feat: add Nebula-only Trilium web clients

nimmo commented

2026-07-26 18:25:22 +01:00

Owner

Summary

add a reusable trilium-web NixOS module for Nebula-only services.trilium-server
enable it from the shared AI desktop profile so electra, lena, vega, and lyra all get a local Trilium web client
seed sync to https://notes.nimmog.uk and support first-run bootstrap from the SOPS-backed trilium/sync-password
document the service port, secret flow, and Nebula-only access model

Validation

nix flake check
manual just test on electra
confirmed Trilium sync working on electra

Remaining Live Evidence

other affected hosts (lena, vega, lyra) still need rollout/verification as appropriate
issue #97 should stay open until the multi-host deployment evidence is complete

Refs #97

## Summary - add a reusable `trilium-web` NixOS module for Nebula-only `services.trilium-server` - enable it from the shared AI desktop profile so `electra`, `lena`, `vega`, and `lyra` all get a local Trilium web client - seed sync to `https://notes.nimmog.uk` and support first-run bootstrap from the SOPS-backed `trilium/sync-password` - document the service port, secret flow, and Nebula-only access model ## Validation - `nix flake check` - manual `just test` on `electra` - confirmed Trilium sync working on `electra` ## Remaining Live Evidence - other affected hosts (`lena`, `vega`, `lyra`) still need rollout/verification as appropriate - issue #97 should stay open until the multi-host deployment evidence is complete Refs #97

nimmo added 1 commit

2026-07-26 18:25:23 +01:00

feat: add Nebula-only Trilium web clients

Build and Push Attic Cache / test (pull_request) Successful in 38s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

AI pull-request review / review (pull_request) Successful in 4m46s

Details

90515dfac1

Refs #97

nimmo commented

2026-07-26 18:30:10 +01:00

Author

Owner

Automated code review

Reviewed commit: 90515dfac1cd41b7417242b4e079763479ac9a54

Verdict: Ready to merge

No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory.

Overall assessment

The PR introduces a NixOS module for Nebula-only Trilium web clients, integrates it into the AI desktop profile, adds SOPS-backed first-run bootstrap secrets, and updates documentation. Static analysis confirms correct assertion guards and service ordering. Two operational suggestions remain regarding firewall interface naming and bootstrap retry behavior.

Blocking findings

None.

Important findings

None.

Suggestions

Nebula firewall interface name must match system configuration exactly (modules/services/trilium-web.nix:145; high confidence)
networking.firewall.interfaces."nebula.mesh".allowedTCPPorts = [ cfg.port ];
Impact: If the actual Nebula overlay interface is named differently (e.g., 'nebula' or a custom alias), this firewall rule will be silently ignored, potentially exposing the service to unintended networks.
Suggested fix: Verify the exact interface name via ip link or Nebula's configuration and update the string literal accordingly.
Bootstrap service retry behavior on persistent failure (modules/services/trilium-web.nix:108; medium confidence)
for _ in $(seq 1 30); do
if status_json="$(${pkgs.curl}/bin/curl --fail --silent --show-error "$api_base/api/setup/status")"; then
break
fi
sleep 1;
done
Impact: If the remote sync server remains unreachable during bootstrap, the oneshot service will exhaust its 30-second window and fail on each subsequent boot until connectivity is restored, generating repeated log noise.
Suggested fix: Consider adding a systemd ConditionPathExists=!/var/lib/trilium/.trilium/config.json or similar marker to skip execution entirely after a successful bootstrap, though the current API-based .isInitialized check mitigates re-runs once initialized.

Tests and validation

No configured deterministic checks.

Questions

Has rollout verification been completed for lena, vega, and lyra as noted in the PR description?
Does the Nebula overlay interface on these hosts use the exact name 'nebula.mesh', or should the firewall rule reference a different interface alias?

Review limitations

Static analysis only; cannot execute nix flake check or validate SOPS decryption/runtime behavior.
Assumes external flake inputs (trilium-next) and Nebula module options are correctly defined in the repository context.
Does not verify actual sync functionality or host-specific hardware compatibility beyond configuration syntax.

Diff coverage

README.md: reviewed — included in a context-limited batch
modules/common/base.nix: reviewed — included in a context-limited batch
modules/profiles/ai-desktop.nix: reviewed — included in a context-limited batch
modules/services/trilium-web.nix: reviewed — included in a context-limited batch
secrets/README.md: reviewed — included in a context-limited batch
secrets/trilium.yaml: reviewed — included in a context-limited batch

Review metadata

Reviewer: forgejo-ai-review v1
Model: qwen3.6:35b-a3b-q8_0
Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md
Commits considered: 1
Previous automated review: none found
Findings: 2

## Automated code review Reviewed commit: `90515dfac1cd41b7417242b4e079763479ac9a54` ## Verdict: Ready to merge No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory. ### Overall assessment The PR introduces a NixOS module for Nebula-only Trilium web clients, integrates it into the AI desktop profile, adds SOPS-backed first-run bootstrap secrets, and updates documentation. Static analysis confirms correct assertion guards and service ordering. Two operational suggestions remain regarding firewall interface naming and bootstrap retry behavior. ### Blocking findings None. ### Important findings None. ### Suggestions - **Nebula firewall interface name must match system configuration exactly** (modules/services/trilium-web.nix:145; high confidence) networking.firewall.interfaces."nebula.mesh".allowedTCPPorts = [ cfg.port ]; Impact: If the actual Nebula overlay interface is named differently (e.g., 'nebula' or a custom alias), this firewall rule will be silently ignored, potentially exposing the service to unintended networks. Suggested fix: Verify the exact interface name via `ip link` or Nebula's configuration and update the string literal accordingly. - **Bootstrap service retry behavior on persistent failure** (modules/services/trilium-web.nix:108; medium confidence) for _ in $(seq 1 30); do if status_json="$(${pkgs.curl}/bin/curl --fail --silent --show-error "$api_base/api/setup/status")"; then break fi sleep 1; done Impact: If the remote sync server remains unreachable during bootstrap, the oneshot service will exhaust its 30-second window and fail on each subsequent boot until connectivity is restored, generating repeated log noise. Suggested fix: Consider adding a systemd ConditionPathExists=!/var/lib/trilium/.trilium/config.json or similar marker to skip execution entirely after a successful bootstrap, though the current API-based .isInitialized check mitigates re-runs once initialized. ### Tests and validation - No configured deterministic checks. ### Questions - Has rollout verification been completed for lena, vega, and lyra as noted in the PR description? - Does the Nebula overlay interface on these hosts use the exact name 'nebula.mesh', or should the firewall rule reference a different interface alias? ### Review limitations - Static analysis only; cannot execute `nix flake check` or validate SOPS decryption/runtime behavior. - Assumes external flake inputs (trilium-next) and Nebula module options are correctly defined in the repository context. - Does not verify actual sync functionality or host-specific hardware compatibility beyond configuration syntax. ### Diff coverage - `README.md`: **reviewed** — included in a context-limited batch - `modules/common/base.nix`: **reviewed** — included in a context-limited batch - `modules/profiles/ai-desktop.nix`: **reviewed** — included in a context-limited batch - `modules/services/trilium-web.nix`: **reviewed** — included in a context-limited batch - `secrets/README.md`: **reviewed** — included in a context-limited batch - `secrets/trilium.yaml`: **reviewed** — included in a context-limited batch <details><summary>Review metadata</summary> - Reviewer: forgejo-ai-review v1 - Model: qwen3.6:35b-a3b-q8_0 - Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md - Commits considered: 1 - Previous automated review: none found - Findings: 2 </details>

nimmo merged commit 10dfd5a21a into main

2026-07-26 18:37:34 +01:00

nimmo deleted branch trilium-web-nebula-sync

2026-07-26 18:37:35 +01:00

nimmo referenced this pull request from a commit

2026-07-26 18:37:36 +01:00

Merge pull request 'feat: add Nebula-only Trilium web clients' (#98) from trilium-web-nebula-sync into main