Fix influxdb-token encryption (was empty) ...

Re-encrypted with rage directly instead of agenix EDITOR flow
which silently produced an empty ciphertext.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Update influxdb-token for skydick InfluxDB instance ...

Token now authenticates against the local InfluxDB on skydick
instead of the old door1 instance.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Add InfluxDB v2 on skydick for fleet monitoring ...

- New modules/influxdb.nix: declarative InfluxDB v2 with ZFS-backed
  storage (dick/system/influxdb, bind-mounted to /var/lib/influxdb2)
- monitoring.nix: make influxUrl configurable (default: skydick)
- skydick/default.nix: enable influxdb, point telegraf to localhost
- datapool.nix: document influxdb dataset in hierarchy + creation cmds

Consolidates all monitoring data (door1 + skydick + IoT sensors) into
a single InfluxDB on the ZFS storage server for infinite retention.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

seems only mtu 1280 works for rdp

修复MSS

fix xlab-gateway host key in secrets.nix and rekey ...

The active host key on xlab-gateway is the original one
(AAAAII+EKDpU...), not the replacement. Corrected and rekeyed.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

add ylw ed25519 key: agenix access, SSH auth, rekey all secrets ...

- Add ylw's ed25519 public key to secrets.nix admins list
- Re-encrypt all .age secrets so ylw can decrypt
- Add ed25519 key to ye-lw21 authorized SSH keys

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

harden and fix: nftables input chain, sudo, agenix, ZFS, NAT priority ...

- Add inet input_filter table to xlab-gateway (policy drop on WAN)
- Restrict NOPASSWD sudo to ldx only; ylw uses password sudo via wheel
- Restructure secrets.nix with admins list, prepare for ylw ed25519 key
- Add ye-lw21 to trusted-users in common.nix
- Remove contradictory relatime=on when atime=off on rpool
- Fix NAT postrouting priority: filter → srcnat
- Remove duplicate nixpkgs.hostPlatform from xlab-gateway hardware-configuration

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

skydick: document drive10 added as second hot spare ...

sg_format completed on drive10 (c9bcfa0f). Both LUNs added as spares,
bringing the pool to 8 mirrors + 2 hot spares (4 spare LUNs total).

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

clamp mss to pmtu fix v6

skydick: document pool expansion to 8 mirrors (~50.9T) ...

Added 4 new SAS Mach2 drives (drive6-9) as 4 mirror vdevs. Updated
drive inventory, layout diagram, expansion commands, and runbook
with sg_format/wipefs steps. drive10 pending sg_format completion.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Update networking.nix

Update networking.nix

add route from subnet to phicomm mgmt

王八蛋bitlocker解密升级版

fix gateway itself to .1

change xlab pubkey

Update default.nix

Update default.nix

agenix?

Update dhcp.nix

Update dhcp.nix

fix syntax error

make sure DHCP start after interface initialization

skydick: fix localsearch, I/O schedulers, wait-online, NIC tuning ...

- Replace broken localsearch oneshot with proper miner daemon running as
  ldx on ldx's session bus (lingering enabled) so Samba Spotlight queries
  from macOS clients actually work
- Fix systemd-networkd-wait-online 2-min boot timeout (anyInterface=true)
- Add storage-tuning service to enforce mq-deadline on SAS HDDs and
  increase Mellanox ring buffers (1024→4096) at boot
- Simplify udev I/O scheduler rules to match by rotational attribute
  instead of hardcoded kernel device names
- Update TM dataset recordsize comments to reflect 1M (applied on pool)
- Fix deprecated linuxPackages_6_6.perf → perf

ZFS properties applied separately on skydick:
  com.sun:auto-snapshot=true on dick (was unset — no snapshots taken)
  com.sun:auto-snapshot=false on dick/users/ldx/timemachine
  recordsize=1M on dick/users/ldx/timemachine

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: drop fruit:time machine max size (buggy bandsize parser) ...

Samba's fruit_get_bandsize() regex-based plist parser fails on valid
Info.plist files. Rely on ZFS refquota on dick/users/ldx instead.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: upgrade to nixos-25.11, add Spotlight + recycle bin ...

- Upgrade nixpkgs from nixos-24.11 to nixos-25.11 (Samba 4.20→4.22)
- Build sambaFull with Spotlight/tracker support via overlay:
  - Patch waf to detect tracker-sparql-3.0 (upstream only checks ≤2.0)
  - Patch rpcd_mdssvc for tinysparql 3.x bus API rename
    (get_async/get_finish → bus_new_async/bus_new_finish)
  - Disable tevent_glib_tracker test (uses removed tracker 2.x API, test-only)
  - Add icu for Unicode normalisation required by Spotlight
- Add Spotlight search with tracker backend for Finder search over SMB
- Add localsearch indexer service for public, media, and ldx files
- Add recycle bin (vfs recycle) for public/homes shares
- Add global fruit VFS for Apple compatibility
- Move fruit:model=TimeCapsule to ldx-timemachine share only
- Disable Spotlight on timemachine share
- Fix package renames for 25.11: targetcli→targetcli-fb, dstat→dool

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: bump TM max size to 3T for three Macs ...

1T was too tight — 579G already used across 3 sparsebundles left only
~450G visible to macOS. 3T leaves headroom for growth while keeping 7T
of the 10T ldx quota available for other datasets.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: rename TM share to ldx-timemachine ...

Per-user naming makes ownership unambiguous. The share points to ldx's
dedicated timemachine ZFS dataset, not a shared location.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: add Samba Time Machine share for macOS backups ...

Exposes dick/users/ldx/timemachine as an SMB share with Apple fruit VFS
extensions (fruit:time machine = yes) so Macs can back up directly to
skydick instead of door1. Capped at 1T via fruit:time machine max size.

Co-Authored-By: Claude Opus 4.6 <[email protected]>