201aea3e87
Three stub READMEs from the review notes now have real content: a
per-file service table for pinix and blunix localServices, and a
users overview (drone vs builder, and why the docker group is dead
weight on both -- docker.nix is commented out globally).
blunix's seven traefik-*.nix files (routes, per-service dynamic
config) moved into a traefik/ subfolder per the review's org
suggestion -- pure rename, no relative-path references between them,
confirmed by a bit-identical rebuild (same output store path before
and after). No deploy needed for this part.
Also: added the tailscaled-autoconnect boot-race fix from 5df6166 to
calendar/README.md (was undocumented there) and removed the two
now-answered "why does this file exist" / "needs updating" review
notes from WEBDAV-SMB.md and calendar/README.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
19 lines
980 B
Markdown
19 lines
980 B
Markdown
# Users
|
|
|
|
Two declarative user accounts, shared across hosts via
|
|
`hosts/globalServices/default.nix`'s `mkVariableModules`/import wiring:
|
|
|
|
- **`drone`** (`drone.nix`) — the account this whole platform actually
|
|
runs as: the admin `tmux` session on blunix, the agent-codex services,
|
|
pinix's recovery checkout. `bash` shell.
|
|
- **`builder`** (`builder.nix`) — a separate human-facing account, `zsh`
|
|
shell, with its own home-manager profile wired up only on `tnix`
|
|
(`home/tnix/builder.nix`). Not the same thing as the Builder *role* in
|
|
`agent-codex` — that runs as `drone` (see
|
|
`hosts/blunix/localServices/agent-codex.nix`, `User = "drone"`).
|
|
|
|
Both carry the same set of authorized SSH keys (personal devices: iPad,
|
|
iPhone, tnix, blunix/pinix host keys) and both are in `wheel` + `docker`
|
|
— `docker` is currently dead weight on every host: `docker.nix` in
|
|
`hosts/globalServices/` is commented out, so no Docker daemon actually
|
|
runs anywhere these groups take effect.
|