Repository navigation
Upgrade to nixpkgs 26.11 and clean up follow-on issues - #19
Merged
Merged
Conversation
nixpkgs has caught up to home-manager at 26.11, so the release-check override and its self-removing warning are no longer needed. Bump the lock and remove the workaround together.
Capture the FluffyChat-not-found incident on argentite (Plasma 6.6.4): what was verified, what cache rebuild dance worked, and the open questions for the next occurrence.
Add the mdformat-gfm plugin so tables get column-padded rather than collapsed to minimum width. Existing tables across the docs tree are re-padded as a side effect.
Convert the hand-aligned plain-text list to a markdown table that mdformat-gfm pads automatically. Add role/hardware/notes columns mapping each ore-named host (argentite, cassiterite, malachite, scheelite) to its hardware; em-dash for rows that don't map to a host. Drop the stale `notes/ores.md` exclude from formatter-module — the file lives under `docs/reference/` and is properly formatted, so the exception is no longer needed.
The config is rendered into the nix store and symlinked into ~/.config/kitty, so it never changes in place — kitty has to be restarted to pick up a new generation anyway, making the runtime auto-reload redundant. Leaving it on also triggers kitty 0.47.0-0.47.1's __watch_conf__ bug where the watcher recursively walks subdirs and exhausts the inotify budget (~482k watches on a single kitty process here). Upstream issue #10102, fixed in 0.47.2.
PR nix-community/home-manager#9420 introduced set-SSH_AUTH_SOCK.service with Before=gpg-agent-ssh.socket on its [Unit] section. Combined with the service's implicit DefaultDependencies (After=basic.target, and basic.target After=sockets.target), this forms an ordering cycle: sockets.target -> gpg-agent-ssh.socket (socket's WantedBy=sockets.target) gpg-agent-ssh.socket After set-SSH_AUTH_SOCK.service (Before= on service) set-SSH_AUTH_SOCK.service After basic.target -> sockets.target (default deps) systemd resolves the cycle by deleting gpg-agent-ssh.socket/start, leaving the SSH agent socket unbound. gpg-agent serves no SSH keys and git over SSH fails with "Permission denied (publickey)" -- no pinentry prompt because there is no agent to prompt. Override Unit.Before to []. The cycle is created purely by that ordering edge, not by any activation relation -- set-SSH_AUTH_SOCK.service is pulled into the transaction independently via WantedBy=default.target, so dropping WantedBy=gpg-agent-ssh.socket from [Install] doesn't help (verified empirically on malachite before settling on Unit.Before). The service's only job is to push SSH_AUTH_SOCK into systemd-user and D-Bus environments; consumers run much later than either unit's activation, so removing the strict ordering is harmless. Add a warning that fires when home-manager-unstable is bumped off the rev #9432 was reported against, so the workaround gets reviewed on each input bump -- same pattern as the enableNixpkgsReleaseCheck workaround removed in 0ca745f. Hit on malachite after the home-manager bump in 0ca745f. Latent on argentite/cassiterite/scheelite -- their currently-running sessions started before the buggy unit was on disk, so the cycle hasn't been evaluated against the new graph yet. The next reboot on any of them would expose it. Tracking upstream at nix-community/home-manager#9432.
…whisparr}: order after postgres container The *arr services connect to their postgres instance at the container's veth address, which pg_hba.conf trusts as the only allowed /24. With no ordering dependency on the container, on concurrent startup the service could begin before the container's veth/route existed, connect via the default route (source IP 10.0.10.111), and hit a fatal `no pg_hba.conf entry` rejection that the *arr does not retry. Add `after` + `requires` on container@postgres-<name>.service, matching the existing stasharr service.
…s race Cold-boot reboot of scheelite surfaced a pre-existing race: the download-client reconcilers wait for the target *arr's API but not for qBittorrent's WebUI, so prowlarr-downloadclients (fires earliest, no media-mount dep) can push a qBittorrent client before qBittorrent's WebUI accepts connections — the *arr validation gets Connection refused and the unit fails. Low impact (updates an existing client) but a persistent failed unit after each boot that loses the race. Captured with root cause, timing evidence, and a proposed endpoint-poll fix.
test-vm declared fileSystems."/".device but no fsType. Under nixpkgs 26.11, ZFS's boot.zfs.enabled eagerly reads every filesystem's fsType while evaluating assertions, so the missing value throws "option fileSystems.\"/\".fsType was accessed but has no value defined" — which fails `nix flake check`'s evaluation of nixosConfigurations.test-vm (the hydraJobs build-skip path didn't surface it). Set fsType = "ext4" for the VM's legacy IDE root device.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
home.enableNixpkgsReleaseCheck = falseworkaround since nixpkgs caught up to home-manager.set-SSH_AUTH_SOCK.servicewithBefore=gpg-agent-ssh.socket, which forms an ordering cycle with the unit's default deps; systemd resolves it by droppinggpg-agent-ssh.socket, leaving the SSH agent unbound and git-over-SSH failing withPermission denied (publickey). OverrideUnit.Before = []. Hit on malachite after the bump; latent on the other hosts until their next reboot.sonarr,sonarr-anime,radarr,prowlarr, andwhisparrconnect to their postgres instance at the container's veth address, whichpg_hba.conftrusts as the only allowed /24. With no ordering dependency, concurrent startup let the service connect before the container's route existed — via the default route (wrong source IP) — and hit a fatal, non-retriedno pg_hba.conf entryrejection. Addafter+requiresoncontainer@postgres-<name>.service, matching the existing stasharr service.auto_reload_config = -1inhomeModules.programs.kittyto dodge kitty 0.47.0–0.47.1's__watch_conf__recursively watching subdirs and exhausting the inotify budget (upstream #10102, fixed in 0.47.2). The config is store-managed, so runtime auto-reload is redundant anyway.mdformat-gfmso markdown tables get column-padded instead of collapsed; rewritedocs/reference/ores.mdas a markdown table withrole/hardware/notescolumns mapping each ore-named host (argentite, cassiterite, malachite, scheelite).docs/plans/active/kde-plasma-sycoca-stale-cache-investigation.mdcapturing the FluffyChat-not-found Plasma sycoca incident on argentite (2026-05-10)..git-blame-ignore-revs: two new entries for the formatter rebaselines (treewide: nix fmt,formatter-module: enable mdformat-gfm).Test plan
nix build .#hydraJobs.systemConfigs.x86_64-linux.{argentite,cassiterite,malachite,scheelite,test-vm}cleannix build .#hydraJobs.homeConfigs.x86_64-linux.{argentite,cassiterite,malachite,scheelite}-djacucleannixos-rebuild switchon each host: activation completes withoutpersist-fileserrors. Hosts not yet migrated to impermanence-rollback need the runbook atdocs/runbooks/migrate-zfs-host-to-impermanence-rollback.mdon first deploy (done for argentite this round).nix run nixpkgs#inotify-infoshows total watches ~50k (well under the 524,288 limit), nokitten __watch_conf__outlier.docs/reference/ores.mdrenders as a padded markdown table; em-dashes where data is absent.After/Requiresoncontainer@postgres-<name>.serviceconfirmed live, declarative-reconcile services succeed, no failed units.gpg-agent-ssh.socketis active and git-over-SSH works after a reboot (the cycle is only evaluated at boot).