:00

Author

Owner

Automated code review

Reviewed commit: 3ebae8c4d38a8de4105c4ef6f7f552500c83de1a

Verdict: Ready to merge

No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory.

Overall assessment

The pull request migrates Synology NFS and Backrest endpoints from LAN IPs to Nebula mesh addresses across multiple service modules. It introduces a standardized nebulaEnabled predicate in mount modules to conditionally enforce systemd dependencies on the Nebula service, ensuring mounts wait for the mesh network. An assertion is added to the Engram Cloud client profile to prevent silent failures when using the mesh default without Nebula enabled. The changes are scoped correctly and validated against multiple hosts.

Blocking findings

None.

Important findings

None.

Suggestions

Document the Engram Cloud non-mesh escape hatch (modules/services/engram-cloud.nix:30; medium confidence)
The diff shows serverUrl default changed to http://vega.mesh:18080. The assertion in ai-agents.nix allows an explicit non-mesh URL. The human reply mentions adding a comment explaining this escape hatch.
Impact: Future maintainers might not immediately understand why the default is mesh-only or how to override it for non-Nebula hosts (like Electra, which uses an overlay).
Suggested fix: Add a descriptive comment in modules/services/engram-cloud.nix next to the serverUrl option explaining that the default requires Nebula and that an explicit URL is required for non-mesh deployments.

Tests and validation

No configured deterministic checks.

Questions

Does the atticd module's NFS mount (/srv/attic/storage) require the same Nebula dependency logic as the other mounts? The diff shows it does, but is Attic accessed by hosts that might not be on Nebula (e.g., via LAN fallback)?

Review limitations

I cannot run nix flake check or just test to verify the evaluation and deployment success claims.
I cannot verify the reachability of mass-storage.mesh or vega.mesh from the specified hosts.
The review is based on the provided diff; if the 'standardization' mentioned in the human replies was done via a separate commit not included in this diff, I am reviewing the state as presented.

Diff coverage

hosts/lyra/default.nix: reviewed — included in a context-limited batch
hosts/vega/default.nix: reviewed — included in a context-limited batch
modules/containers/slskd.nix: reviewed — included in a context-limited batch
modules/profiles/ai-agents.nix: reviewed — included in a context-limited batch
modules/services/appdata.nix: reviewed — included in a context-limited batch
modules/services/atticd.nix: reviewed — included in a context-limited batch
modules/services/backrest.nix: reviewed — included in a context-limited batch
modules/services/engram-cloud.nix: reviewed — included in a context-limited batch
modules/services/media-library.nix: reviewed — included in a context-limited batch
modules/services/redview.nix: reviewed — included in a context-limited batch
modules/services/sabnzbd.nix: reviewed — included in a context-limited batch
modules/services/tdarr.nix: reviewed — included in a context-limited batch

Review metadata

Reviewer: forgejo-ai-review v1
Model: qwen3.6:35b-a3b-q8_0
Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md
Commits considered: 4
Previous automated review: updated
Findings: 1

## Automated code review Reviewed commit: `3ebae8c4d38a8de4105c4ef6f7f552500c83de1a` ## Verdict: Ready to merge No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory. ### Overall assessment The pull request migrates Synology NFS and Backrest endpoints from LAN IPs to Nebula mesh addresses across multiple service modules. It introduces a standardized `nebulaEnabled` predicate in mount modules to conditionally enforce systemd dependencies on the Nebula service, ensuring mounts wait for the mesh network. An assertion is added to the Engram Cloud client profile to prevent silent failures when using the mesh default without Nebula enabled. The changes are scoped correctly and validated against multiple hosts. ### Blocking findings None. ### Important findings None. ### Suggestions - **Document the Engram Cloud non-mesh escape hatch** (modules/services/engram-cloud.nix:30; medium confidence) The diff shows `serverUrl` default changed to `http://vega.mesh:18080`. The assertion in `ai-agents.nix` allows an explicit non-mesh URL. The human reply mentions adding a comment explaining this escape hatch. Impact: Future maintainers might not immediately understand why the default is mesh-only or how to override it for non-Nebula hosts (like Electra, which uses an overlay). Suggested fix: Add a descriptive comment in `modules/services/engram-cloud.nix` next to the `serverUrl` option explaining that the default requires Nebula and that an explicit URL is required for non-mesh deployments. ### Tests and validation - No configured deterministic checks. ### Questions - Does the `atticd` module's NFS mount (`/srv/attic/storage`) require the same Nebula dependency logic as the other mounts? The diff shows it does, but is Attic accessed by hosts that might not be on Nebula (e.g., via LAN fallback)? ### Review limitations - I cannot run `nix flake check` or `just test` to verify the evaluation and deployment success claims. - I cannot verify the reachability of `mass-storage.mesh` or `vega.mesh` from the specified hosts. - The review is based on the provided diff; if the 'standardization' mentioned in the human replies was done via a separate commit not included in this diff, I am reviewing the state as presented. ### Diff coverage - `hosts/lyra/default.nix`: **reviewed** — included in a context-limited batch - `hosts/vega/default.nix`: **reviewed** — included in a context-limited batch - `modules/containers/slskd.nix`: **reviewed** — included in a context-limited batch - `modules/profiles/ai-agents.nix`: **reviewed** — included in a context-limited batch - `modules/services/appdata.nix`: **reviewed** — included in a context-limited batch - `modules/services/atticd.nix`: **reviewed** — included in a context-limited batch - `modules/services/backrest.nix`: **reviewed** — included in a context-limited batch - `modules/services/engram-cloud.nix`: **reviewed** — included in a context-limited batch - `modules/services/media-library.nix`: **reviewed** — included in a context-limited batch - `modules/services/redview.nix`: **reviewed** — included in a context-limited batch - `modules/services/sabnzbd.nix`: **reviewed** — included in a context-limited batch - `modules/services/tdarr.nix`: **reviewed** — included in a context-limited batch <details><summary>Review metadata</summary> - Reviewer: forgejo-ai-review v1 - Model: qwen3.6:35b-a3b-q8_0 - Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md - Commits considered: 4 - Previous automated review: updated - Findings: 1 </details>

nimmo commented

2026-09-08 08:23:49 +01:00

Author

Owner

Thanks for the review.

The mount dependency is intentional: a mass-storage.mesh NFS source has no usable route without Nebula, so Requires= prevents a failed early mount and unavailable dependent services. All current consumers evaluate with nixosConfig.nebula.enable = true (Vega, Lyra, and Chaos), and Lena also enables Nebula for its Engram client default.

I am taking the valid consistency suggestion: I will standardize the Nebula-enabled predicate across the mount modules, with no change to the intentional dependency semantics.

Thanks for the review. The mount dependency is intentional: a `mass-storage.mesh` NFS source has no usable route without Nebula, so `Requires=` prevents a failed early mount and unavailable dependent services. All current consumers evaluate with `nixosConfig.nebula.enable = true` (Vega, Lyra, and Chaos), and Lena also enables Nebula for its Engram client default. I am taking the valid consistency suggestion: I will standardize the Nebula-enabled predicate across the mount modules, with no change to the intentional dependency semantics.

nimmo added 1 commit

2026-09-08 08:26:12 +01:00

refactor(nebula): standardize mount dependency checks

Build and Push Attic Cache / test (pull_request) Successful in 1m33s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped

Details

Build and Push Attic Cache / notify-remediation (pull_request) Has been skipped

Details

Build and Push Attic Cache / record-remediation-notify-failure (pull_request) Has been skipped

Details

AI pull-request review / review (pull_request) Successful in 1m12s

Details

902c2e1e77

nimmo commented

2026-09-08 08:31:11 +01:00

Author

Owner

Follow-up completed in 902c2e1 (refactor(nebula): standardize mount dependency checks). The four mount modules now use the same local nebulaEnabled predicate; Vega, Lyra, Chaos, and Lena re-evaluate successfully, and the deterministic CI test passed.

The subsequent AI-review workflow reported failure but posted no new review comment. Its job details cannot be fetched with the available Forgejo CLI because the server returns an incompatible jobs-response schema, so there is no additional actionable feedback to implement.

Follow-up completed in `902c2e1` (`refactor(nebula): standardize mount dependency checks`). The four mount modules now use the same local `nebulaEnabled` predicate; Vega, Lyra, Chaos, and Lena re-evaluate successfully, and the deterministic CI test passed. The subsequent AI-review workflow reported failure but posted no new review comment. Its job details cannot be fetched with the available Forgejo CLI because the server returns an incompatible jobs-response schema, so there is no additional actionable feedback to implement.

nimmo commented

2026-09-08 10:13:06 +01:00

Author

Owner

I will add an assertion so any future host using the vega.mesh default must enable Nebula, while retaining an explicit non-mesh URL override for exceptional deployments.

The rerun’s remaining finding is valid as a future-safety concern. Current autosync consumers are covered: Lena enables Nebula and uses the new default; Electra enables Nebula and explicitly uses Vega’s overlay URL. I will add an assertion so any future host using the `vega.mesh` default must enable Nebula, while retaining an explicit non-mesh URL override for exceptional deployments.

nimmo added 1 commit

2026-09-08 10:15:56 +01:00

fix(engram): require mesh for default autosync URL

AI pull-request review / review (pull_request) Successful in 1m11s

Details

Build and Push Attic Cache / test (pull_request) Successful in 2m4s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped

Details

Build and Push Attic Cache / notify-remediation (pull_request) Has been skipped

Details

Build and Push Attic Cache / record-remediation-notify-failure (pull_request) Has been skipped

Details

a7d3b36b28

nimmo commented

2026-09-08 10:16:06 +01:00

Author

Owner

Implemented in a7d3b36 (fix(engram): require mesh for default autosync URL). Autosync may use http://vega.mesh:18080 only with Nebula enabled; an explicit non-mesh serverUrl remains supported for exceptional deployments. Vega, Electra, and Lena configurations evaluate successfully.

Implemented in `a7d3b36` (`fix(engram): require mesh for default autosync URL`). Autosync may use `http://vega.mesh:18080` only with Nebula enabled; an explicit non-mesh `serverUrl` remains supported for exceptional deployments. Vega, Electra, and Lena configurations evaluate successfully.

nimmo commented

2026-09-08 10:18:51 +01:00

Author

Owner

Follow-up assessment:

docker-slskd.service already has requires = [ "srv-media.mount" ] and after = [ "srv-media.mount" ] in modules/containers/slskd.nix, so its container cannot start before the NFS mount is active. No change is needed there.
The remaining LAN-address inventory is limited to the intentional Vega lighthouse bootstrap address and the non-Nebula Desktop Ollama endpoint; all Synology and Engram service consumers in scope were converted.
I will add the requested code comment explaining that an explicit non-mesh Engram URL is the deliberate escape hatch.

Follow-up assessment: - `docker-slskd.service` already has `requires = [ "srv-media.mount" ]` and `after = [ "srv-media.mount" ]` in `modules/containers/slskd.nix`, so its container cannot start before the NFS mount is active. No change is needed there. - The remaining LAN-address inventory is limited to the intentional Vega lighthouse bootstrap address and the non-Nebula Desktop Ollama endpoint; all Synology and Engram service consumers in scope were converted. - I will add the requested code comment explaining that an explicit non-mesh Engram URL is the deliberate escape hatch.

nimmo added 1 commit

2026-09-08 10:19:57 +01:00

docs(engram): explain non-mesh autosync override

AI pull-request review / review (pull_request) Successful in 1m7s

Details

Build and Push Attic Cache / test (pull_request) Successful in 1m27s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped