In-flight work#
Verified against the repository and GitHub on 2026-09-02. This register
lets a successor tell “deployed but unmerged” from “merged but never run” from
“known and deliberately left alone”. The public status page
(status.falseblue.com) is uptime, not this.
Rules: one row per item. When an item finishes, delete its row in the same PR.
When you park something, add a row. Facts only the owner can confirm are
TODO(owner).
Open pull requests#
| PR | Title | Branch | Opened | State / next action | Decision needed |
|---|---|---|---|---|---|
| #289 | chore(flake): update inputs | automation/flake-update |
2026-09-02 | The Sep-1 scheduled bump, re-run by hand after the force-with-lease fix. Merges automatically when om ci and the GitHub check are green. TODO(owner): a 2026-09-02 note says the GitHub check was red on a FlakeHub 401 (cache.flakehub.com) — confirm, and refresh the token if so. |
None if green |
| #230 | feat(ereshkigal): resilient MQTT broker, decoupled from HA Green | fix/mqtt-broker-resilience |
2026-07-16 (draft) | Written when the HA Green appliance was the only MQTT broker. The Green has since been retired and HA runs as a VM on ereshkigal. | Rebase and finish, or close as superseded |
| #172 | Implement VNC restricted to Tailscale interface | 39-vnc-tailscale-only |
2026-03-25 | Stale for five months. | Close or rebase |
Already merged (older notes said otherwise — do not redo):
chore/housekeeping-2026-08 landed as #274 (5ca12e11) and the remote
branch can be deleted; the worldsim stack (#283–#287) and re-OCR v2 (#225) are
merged.
Deployed to a host but not yet in release#
Fixes pushed with deploy-rs reach one host immediately; the other hosts get
them only when the next automation PR merges and release advances
(the three stages).
| Item | Commit(s) | On host | Next action |
|---|---|---|---|
ereshkigal nightly failures: gawk in the servarr-backup PATH (no backup archive 2026-08-22..09-01), auto-update glob-refspec fetch --prune, paperless→Open-WebUI sync retries, session-scope alert demotion |
7f071e88, 27990ca3, 05d5da7f, cf93ce60 |
ereshkigal | Nothing; converges with the next release |
om ci unit timeout raised 6 h → 12 h (haxo’s armv6l cross toolchain) |
00500e1a |
TODO(owner): deployed to ereshkigal? |
— |
Merged but not confirmed as run#
| Item | Where | How to check | Decision needed |
|---|---|---|---|
Jellyfin declarative provisioning (media.server.jellyfin.provision.enable = true, one-time refreshExistingMetadata) |
hosts/x86_64-nixos/ereshkigal/default.nix, modules/nixos/media/jellyfin.nix |
systemctl status jellyfin-provision on ereshkigal; Dashboard → Active Devices shows Transcode (hw) on the P400 for an ASS-subtitled title |
TODO(owner): confirm the timer has run and the back-catalog refresh completed |
Re-OCR v2 campaign (curate.visionModel = "richardyoung/olmocr2:7b-q8", M4-only) |
hosts/x86_64-nixos/ereshkigal/default.nix; runbook AI → Reprocessing |
/var/lib/paperless-curate/reocr-report.md on ereshkigal |
TODO(owner): has the 7-phase campaign been run? Tag hygiene and correspondent collapse need a human |
octopi committed fixes (PMF ieee80211w=0, wifi secret owner wpa_supplicant, clamav off) |
hosts/x86_64-nixos/octopi/default.nix |
nixos-version --configuration-revision on octopi; it was reflashed 2026-06-26 onto the nixos-raspberrypi layout |
TODO(owner): has octopi been switched since 2026-06-26? |
Known, deliberately parked#
| Item | State | Where it lives | Next action | Decision needed |
|---|---|---|---|---|
Catalina Mac minis (bedford-kitchen-macmini, bedford-office-macmini) |
Paused 2026-08-14: nixpkgs 26.11 dropped x86_64-darwin; entries commented out; still sops recipients with live borgmatic/* secrets |
hosts/default.nix (comment block), .sops.yaml, hosts/x86_64-darwin/*.nix |
Pin nixpkgs-26.05-darwin, or retire via the decommissioning runbook |
Owner |
commit.gpgSign = false |
Off since 2026-06-26: only the Nano 5C can sign; the 5C NFC’s OpenPGP pubkey was never imported | modules/users/tsunami/git.nix |
Re-enable when the Nano 5C is the daily key, or import the NFC’s pubkey (YubiKey recovery) | Owner |
ca.falseblue.com DNS flap |
Mitigated, not fixed: ACME renewals retry 3×/hour; the root cause (LAN A record → ereshkigal nginx without a ca vhost) remains |
modules/nixos/acme/default.nix; step-ca known issue |
Pin the name in networking.hosts and point ACME at :9443, or add the vhost, or drop the LAN record |
Pick one |
normaliseClass never resolves |
modules/flake/nix/default.nix reads self.easy-hosts.additionalClasses, which does not exist, so rpi hosts never get modules/flake/nix/nixos.nix; octopi works around it locally |
modules/flake/nix/default.nix, hosts/x86_64-nixos/octopi/default.nix |
Fix the lookup; rebuild octopi and haxo and confirm the rpi kernel still substitutes | Needs an octopi build |
tsunaminoai.spotify module |
Unusable: path = "/var/run/spotify/auth" (the /var/run sops taint breaks networking) and .value is not a sops-nix attribute. Enabled nowhere |
modules/nixos/media/spotify.nix |
Fix or delete before anyone enables it | Owner |
Three pki/db/recovery_files encrypted to a pruned age key |
private_keys.yaml, f9e6b4b8-….pfx, pve-ereshkigal….enc decrypt only to age1vtddaa… (the previous tsunami-mokou key); just sops-updatekeys aborts on them |
CA escrow | Decrypt with the old key if it still exists, re-key, rename to .sops; otherwise delete |
TODO(owner): does the old mokou age key survive in a backup? |
| haxo NixOS host | Config builds; the physical Haxophone is still a Pi Zero W 1.1 on Raspberry Pi OS | haxo | Zero 2 W swap, sops onboarding, host key, flash | Owner |
Stale sops recipient pways |
Host anchor with no hosts/default.nix entry |
.sops.yaml |
Remove it and run just sops-updatekeys once confirmed unused |
TODO(owner): what was pways? |
| Orphan secrets | attic/*, minio/*, media/*, myon/ssh-host-key have no consumer in the tree (myon’s age identity derives from its live host key) |
secrets.yaml |
sops unset after confirmation |
Owner |
| FlakeHub token expiry | ~90-day token | sops nix/flakehub-token; Accounts |
Rotate before expiry; run the acceptance curl | TODO(owner): exact date |
Deferred follow-ups (filed as issues 2026-09-03)#
Each needs a fleet build or an owner call; none is started. They came out of the 2026-09-02 maintainability audit and are tracked on GitHub:
- #294 chore(flake): remove unused inputs devshell, nix-index-db, nix-index-database, pre-commit-hooks
- #295 decision: Catalina Mac minis — pin nixpkgs-26.05-darwin or retire
- #296 security(ssh): remove modules/nixos/security/pubkeys/ishtar.pub
- #297 fix(flake): normaliseClass in modules/flake/nix/default.nix never resolves — rpi hosts miss nix/nixos.nix
- #298 refactor(modules): register laptop/ and deployment/ in modules/nixos/default.nix; add tsunaminoai.pki.enable guard
- #299 ci(format): wire shellcheck into treefmt
- #300 test(checks): shell-tools smoke check and paperless-rag tests
- #301 feat(docs): generated module → option → enabling-hosts index with a freshness check
- #302 refactor: split the remaining >1000-line files
- #303 docs(security): secrets.md inventory; delete orphan secrets; re-key pki recovery files
- #304 feat(llm-maint): raise num_ctx default to 32768 once VRAM is confirmed
- #305 chore(hosts): move hosts/x86_64-nixos/octopi to hosts/aarch64-nixos/octopi
- #306 fix(doc-pipeline): reconcile createNewTags with tags.tmpl; version the prompts
- #307 chore(users): converge the duplicated sudo timestamp_timeout FIXMEs
- #308 security(overlays): freerdp CVE-2026-31806 — whitelist with rationale or re-enable the override
- #309 ci: build host toplevels in CI or add
just affected-hosts <option> - #310 docs: packages.md and formatting.md pages; commit-msg convention hook
- #311 fix(nix): two tsunaminoai.nix option declarations cannot be evaluated
- #312 refactor(nix): every host closure depends on the whole source tree via nix.registry.self