nimmo/nixos-config

Watch

Fork 0

feat(vega): docker-report (Trilium) sync + atticd alerts #231

Merged

nimmo merged 1 commit from feat/vega-docker-report into main

2026-09-19 08:30:40 +01:00

nimmo commented

2026-09-19 08:23:08 +01:00

Owner

Gives vega the same service coverage lyra already has.

Changes

Import modules/services/docker-report.nix on vega — its non-declarative /srv/stacks now document under the shared Trilium tree (option a: shared ETAPI token + parent note + stacks dir).
Vega added as a SOPS recipient of secrets/docker-report.yaml; the .sops.yaml creation rule for that secret is updated to include vega.
atticd added to the ntfy service-failure monitor on vega and lyra (atticd.nix doesn't self-register like jellyfin/immich/tdarr do).

Files

.sops.yaml, secrets/docker-report.yaml (re-encrypted to add vega), hosts/vega/default.nix, hosts/lyra/default.nix.

Validation

nix flake check — all 6 hosts
Vega is a recipient of secrets/docker-report.yaml (canonical .sops.yaml key)
App provisioned on vega (/srv/services/docker-report, 14 files, nimmo:users 755)
Vega canary: sudo nixos-rebuild test --flake .#vega (secret decrypts on vega; service + timer active)
First Trilium sync + no-op follow-up (live write)

Notes

First Trilium sync is a live write (Trilium notes + # TRILIUM METADATA injected into vega's /srv/stacks/*.yml). Vega is pull-only from main, so this goes live on vega via auto-update once merged.

Closes #230

Gives vega the same service coverage lyra already has. ## Changes - Import `modules/services/docker-report.nix` on vega — its non-declarative `/srv/stacks` now document under the shared Trilium tree (option a: shared ETAPI token + parent note + stacks dir). - Vega added as a SOPS recipient of `secrets/docker-report.yaml`; the `.sops.yaml` creation rule for that secret is updated to include vega. - `atticd` added to the ntfy service-failure monitor on vega and lyra (`atticd.nix` doesn't self-register like jellyfin/immich/tdarr do). ## Files `.sops.yaml`, `secrets/docker-report.yaml` (re-encrypted to add vega), `hosts/vega/default.nix`, `hosts/lyra/default.nix`. ## Validation - [x] `nix flake check` — all 6 hosts - [x] Vega is a recipient of `secrets/docker-report.yaml` (canonical `.sops.yaml` key) - [x] App provisioned on vega (`/srv/services/docker-report`, 14 files, `nimmo:users 755`) - [x] Vega canary: `sudo nixos-rebuild test --flake .#vega` (secret decrypts on vega; service + timer active) - [ ] First Trilium sync + no-op follow-up (live write) ## Notes - First Trilium sync is a **live write** (Trilium notes + `# TRILIUM METADATA` injected into vega's `/srv/stacks/*.yml`). Vega is pull-only from `main`, so this goes live on vega via auto-update once merged. Closes #230

nimmo added the

phase:deploy

host:lyra

host:vega

labels

2026-09-19 08:23:08 +01:00

nimmo added 1 commit

2026-09-19 08:23:09 +01:00

feat(vega): enable docker-report (Trilium) sync and atticd alerts

Build and Push Attic Cache / test (pull_request) Successful in 1m38s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped

Details

Build and Push Attic Cache / notify-remediation (pull_request) Has been skipped

Details

Build and Push Attic Cache / record-remediation-notify-failure (pull_request) Has been skipped

Details

AI pull-request review / review (pull_request) Successful in 2m15s

Details

765f6cb329

Vega now matches lyra's service coverage:

- docker-report: import the Trilium stacks-sync service so vega's
  non-declarative /srv/stacks are documented under the shared Trilium
  tree. Vega is added as a SOPS recipient of secrets/docker-report.yaml
  (shared ETAPI token, parent note, and stacks dir) and the .sops.yaml
  creation rule for that secret is updated to include vega.
- Monitoring: add atticd to the ntfy service-failure monitor on both
  vega and lyra. Unlike most service modules (jellyfin, immich, tdarr,
  redview, ...), atticd.nix does not self-register.

nimmo commented

2026-09-19 08:25:26 +01:00

Author

Owner

Automated code review

Reviewed commit: 765f6cb329e9ba5701c11ee7931d178f5471aeb9

Verdict: Ready to merge

No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory.

Overall assessment

The PR adds the docker-report service to vega and includes atticd in the service failure monitor on both vega and lyra. It also updates SOPS configuration to allow vega to decrypt the shared docker-report.yaml secret.

Blocking findings

None.

Important findings

None.

Suggestions

SOPS Recipient Order Consistency (.sops.yaml:90; medium confidence)
The diff shows *vega added before *lyra. The existing order was lyra, yubikey-nano5c, etc. Other secrets might have different orders.
Impact: While functionally equivalent for decryption, inconsistent ordering of SOPS recipients can make diffs noisier and harder to review in the future. It may also imply a priority or ownership hierarchy that isn't intended.
Suggested fix: Consider if vega should be placed after lyra to maintain alphabetical or logical consistency with other secrets, or if the current order is intentional. Ensure this pattern is documented or consistent across .sops.yaml.

Tests and validation

No configured deterministic checks.

Questions

Is the order of SOPS recipients in .sops.yaml intentional, or should it be standardized across all secrets?

Review limitations

I cannot run nix flake check or nixos-rebuild test to verify the configuration.
I cannot access the live Trilium instance to verify the sync behavior.
I cannot verify the actual content of secrets/docker-report.yaml beyond the SOPS metadata.

Diff coverage

.sops.yaml: reviewed — included in a context-limited batch
hosts/lyra/default.nix: reviewed — included in a context-limited batch
hosts/vega/default.nix: reviewed — included in a context-limited batch
secrets/docker-report.yaml: reviewed — included in a context-limited batch

Review metadata

Reviewer: forgejo-ai-review v1
Model: qwen3.6:35b-a3b-q8_0
Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, docs/auto-update-remediation.md, README.md
Commits considered: 1
Previous automated review: none found
Findings: 1

## Automated code review Reviewed commit: `765f6cb329e9ba5701c11ee7931d178f5471aeb9` ## Verdict: Ready to merge No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory. ### Overall assessment The PR adds the `docker-report` service to vega and includes `atticd` in the service failure monitor on both vega and lyra. It also updates SOPS configuration to allow vega to decrypt the shared `docker-report.yaml` secret. ### Blocking findings None. ### Important findings None. ### Suggestions - **SOPS Recipient Order Consistency** (.sops.yaml:90; medium confidence) The diff shows `*vega` added before `*lyra`. The existing order was `lyra`, `yubikey-nano5c`, etc. Other secrets might have different orders. Impact: While functionally equivalent for decryption, inconsistent ordering of SOPS recipients can make diffs noisier and harder to review in the future. It may also imply a priority or ownership hierarchy that isn't intended. Suggested fix: Consider if `vega` should be placed after `lyra` to maintain alphabetical or logical consistency with other secrets, or if the current order is intentional. Ensure this pattern is documented or consistent across `.sops.yaml`. ### Tests and validation - No configured deterministic checks. ### Questions - Is the order of SOPS recipients in `.sops.yaml` intentional, or should it be standardized across all secrets? ### Review limitations - I cannot run `nix flake check` or `nixos-rebuild test` to verify the configuration. - I cannot access the live Trilium instance to verify the sync behavior. - I cannot verify the actual content of `secrets/docker-report.yaml` beyond the SOPS metadata. ### Diff coverage - `.sops.yaml`: **reviewed** — included in a context-limited batch - `hosts/lyra/default.nix`: **reviewed** — included in a context-limited batch - `hosts/vega/default.nix`: **reviewed** — included in a context-limited batch - `secrets/docker-report.yaml`: **reviewed** — included in a context-limited batch <details><summary>Review metadata</summary> - Reviewer: forgejo-ai-review v1 - Model: qwen3.6:35b-a3b-q8_0 - Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, docs/auto-update-remediation.md, README.md - Commits considered: 1 - Previous automated review: none found - Findings: 1 </details>

nimmo merged commit efad725691 into main

2026-09-19 08:30:40 +01:00

nimmo deleted branch feat/vega-docker-report

2026-09-19 08:30:42 +01:00

nimmo referenced this pull request from a commit

2026-09-19 08:30:42 +01:00

Merge pull request 'feat(vega): docker-report (Trilium) sync + atticd alerts' (#231) from feat/vega-docker-report into main