Project on Alwaldend

Projects

Mon, 01 Jan 0001 00:00:00 +0000

This tree contains first-party products and reusable project code. All tracked content follows the repository’s public-source policy.

Each project owns its specifications and maintained changes in <project>/openspec/. Use the pinned OpenSpec workflow with that project selected. infra/src/ owns repository evolution.

Requirements

Bazel targets MAY use public visibility when their owner intends external reuse.
Project artifacts MAY be published through an explicit release workflow.
Project targets MAY be used by production build targets.

Project sites

Each project has a landing page in the main website at https://alwaldend.com/projects/<name>/. Sites are published with the main site rather than as separate Pages repositories, and repository reference documentation, including each project README, lives under /docs/.

Mon, 01 Jan 0001 00:00:00 +0000

Releases

Release packaging for the ActivityWatch ingester Android app.

Mon, 01 Jan 0001 00:00:00 +0000

project-dns Specification

Purpose

Record the retirement of this project’s landing DNS infrastructure while preserving its repository documentation and builds.

Requirements

Requirement: Keep landing infrastructure retired

The project SHALL have no dedicated landing DNS declaration, Terraform root, or operational source export. Its landing page SHALL be published by the main site under /projects/kustomization/ instead of a dedicated hostname.

Scenario: Inspect the project after landing retirement

WHEN the project tree is consumed
THEN it contains no landing DNS declaration, Terraform DNS stage, or landing build target, and the main site owns its landing page.

Mon, 01 Jan 0001 00:00:00 +0000

Kustomization Specification

Purpose

Provide in-progress Kubernetes resource definitions for Flux, Traefik, and cert-manager. This baseline records declared resources at revision 550d7e79b1f5fdbc2b6017b75178471d6914082f, observed on 2026-09-08. It does not assert successful rendering, reconciliation, or a deployed cluster state.

Sources: project README, Flux source, Traefik release, Traefik remote resources, and cert-manager release.

Requirements

Requirement: Scoped Flux repository source

The Flux GitRepository declaration SHALL select the repository’s master branch, refer to the flux-git-src credential secret, and include only infra and projects/kustomization from the repository through its ignore rules.

Mon, 01 Jan 0001 00:00:00 +0000

dns-records Specification

Purpose

Provide one canonical DNS transformation for project-local Terraform resources and offline inspection, preserving declared names, values, and view ownership.

Requirements

Requirement: Normalize canonical declarations without providers

The module SHALL accept decoded owner DNS documents and a zone, flatten every supported type member, expand and deduplicate destinations, and expose one normalized map without provider configuration. It SHALL reject unsupported types, destinations, malformed members, and absolute names outside the zone.

Mon, 01 Jan 0001 00:00:00 +0000

project-dns Specification

Purpose

Record the retirement of this project’s landing DNS infrastructure while preserving its repository documentation and builds.

Requirements

Requirement: Keep landing infrastructure retired

Scenario: Inspect the project after landing retirement

WHEN the project tree is consumed
THEN it contains no landing DNS declaration, Terraform DNS stage, or landing build target, and the main site owns its landing page.

Mon, 01 Jan 0001 00:00:00 +0000

Reusable Terraform modules

Purpose

Provide reusable infrastructure declarations for Vault, virtual machines, storage, and related services. This baseline was observed at repository revision 550d7e79 on 2026-09-08. The collection remains in progress according to its README. Sources for the representative module contracts below are the AppRole module, transit-key module, backup-bucket module, and module packaging. These are declarative source contracts; no live provisioning is asserted.

Requirements

Requirement: Package reusable module source

The AppRole, transit-key, backup-bucket, and Proxmox VM module packages SHALL each expose their main.tf through a same-named Bazel filegroup available to repository subpackages.

ActivityWatch ingester Android

Mon, 01 Jan 0001 00:00:00 +0000

ActivityWatch ingester Android

An Android collector that reads supported browser address-bar text through Android accessibility and sends it to an ActivityWatch server. The app holds full accessibility permission only to obtain the URL; it never uses that permission for anything else.

How it works

Enabling accessibility for this app lets it read the focused address bar.
The accessibility service matches browser view IDs (url_bar and common Chrome-derived variants), extracts the current URL, and sends an ActivityWatch heartbeat for the web.tab.current bucket to a configurable server.
web.tab.current heartbeats use pulsetime=1.0; consecutive URLs are sent with the time spent on the previous tab as the duration field.
Data goes directly from this app to the ActivityWatch HTTP API; it is not uploaded to any other service.

Configuration

Open the app to configure:

Adguard

Mon, 01 Jan 0001 00:00:00 +0000

Agents

Mon, 01 Jan 0001 00:00:00 +0000

Repository agent skills

This project owns the reusable cross-repository agent skills. Maintained improvement work lives in this project’s OpenSpec workspace. It does not centralize component facts or runtime state: each fact remains canonical at its natural owner.

Start here

Document	Purpose
OpenSpec changes	Maintained work, acceptance, and preserved goal history
Root agent guide	Current repository-wide operating policy

Dated audits remain in migrated history.

Ownership boundaries

openspec/ owns agent-system requirements, changes, and evidence; the migration map locates historical records.
Other components own their specifications and changes under their own openspec/ directory. infra/src/openspec/ describes repository evolution.
skills/ owns reusable cross-product, repository-wide agent procedures and their development-time evaluations. A product-specific procedure belongs with its product; a procedure that no narrower project genuinely owns lives here rather than in a contrived local home.
Product-specific skills remain with their project at projects/<project>/skills/<name>. Do not split one skill across owners.

Skill packaging and discovery

Every canonical skill is packaged as a skill_library in its owning directory.

Al

Mon, 01 Jan 0001 00:00:00 +0000

AL is a command runner that prepares credentials and environment variables through plugins, runs your command, and cleans up afterward. Its Bazel rules package commands with their configuration and required plugins.

al tool runs tools declared in AL configuration from a source-keyed executable cache. With no --config, it uses the repository-root al.lua; explicit --config paths replace that default. Cache misses build the tool’s configured Bazel label and publish the selected executable under $XDG_CACHE_HOME/al/tools. AL_TOOL_CACHE or tool --cache-root PATH selects an alternate cache root.

al_config

Mon, 01 Jan 0001 00:00:00 +0000

al_config

load("@com_alwaldend_src//projects/al/rules/al:al_config.bzl", "al_config")

al_config(name, deps, srcs, data)

Dump al config

ATTRIBUTES

Name	Description	Type	Mandatory	Default
name	A unique name for this target.	Name	required
deps	Al configs (targets)	List of labels	optional	`[]`
srcs	Al configs (source files)	List of labels	optional	`[]`
data	Data	List of labels	optional	`[]`

AlConfigInfo

load("@com_alwaldend_src//projects/al/rules/al:al_config.bzl", "AlConfigInfo")

AlConfigInfo(config)

Config info

FIELDS

Name	Description
config	Merged config file

al_leetcode_submissions

Mon, 01 Jan 0001 00:00:00 +0000

al_leetcode_submissions

load("@com_alwaldend_src//projects/leetcode_downloader/main/bzl:al_leetcode_submissions.bzl", "al_leetcode_submissions")

al_leetcode_submissions(name, srcs, visibility, **kwargs)

Generate leetcode submission targets

PARAMETERS

Name	Description	Default Value
name	generated md archive name	none
srcs	leetcode submission configs	none
visibility	visibility	`None`
kwargs	kwargs for template_files	none

al_toolchain

Mon, 01 Jan 0001 00:00:00 +0000

al_toolchain

load("@com_alwaldend_src//projects/al/rules/al:al_toolchain.bzl", "al_toolchain")

al_toolchain(name, al)

Al toolchain

ATTRIBUTES

Name	Description	Type	Mandatory	Default
name	A unique name for this target.	Name	required
al	Al binary	Label	required

al_toolchain_resolved

Mon, 01 Jan 0001 00:00:00 +0000

al_toolchain_resolved

load("@com_alwaldend_src//projects/al/rules/al:al_toolchain_resolved.bzl", "al_toolchain_resolved")

al_toolchain_resolved(name)

Resolved al toolchain (for genrules)

ATTRIBUTES

Name	Description	Type	Mandatory	Default
name	A unique name for this target.	Name	required

Alwaldend.com

Mon, 01 Jan 0001 00:00:00 +0000

Alwaldend.com is the repository’s main website and documentation site. It uses Hugo with Docsy to publish project documentation on GitHub Pages.

Features

Hugo site
Docsy, Bootstrap

Local preview and validation

Run from the repository root:

bazel_agent bazel build //projects/alwaldend.com:site
bazel_agent bazel test //projects/alwaldend.com:site_test
bazel_agent bazel run //projects/alwaldend.com:site_serve

The preview serves the local build at http://127.0.0.1:1313.

Blog

The site publishes dated articles from content/blog. Each post is its own Bazel package with an index.md and a BUILD.bazel declaring its docs_filegroup; the section package aggregates them. The section publishes HTML, an RSS feed, and a print edition, and appears in the main navigation. The section index and its posts carry a github_subdir cascade so the per-page GitHub links point at the content sources.

Android launcher

Mon, 01 Jan 0001 00:00:00 +0000

A text-only Android launcher built with Kotlin and Jetpack Compose. It lets you hide apps and runs without ads, tracking, or internet access.

Features

Android app
Kotlin, Jetpack Compose
Only text
FOSS, no ads, no internet access, no tracking, minimal dependencies
Allows you to hide apps

Ansible collection

Mon, 01 Jan 0001 00:00:00 +0000

alwaldend.main is the repository’s Ansible collection. Bazel packages its Ansible source for reuse in repository automation.

Features

Ansible collection
Bazel-managed Ansible source packaging.

Galaxy

namespace: alwaldend
name: main
version: 0.0.0
readme: README.md
authors:
-  <example@domain.com>
description: main alwaldend ansible collection
license:
  - AGPL-3.0-or-later
license_file: LICENSE.txt
tags: []
dependencies:
  ansible.posix: 1.5.4
  community.crypto: 2.17.0
  community.general: 11.3.0
  devsec.hardening: 9.0.1
  community.docker: 3.11.0
repository: https://git.alwaldend.com/src
documentation: https://collection-main.docs.alwaldend.com
homepage: https://collection-main.docs.alwaldend.com
issues: ""
build_ignore: []

Autoscroll

Mon, 01 Jan 0001 00:00:00 +0000

Autoscroll is a Python and PyQt6 command-line application that turns mouse movement into horizontal and vertical scrolling. It supports configurable buttons, scroll speed, and configuration changes without restarting.

Features

Platfrom-independent autoscroll
Config file with hot-reload
Some argparse tinkering
Python3, PyQt6

Usage

By default, the icon is disabled, to enable it pass --icon-enable

You can pass file contents as command line arguments using @path/to/the/file syntax. Arguments in that case can be placed wherever - on one line, on several lines

Backup bucket

Mon, 01 Jan 0001 00:00:00 +0000

Bazel agent

Mon, 01 Jan 0001 00:00:00 +0000

bazel_agent is the repository Bazel entry point for agents. It keeps the Bazel invocation behind a validated subcommand while consistently applying the agent configuration:

bazel_agent bazel test //path/to/package:all
    ->
bazel test --config=agent //path/to/package:all

bazel is the only Bazel entry point, and it is a validated subcommand. The runner accepts a known Bazel command after the bazel keyword, rejects arbitrary leading arguments, and places --config=agent after the command. Targets, command options, and arguments after the -- separator of a bazel run invocation pass through unchanged. Later options therefore retain Bazel’s normal precedence and can override settings supplied by the agent configuration. The runner resolves bazel from PATH and replaces itself with that process, so signals and the final exit status are not mediated by another wrapper process. Uses of the persistent Bazel server follow the host Codex network policy; the host-bot profile allows loopback so the client-server connection is not blocked.

Bzl

Mon, 01 Jan 0001 00:00:00 +0000

Bzl

Mon, 01 Jan 0001 00:00:00 +0000

Caddy

Mon, 01 Jan 0001 00:00:00 +0000

Ci platform

Mon, 01 Jan 0001 00:00:00 +0000

An abandoned continuous integration platform with a Go backend and a Vue single-page frontend. The source retains its job, pipeline, and project management components.

Features

Clean architecture
Backend: Golang, Gorm, Fiber, Hcl, Postgresql
Frontend: SPA, VueJS with PrimeVue

Arch

Layout

ci_platform
├── api [Interface Adapters]
│   ├── controller
│   ├── middleware
│   └── presenter
├── cmd (CLI interface)
├── docs (OpenAPI Specification and other documentation)
│   └── diagrams
├── entity [Enterprise Business Rules]
├── infrastructure [Frameworks and Drivers]
│   ├── access
│   ├── branch
│   ├── config
│   ├── job
│   ├── jwt
│   ├── lifecycle
│   ├── pipeline
│   ├── pool
│   ├── project
│   ├── schedule
│   ├── session
│   └── user
├── pkg (Support packages)
│   └── error
└── usecase [Application Business Rules]
│   ├── access
│   ├── branch
│   ├── job
│   ├── jwt
│   ├── lifecycle
│   ├── pipeline
│   ├── pool
│   ├── project
│   ├── schedule
│   ├── session
│   └── user
└── web (Web interface)

Resources

architecture

CIFS

Mon, 01 Jan 0001 00:00:00 +0000

Command and plugin lifecycle

Mon, 01 Jan 0001 00:00:00 +0000

al run starts selected plugins, passes their environment to a command, and keeps plugin resources available until that command exits. On cancellation it asks the command to terminate and waits up to ten seconds before killing it. Plugin shutdown then drains requests, releases resources in reverse registration order, and waits for plugin exit. Startup failure cancels sibling starts and rolls back partially initialized resources. Cleanup errors fail the invocation.

The injector creates secret files with owner-only permissions and removes them after consumers stop. Vault stores revoke AppRole tokens they issue; failed AppRole login attempts destroy their unused single-use SecretID. The role’s bootstrap policy must permit secret-id-accessor/destroy, as declared by projects/tf_modules/vault_approle. The user’s existing token-helper credential is never erased or revoked. Secret inputs and remote response bodies are omitted from diagnostic messages. OIDC authorization uses the configured Vault HTTPS origin and TLS transport, rejecting alternate origins and redirects. Explicit config dumps still contain the requested configuration; file outputs use owner-only permissions and truncate previous contents.

Consul

Mon, 01 Jan 0001 00:00:00 +0000

Consul

Mon, 01 Jan 0001 00:00:00 +0000

Consul envoy

Mon, 01 Jan 0001 00:00:00 +0000

contracts

Mon, 01 Jan 0001 00:00:00 +0000

Java

load("@rules_java//java:defs.bzl", "java_library")

java_library(
    name = "name",
    deps = [
        "@com_alwaldend_src//projects/leetcode_downloader/main/proto/contracts:contracts_java_library",
    ],
)

Golang

load("@rules_go//go:def.bzl", "go_library")

go_library(
    name = "name",
    deps = [
        "@com_alwaldend_src//projects/leetcode_downloader/main/proto/contracts:contracts",
    ],
)

Proto

syntax = "proto3";

option go_package = "git.alwaldend.com/alwaldend/src/projects/leetcode_downloader/main/proto/contracts";

enum CliAction {
  DOWNLOAD = 0;
  GENERATE = 1;
  UPDATE = 2;
}

message Config {
  string base_url = 1;
  string cookie = 2;
  repeated string action_args = 4;
  CliAction action = 5;
  uint64 offset = 6;
  uint64 limit = 7;
  map<string, SubmissionConfig> submissions = 8;
  string root_dir = 9;
  map<string, string> headers = 11;
  string submissions_file = 12;
  bool write_code = 13;
}

message SubmissionConfig {
  string dir = 1;
  string extension = 2;
  repeated string types = 3;
}

message Submission {
  uint64 id = 1;
  string status_display = 2;
  string lang = 3;
  uint64 question_id = 4;
  string title_slug = 5;
  string code = 6;
  string title = 7;
  string url = 8;
  string lang_name = 9;
  // string time = 10;
  uint64 timestamp = 11;
  uint64 status = 12;
  string runtime = 13;
  string is_pending = 14;
  string memory = 15;
  string compare_result = 16;
  bool has_notes = 17;
  uint64 flag_type = 18;
}

message SubmissonsResponse {
  repeated Submission submissions_dump = 1;
  bool has_next = 2;
  string last_key = 3;
}
message SubmissonsStorage {
  repeated Submission submissions = 1;
}

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

adguard_dir: /etc/adguard
adguard_work_dir: "{{ adguard_dir }}"
adguard_gpg_key_url: https://keys.openpgp.org/vks/v1/by-fingerprint/28645AC9776EC4C00BCE2AFC0FE641E7235E2EC6
adguard_gpg_key_src: files/key.asc
adguard_gpg_key_path: "{{ adguard_dir }}/release-key.asc"
adguard_gpg_key_checksum: "22d78dbacb461667861ee7d2dd13d13240ee003d"
adguard_release_source_url: https://github.com/AdguardTeam/AdGuardHome/releases/download
adguard_release_version: v0.107.48
adguard_release_checksum: "sha512:c0a336212e3792ae6fc6b8de976befce0038c5d6ddde919a00994c43a929349958c7bd65f7fb7fdd471962afa20855ecbf5830cc7a1d26f3037a716db638c101"
adguard_release_distrib: AdGuardHome_linux_amd64.tar.gz
adguard_release_url: "{{ adguard_release_source_url }}/{{ adguard_release_version }}/{{ adguard_release_distrib }}"
adguard_release_archive_dest: "{{ adguard_dir }}/release-{{ adguard_release_version }}-{{ adguard_release_distrib }}" 
adguard_release_dest: "{{ adguard_dir }}/release-{{ adguard_release_version }}" 
adguard_release_dir: "{{ adguard_release_dest }}/AdGuardHome"
adguard_release_bin: "{{ adguard_release_dir }}/AdGuardHome"
adguard_release_sig: "{{ adguard_release_bin }}.sig"

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

caddy_enabled: false
caddy_user: caddy
caddy_config_path: /etc/caddy/Caddyfile
caddy_config_dir: /etc/caddy/configs
caddy_config: |
  import {{ caddy_config_dir }}/*

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

cifs_enabled: false
cifs_systemd_dir: /etc/systemd/system
cifs_mounts: []

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

consul_user: consul
consul_user_uid: 4266
consul_dir: "/opt/consul"
consul_data_dir: "{{ consul_dir }}/data"
consul_config_dir: "{{ consul_dir }}/configs"
consul_config_path: "{{ consul_config_dir }}/consul.hcl"
consul_config_local_path: "files/consul.hcl"
consul_log_dir: "{{ consul_dir }}/logs"
consul_tls_dir: "{{ consul_dir }}/tls"
consul_service_path: "/lib/systemd/system/consul.service"
consul_tls_ca_file_local_path: files/pki_ca_servers.crt
consul_tls_ca_file_path: "{{ consul_tls_dir }}/tls_ca_file.crt"
consul_tls_cert_file_path: "{{ consul_tls_dir }}/cert_file.crt"
consul_tls_key_file_path: "{{ consul_tls_dir }}/key_file.crt"
consul_tls_common_name: "{{ inventory_hostname }}"
consul_tls_ttl: "2629746" # month
consul_tls_alt_names: ""
consul_vault_local_path: "{{ role_path }}/files/vault"
consul_bin_local_path: "{{ role_path }}/files/consul"
consul_bin_path: /usr/bin/consul

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

consul_envoy_dir: "/opt/consul_envoy"
consul_envoy_deployments_dir: "{{ consul_envoy_dir }}/deployments"
consul_envoy_releases_dir: "{{ consul_envoy_dir }}/releases"
consul_envoy_deployment_dir: "{{ consul_envoy_deployments_dir }}/{{ consul_envoy_deployment_version }}"
consul_envoy_release_dir: "{{ consul_envoy_releases_dir }}/{{ consul_envoy_release_version }}"
consul_envoy_configs_dir: "{{ consul_envoy_deployment_dir }}/configs"
consul_envoy_bootstrap_config_path: "{{ consul_envoy_configs_dir }}/bootstrap.json"
consul_envoy_deployment_version: "{{ lookup('ansible.builtin.pipe', 'git rev-parse HEAD') }}"
consul_envoy_user_name: consul_envoy
consul_envoy_release_version: 1.31.0
consul_envoy_release_archive_fullname: "envoy_{{ consul_envoy_release_version }}_linux_amd64.zip"
consul_envoy_release_url: "https://releases.hashicorp.com/envoy/{{ consul_envoy_release_version }}/{{ consul_envoy_release_archive_fullname }}"
consul_envoy_release_bin_path: "{{ consul_envoy_release_dir }}/envoy"
consul_envoy_release_symlink_path: "{{ consul_envoy_releases_dir }}/current"
consul_envoy_release_checksum: "sha256:350782275de0fe50699844b4f9096d77a0193a5bcf205e14b8ad964ec429d45e"

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

consul_is_server: false
consul_user_name: consul
consul_user_uid:
consul_dir: "/opt/consul"
consul_persistence_dir: "{{ consul_dir }}"
consul_releases_dir: "{{ consul_dir }}/releases"
consul_config_symlink_dir: "{{ consul_configs_dir }}/current"
consul_config_symlink_data_dir: "{{ consul_config_symlink_dir }}/configs"
consul_configs_dir: "{{ consul_persistence_dir }}/configs/{{ inventory_hostname }}"
consul_data_dir: "{{ consul_persistence_dir }}/data/{{ inventory_hostname }}"
consul_config_path: "{{ consul_config_config_dir }}/consul.json"
consul_config_dir: "{{ consul_configs_dir }}/{{ consul_config_dir_name }}" 
consul_config_data_dir: "{{ consul_config_dir }}/data"
consul_config_config_dir: "{{ consul_config_dir }}/configs"
consul_config_dir_name: "{{ consul_config_version }}"
consul_config_version: "{{ lookup('ansible.builtin.pipe', 'git rev-parse HEAD') }}"
consul_env: {}
consul_configs: []
consul_env_path: "{{ consul_config_data_dir }}/consul.env"
consul_env_symlink_path: "{{ consul_config_symlink_dir }}/data/consul.env"
consul_release_dir: "{{ consul_releases_dir }}/{{ consul_release_dir_name }}"
consul_release_dir_name: "{{ consul_release_version }}"
consul_release_symlink_path: "{{ consul_releases_dir }}/current"
consul_release_symlink_bin_path: "{{ consul_release_symlink_path }}/consul"
consul_release_version: 1.20.2
consul_release_archive_name: "consul_{{ consul_release_version }}_linux_amd64"
consul_release_archive_fullname: "{{ consul_release_archive_name }}.zip"
consul_release_bin_path: "{{ consul_release_dir }}/consul"
consul_release_url: "https://releases.hashicorp.com/consul/{{ consul_release_version }}/{{ consul_release_archive_fullname }}"
consul_release_checksum: "sha256:1bf7ddf332f02e6e36082b0fdf6c3e8ce12a391e7ec7dafd3237bb12766a7fd5"
consul_agent_ca_cert_path: "{{ consul_config_data_dir }}/agent_ca_cert.pub"
consul_agent_ca_cert:
consul_server_cert_path: "{{ consul_config_data_dir }}/server_cert_{{ inventory_hostname }}.pub"
consul_server_cert:
consul_server_key_path: "{{ consul_config_data_dir }}/server_cert_{{ inventory_hostname }}.key"
consul_server_key:

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

---
dev_vm_install_packages: true
dev_vm_package_backend: auto
dev_vm_rpm_ostree_apply_live: false
dev_vm_packages:
  - clang
  - clang-tools-extra
  - java-latest-openjdk-devel
  - rust
  - cargo
  - mesa-libGL-devel
  - go
  - Xvfb
  - python3
  - gmp-devel
  - patch
  - podman
  - git
  - git-lfs
  - fuse
  - fuse-libs
  - pcsc-lite
  - pcsc-lite-devel
  - openssl
  - gnutls-utils
  - opensc
  - openssl-pkcs11
  - libdnet
  - qemu-kvm
  - qemu-img
dev_vm_bazel_user: "{{ undefined() }}"
dev_vm_bazel_group: "{{ dev_vm_bazel_user }}"
dev_vm_bazel_home: "{{ undefined() }}"
dev_vm_bazelrc_src: bazelrc
dev_vm_bazelisk_src: bazelisk
dev_vm_bazel_agent_src: bazel_agent
dev_vm_selinux_android_emulation: true

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

dns_records: []
dns_domains: []
dns_njalla_api_url: https://njal.la/api/1/
dns_njalla_token:

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

docker_enabled: false

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

facts_debug: false

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

filesystem_setup: []

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

firewall_state: enabled
firewall_enabled: true
firewall_allow_port_from: []
firewall_allow_forward: []

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

forgejo_user: forgejo
forgejo_user_uid: 5157
forgejo_dir: "/opt/forgejo"
forgejo_data_dir: "{{ forgejo_dir }}/data"
forgejo_config_dir: "{{ forgejo_dir }}/configs"
forgejo_work_dir: "{{ forgejo_dir }}/work"
forgejo_config_path: "{{ forgejo_config_dir }}/forgejo.ini"
forgejo_config_local_path: "files/forgejo.ini"
forgejo_disk:
forgejo_log_dir: "{{ forgejo_dir }}/logs"
forgejo_service_path: "/lib/systemd/system/forgejo.service"
forgejo_vault_local_path: "{{ role_path }}/files/vault"
forgejo_bin_local_path: "{{ role_path }}/files/forgejo"
forgejo_bin_path: /usr/bin/forgejo

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

forgejo_runner_user: forgejo-runner
forgejo_runner_user_uid: 5721
forgejo_runner_dir: /opt/forgejo-runner
forgejo_runner_disk:
forgejo_runner_home_dir: /opt/forgejo-runner/home
forgejo_runner_work_dir: /opt/forgejo-runner/work
forgejo_runner_bin_local_path: "{{ role_path }}/files/forgejo-runner"
forgejo_runner_bin_path: /usr/bin/forgejo-runner
forgejo_runner_service_path: /lib/systemd/system/forgejo-runner.service
forgejo_runner_instance: "{{ undefined() }}"
forgejo_runner_token: "{{ undefined() }}"
forgejo_runner_name: "{{ inventory_hostname }}"
forgejo_runner_labels:
  - "self-hosted:host"

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

gpg_users: []

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

harbor_user: harbor
harbor_user_uid: 7049
harbor_dir: "/opt/harbor"
harbor_installer_dir: "{{ harbor_dir }}/installer"
harbor_logs_dir: "{{ harbor_dir }}/logs"
harbor_data_dir: "{{ harbor_dir }}/data"
harbor_installer_local_dir: "{{ role_path }}/files/harbor_installer"
harbor_config_path: "{{ harbor_installer_dir }}/harbor.yml"
harbor_config_local_path: "files/harbor.yaml"
harbor_domain: "{{ undefined() }}"
harbor_ca_local_path: "{{ role_path }}/files/pki_ca_servers.crt"
harbor_ca_path: /etc/docker/certs.d/{{ harbor_domain }}/ca.crt
harbor_root_ca_local_path: "{{ role_path }}/files/pki_ca_root.crt"

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

hermes_user: hermes
hermes_user_uid: 8150
hermes_dir: /opt/hermes
hermes_home_dir: "{{ hermes_dir }}/home"
hermes_install_dir: "{{ hermes_dir }}/hermes-agent"
hermes_disk:
hermes_port: 8642
hermes_commit: "{{ undefined() }}"
hermes_installer_local_path: "{{ role_path }}/files/install.sh"
hermes_installer_path: "{{ hermes_dir }}/install.sh"
hermes_config_local_path: "files/hermes.yaml"
hermes_config_path: "{{ hermes_home_dir }}/.hermes/config.yaml"
hermes_env_path: "{{ hermes_home_dir }}/.hermes/.env"
hermes_env: {}
hermes_bin_path: "{{ hermes_home_dir }}/.local/bin/hermes"
hermes_dashboard_service_path: /lib/systemd/system/hermes-dashboard.service

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

hiddify_manager_env:
  HIDDIFY_MANAGER_IMAGE: ghcr.io/hiddify/hiddify-manager:main@sha256:d5edef06d2133ffa26f0fcbb67e711f4356dba44c44a41a96570c4e03845a84c
  HIDDIFY_MANAGER_REDIS_IMAGE: redis:7.4.1@sha256:bb142a9c18ac18a16713c1491d779697b4e107c22a97266616099d288237ef47
  HIDDIFY_MANAGER_MARIADB_IMAGE: mariadb:11.6.2@sha256:a9547599cd87d7242435aea6fda22a9d83e2c06d16c658ef70d2868b3d3f6a80
  HIDDIFY_MANAGER_REDIS_PASSWORD: "{{ lookup('ansible.builtin.env', 'HIDDIFY_MANAGER_REDIS_PASSWORD', default=undef()) }}"
  HIDDIFY_MANAGER_MYSQL_PASSWORD: "{{ lookup('ansible.builtin.env', 'HIDDIFY_MANAGER_MYSQL_PASSWORD', default=undef()) }}"
  HIDDIFY_MANAGER_MARIADB_PASSWORD: "{{ lookup('ansible.builtin.env', 'HIDDIFY_MANAGER_MARIADB_PASSWORD', default=undef()) }}"
hiddify_manager_env_override: {}
hiddify_manager_dir: /opt/hiddify_manager

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

install_ca:
  - path: "{{ role_path }}/files/pki_ca_root.crt"
  - path: "{{ role_path }}/files/pki_ca_servers.crt"

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

k3s_data_dir: /srv/k3s_data
k3s_service_name: k3s
k3s_data_disk: /dev/sdb
k3s_storage_dir: /srv/k3s_storage
k3s_storage_disk: /dev/sdc
k3s_config_path: "/etc/rancher/k3s/config.yaml"
k3s_config_local_path: "files/k3s.yaml"
k3s_admission_config_path: "/etc/rancher/k3s/admission.yaml"
k3s_admission_config_local_path: "files/k3s_admission.yaml"
k3s_auth_config_path: "{{ [(k3s_config_path | dirname), 'k3s_auth.yaml'] | path_join }}"
k3s_auth_config_local_path: "files/k3s_auth.yaml"
k3s_manifests_local_path: "files/k3s_manifests.yaml"
k3s_manifests_path: "{{ k3s_data_dir }}/server/manifests/k3s-manifests.yaml"
k3s_bin_local_path: "{{ role_path }}/files/k3s"
k3s_bin_path: /usr/local/bin/k3s
k3s_install_script_local_path: "{{ role_path }}/files/k3s_install"
k3s_install_script_path: /usr/local/bin/k3s_install

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

k3s_bootstrap_apply_path:
k3s_bootstrap_token_name: "{{ lookup('ansible.builtin.env', 'USER', default=undef()) }}"
k3s_bootstrap_token_namespace: kube-system
k3s_bootstrap_venv_dir: "/opt/bootstrap-venv"
k3s_bootstrap_venv_bin: "{{ k3s_bootstrap_venv_dir | mandatory }}/bin/python"
k3s_bootstrap_kubeconfig: /etc/rancher/k3s/k3s.yaml
k3s_bootstrap_cluster_name: "{{ inventory_hostname }}"
k3s_bootstrap_cluster_ca_path: "{{ lookup('ansible.builtin.env', 'HOME', default=undef()) }}/.kube/ca-{{ k3s_bootstrap_cluster_name | mandatory }}.ca.crt"
k3s_bootstrap_user_ca_path: "{{ k3s_bootstrap_cluster_ca_path | mandatory | dirname }}/ca-{{ k3s_bootstrap_cluster_name | mandatory }}-{{ k3s_bootstrap_token_name | mandatory }}.ca.crt"
k3s_bootstrap_user_name: "{{ k3s_bootstrap_cluster_name | mandatory }}-{{ k3s_bootstrap_token_name | mandatory }}"
k3s_bootstrap_cluster_port:

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

k3s_kubeconfig_secret_path: "{{ undefined() }}"
k3s_kubeconfig_secret_mount: "{{ undefined() }}"
k3s_kubeconfig_path: /etc/rancher/k3s/k3s.yaml
k3s_kubeconfig_vault_bin_local_path: "{{ role_path }}/files/vault"

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

lvg_volume_groups: []

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

lvol_volumes: []

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

mount_points: []

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

opencode_user: opencode
opencode_user_uid: 8149
opencode_dir: "/opt/opencode"
opencode_port: 4096
opencode_domain: "{{ undefined() }}"
opencode_log_dir: "{{ opencode_dir }}/logs"
opencode_work_dir: "{{ opencode_dir }}/work"
opencode_home_dir: "{{ opencode_dir }}/home"
opencode_config_dir: "{{ opencode_home_dir }}/.config/opencode"
opencode_config_path: "{{ opencode_config_dir }}/opencode.json"
opencode_config_local_path: "files/opencode.json"
opencode_disk:
opencode_service_path: "/lib/systemd/system/opencode.service"
opencode_bin_local_path: "{{ role_path }}/files/opencode"
opencode_bin_path: /usr/bin/opencode
opencode_env_path: "{{ opencode_config_dir }}/opencode.env"
opencode_env_override: {}
opencode_ssh_public_key: "{{ undefined() }}"
opencode_ssh_private_key: "{{ undefined() }}"
opencode_server_username: "{{ undefined() }}"
opencode_server_password: "{{ undefined() }}"
opencode_env:
  OPENCODE_SERVER_USERNAME: "{{ opencode_server_username }}"
  OPENCODE_SERVER_PASSWORD: "{{ opencode_server_password }}"

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

openhands_automation_user: openhands
openhands_automation_user_uid: 8154
openhands_automation_dir: /opt/openhands-automation
openhands_automation_home_dir: "{{ openhands_automation_dir }}/home"
openhands_automation_work_dir: "{{ openhands_automation_dir }}/work"
openhands_automation_state_dir: "{{ openhands_automation_dir }}/state"
openhands_automation_disk:
openhands_automation_packages:
  - python3.12
  - uv
openhands_automation_host: 127.0.0.1
openhands_automation_port: 18001
openhands_automation_version: "{{ undefined() }}"
openhands_automation_agent_server_version: "{{ undefined() }}"
openhands_automation_agent_server_url: "{{ undefined() }}"
openhands_automation_sandbox_agent_server_url: ""
openhands_automation_agent_server_api_key: "{{ undefined() }}"
openhands_automation_base_url: "{{ undefined() }}"
openhands_automation_local_api_key: "{{ undefined() }}"
openhands_automation_kv_secret: "{{ undefined() }}"
openhands_automation_database_url: "sqlite+aiosqlite:///{{ openhands_automation_state_dir }}/automations.db"
openhands_automation_workspace_base: "{{ openhands_automation_work_dir }}/automations"
openhands_automation_venv_dir: "{{ openhands_automation_dir }}/venv"
openhands_automation_service_path: /lib/systemd/system/openhands-automation.service
openhands_automation_env_path: "{{ openhands_automation_dir }}/.env"
openhands_automation_env:
  PYTHONUTF8: "1"
  OPENHANDS_REMOTE_WS_READY_REQUIRED: "false"
  OPENHANDS_SUPPRESS_BANNER: "1"
openhands_automation_env_override: {}

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

openhands_canvas_user: openhands
openhands_canvas_user_uid: 8153
openhands_canvas_dir: /opt/openhands-canvas
openhands_canvas_home_dir: "{{ openhands_canvas_dir }}/home"
openhands_canvas_work_dir: "{{ openhands_canvas_dir }}/work"
openhands_canvas_state_dir: "{{ openhands_canvas_dir }}/state"
openhands_canvas_package_dir: "{{ openhands_canvas_dir }}/lib/node_modules/@openhands/agent-canvas"
openhands_canvas_disk:
openhands_canvas_packages:
  - nodejs24
  - nodejs24-npm
openhands_canvas_host: 127.0.0.1
openhands_canvas_port: 8000
openhands_canvas_version: "{{ undefined() }}"
openhands_canvas_service_path: /lib/systemd/system/openhands-canvas.service
openhands_canvas_env_path: "{{ openhands_canvas_dir }}/.env"
openhands_canvas_env:
  NODE_ENV: production
openhands_canvas_env_override: {}

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

openhands_server_user: openhands
openhands_server_user_uid: 8152
openhands_server_dir: /opt/openhands-server
openhands_server_home_dir: "{{ openhands_server_dir }}/home"
openhands_server_work_dir: "{{ openhands_server_dir }}/work"
openhands_server_state_dir: "{{ openhands_server_dir }}/state"
openhands_server_conversations_dir: "{{ openhands_server_state_dir }}/conversations"
openhands_server_persistence_dir: "{{ openhands_server_state_dir }}/persistence"
openhands_server_workspace_dir: "{{ openhands_server_work_dir }}/project"
openhands_server_bash_events_dir: "{{ openhands_server_state_dir }}/bash_events"
openhands_server_tools_dir: "{{ openhands_server_dir }}/tools"
openhands_server_disk:
openhands_server_secure: true
openhands_server_install_packages: true
openhands_server_packages:
  - python3.12
  - uv
openhands_server_host: 127.0.0.1
openhands_server_port: 18000
openhands_server_version: "{{ undefined() }}"
openhands_server_session_api_key: "{{ undefined() }}"
openhands_server_secret_key: "{{ undefined() }}"
openhands_server_import_modules: canvas_ui_tool
openhands_server_vscode_port: 8001
openhands_server_vscode_base_path: /vscode
openhands_server_venv_dir: "{{ openhands_server_dir }}/venv"
openhands_server_venv_python: "{{ openhands_server_venv_dir }}/bin/python"
openhands_server_service_path: /lib/systemd/system/openhands-server.service
openhands_server_env_path: "{{ openhands_server_dir }}/.env"
openhands_server_env:
  LOG_JSON: "true"
  PYTHONUTF8: "1"
  OPENHANDS_REMOTE_WS_READY_REQUIRED: "false"
  OH_PERSISTENCE_DIR: "{{ openhands_server_persistence_dir }}"
  OH_CONVERSATIONS_PATH: "{{ openhands_server_conversations_dir }}"
  OH_WORKSPACE_PATH: "{{ openhands_server_workspace_dir }}"
  OH_BASH_EVENTS_DIR: "{{ openhands_server_bash_events_dir }}"
  OH_SECRET_KEY: "{{ openhands_server_secret_key }}"

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

os_hardening_enabled: true

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

postgresql_packages:
  - postgresql-server
  - postgresql-contrib
postgresql_service: postgresql

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

pve_repo_keyring_path: /usr/share/keyrings/proxmox-archive-keyring.gpg
pve_repo_path: /etc/apt/sources.list.d/pve-install-repo.sources
pve_repo_keyring_url: https://enterprise.proxmox.com/debian/proxmox-archive-keyring-trixie.gpg
pve_repo_keyring_checksum: "sha256:136673be77aba35dcce385b28737689ad64fd785a797e57897589aed08db6e45"
pve_snippets_dir: /var/lib/vz/snippets
pve_snippets: []
pve_repo_content: |
  Types: deb
  URIs: http://download.proxmox.com/debian/pve
  Suites: trixie
  Components: pve-no-subscription
  Signed-By: {{ pve_repo_keyring_path }}

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

pve_cluster_remove_repos:
  - pve-enterprise.list 
  - ceph.list
pve_cluster_add_repos:
  - name: pve-no-subscription
    value: deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription
  - name: ceph-squid
    value: deb http://download.proxmox.com/debian/ceph-squid bookworm no-subscription
pve_cluster_node_config: []
pve_cluster_admins: []
pve_cluster_cluster_name:
pve_cluster_acme_accounts: []
pve_cluster_acme_plugins: []
pve_cluster_venv_dir: /opt/ansible/pve_cluster_venv
pve_cluster_venv_packages: 
  - pexpect
pve_cluster_base_image_dir: /var/lib/vz/template
pve_cluster_node_name: "{{ inventory_hostname | mandatory | split('.') | first }}"
pve_cluster_ceph_enabled: false
pve_cluster_ceph_repository: no-subscription
pve_cluster_ceph_osd: []
pve_cluster_ceph_pools: []
pve_cluster_ceph_mon: []
pve_cluster_ceph_mgr: []
pve_cluster_ceph_mds: []
pve_cluster_storages: []
pve_cluster_storage_config_path: /etc/pve/storage.cfg

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

pve_vm_agent: 
pve_vm_name: "{{ inventory_hostname }}"
pve_vm_delegate_update_known_hosts: localhost
pve_vm_delegate_pve: 
pve_vm_set: "{{ pve_vm_set_default + pve_vm_set_additional }}"
pve_vm_set_default: []
pve_vm_set_additional: []
pve_vm_set_creation: "{{ pve_vm_set_creation_default + pve_vm_set_creation_additional }}"
pve_vm_set_creation_default: []
pve_vm_set_creation_additional: []
pve_vm_resize: []
pve_vm_venv_dir: "/opt/ansible/pve_vm_venv"
pve_vm_init_user:
pve_vm_venv_packages:
  - proxmoxer
  - requests

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

raspberry_pi_argon_enabled: false
raspberry_pi_containers_enabled: false
raspberry_pi_argon_eeprom_script_path: /usr/local/bin/argon_argon_eeprom.sh
raspberry_pi_argon_argon1_script_path: /usr/local/bin/argon_argon1.sh
raspberry_pi_cmdline_path: /boot/firmware/cmdline.txt

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

ssh_hardening_enabled: true
ssh_vault_mount: ssh/servers
ssh_vault_role: "{{ undefined }}"
ssh_sign_ignore_errors: false
ssh_valid_principals: []

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

ssh_port_forward_local_addr: 127.0.0.1
ssh_port_forward_script_path: /usr/local/bin/ssh-port-forward

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

ssh_update_known_hosts_hosts: []

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

t3code_user: t3code
t3code_user_uid: 8151
t3code_dir: /opt/t3code
t3code_home_dir: "{{ t3code_dir }}/home"
t3code_work_dir: "{{ t3code_dir }}/work"
t3code_disk:
t3code_port: 5120
t3code_version: "{{ undefined() }}"
t3code_state_dir: "{{ t3code_dir }}/state"
t3code_auth_token: "{{ undefined() }}"
t3code_service_path: /lib/systemd/system/t3code.service
t3code_env_path: "{{ t3code_dir }}/.env"
t3code_env: {}

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

threexui_user: threexui
threexui_user_uid: 6468
threexui_dir: "/opt/threexui"
threexui_data_dir: "{{ threexui_dir }}/data"
threexui_work_dir: "{{ threexui_dir }}/work"
threexui_disk:
threexui_log_dir: "{{ threexui_dir }}/logs"
threexui_service_path: "/lib/systemd/system/threexui.service"
threexui_vault_local_path: "{{ role_path }}/files/vault"
threexui_bin_dir: "{{ threexui_dir }}/bin"
threexui_bin_local_dir: "{{ role_path }}/files/threexui_bin"
threexui_config_dir: "{{ threexui_dir }}/configs"
threexui_env_path: "{{ threexui_config_dir }}/threexui.env"
threexui_env_override: {}
threexui_base_path: /
threexui_username: "{{ undefined() }}"
threexui_password: "{{ undefined() }}"
threexui_port: "2053"
threexui_debug: "false"
threexui_env:
  # https://docs.sanaei.dev/docs/reference/env-vars/
  XUI_DB_TYPE: sqlite
  XUI_DB_FOLDER: "{{ threexui_data_dir }}"
  XUI_PORT: "{{ threexui_port }}"
  XUI_INIT_WEB_BASE_PATH: "{{ threexui_base_path }}"
  XUI_ENABLE_FAIL2BAN: "true"
  XUI_SKIP_HSTS: "true"
  XUI_LOG_LEVEL: info
  XUI_DEBUG: "{{ threexui_debug }}"
  XUI_LOG_FOLDER: "{{ threexui_log_dir }}"
  XUI_BIN_FOLDER: "{{ threexui_bin_dir }}/bin"
  XRAY_VMESS_AEAD_FORCED: "false"
  XUI_ACCESS_URL: "https://{{ inventory_hostname }}{{ threexui_base_path }}"
  XUI_USERNAME: "{{ threexui_username }}"
  XUI_PASSWORD: "{{ threexui_password }}"

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

traefik_user: traefik
traefik_no_user: false
traefik_owner: root
traefik_user_uid: 3578
traefik_dir: "/opt/traefik"
traefik_log_dir: "{{ traefik_dir }}/logs"
traefik_data_dir: "{{ traefik_dir }}/data"
traefik_tls_dir: "{{ traefik_dir }}/tls"
traefik_disk:
traefik_mtls_ca_local_path: "{{ role_path }}/files/traefik_mtls_ca.crt"
traefik_mtls_ca_path: "{{ traefik_tls_dir }}/mtls_ca.crt"
traefik_acme_path: "{{ undefined }}"
traefik_config_dir: "{{ traefik_dir }}/configs"
traefik_config_path: "{{ traefik_config_dir }}/traefik.toml"
traefik_disable_eab: false
traefik_config_local_path: "files/traefik.toml"
traefik_dynamic_config_path: "{{ traefik_config_dir }}/traefik_dynamic.toml"
traefik_dynamic_config_local_path: "files/traefik_dynamic.toml"
traefik_service_path: "/lib/systemd/system/traefik.service"
traefik_service_scope: system
traefik_bin_local_path: "{{ role_path }}/files/traefik"
traefik_bin_path: /usr/bin/traefik
traefik_vault_bin_local_path: "{{ role_path }}/files/vault"

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

traefik_user: traefik
traefik_user_uid: 3653
traefik_env: {}
traefik_data_dir: /mnt/traefik
traefik_log_dir: "/var/log/traefik"
traefik_certificates_dir: "{{ traefik_data_dir }}/certificates"
traefik_configs_dir: "{{ traefik_data_dir }}/configs"
traefik_configs_version: "{{ lookup('ansible.builtin.pipe', 'git rev-parse HEAD') }}"
traefik_configs_dynamic_dir: "{{ traefik_configs_cur_dir }}/dynamic"
traefik_configs_dynamic_dir_symlink: "{{ traefik_configs_symlink }}/dynamic"
traefik_configs_cur_dir_name: "{{ traefik_configs_version }}"
traefik_configs_cur_dir: "{{ traefik_configs_dir }}/{{ traefik_configs_cur_dir_name }}"
traefik_configs_symlink: "{{ traefik_configs_dir }}/current"
traefik_static_config_path: "{{ traefik_configs_symlink }}/traefik.yaml"
traefik_releases_dir: /opt/traefik/releases
traefik_static_config:
traefik_dynamic_configs: []
traefik_release_version: v3.3.1
traefik_release_dir_name: "{{ traefik_release_version }}"
traefik_release_dir: "{{ traefik_releases_dir }}/{{ traefik_release_dir_name }}"
traefik_release_symlink: "{{ traefik_releases_dir }}/current"
traefik_release_symlink_bin: "{{ traefik_release_symlink }}/traefik"
traefik_release_archive_name: "traefik_{{ traefik_release_version }}_linux_amd64"
traefik_release_archive_full: "traefik_{{ traefik_release_version }}_linux_amd64.tar.gz"
traefik_release_bin_path: "{{ traefik_release_dir }}/traefik"
traefik_release_download_url: "https://github.com/traefik/traefik/releases/download/{{ traefik_release_version }}/{{ traefik_release_archive_full }}"
traefik_release_download_checksum: sha256:27fd502a8d80fc81b97faf5cebd7a1cbc1a2c5369d18e0f4471a66d1a8c139ce

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

users_regular: {}
users_remove: {}
users_admins:
  ansible:
    name: ansible
    disable_passwd: true
    sudo_no_passwd: true
users_ssh_keys: {}

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

vault_user: vault
vault_user_uid: 3123
vault_dir: "/opt/vault"
vault_data_dir: "{{ vault_dir }}/data"
vault_raft_dir: "{{ vault_dir }}/raft"
vault_config_dir: "{{ vault_dir }}/configs"
vault_config_path: "{{ vault_config_dir }}/vault.hcl"
vault_config_local_path: "files/vault.hcl"
vault_log_dir: "{{ vault_dir }}/logs"
vault_tls_dir: "{{ vault_dir }}/tls"
vault_service_path: "/lib/systemd/system/vault.service"
vault_tls_client_ca_file_local_path: files/tls_client_ca_file.pem
vault_tls_client_ca_file_path: "{{ vault_tls_dir }}/tls_client_ca_file.pem"
vault_tls_cert_file_path: "{{ vault_tls_dir }}/tls_cert_file.pem"
vault_tls_key_file_path: "{{ vault_tls_dir }}/tls_key_file.pem"
vault_tls_issue_path:
vault_tls_alt_names: ""
vault_bin_local_path: "{{ role_path }}/files/vault"
vault_bin_path: /usr/bin/vault
vault_peers_write: false
vault_peers_local_path:
vault_peers_remote_path: "{{ vault_raft_dir }}/raft/peers.json"

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

wireguard_dir: "/etc/wireguard"
wireguard_local_config_paths: []

Defaults

Mon, 01 Jan 0001 00:00:00 +0000

xray_enabled: false
xray_config_dir: /usr/local/etc/xray
xray_log_dir: /var/log/xray
xray_config_path: "{{ xray_config_dir }}/0-main.json"
xray_client_id:
xray_wireguard_relays: []
xray_wireguard_ipv4_address:
xray_wireguard_ipv6_address:
xray_wireguard_private_key:
xray_config:
xray_configs: {}
xray_user: xray
xray_socket_dir: /var/shm/xray
xray_caddy_config_path: /etc/caddy/configs/xray.Caddyfile
xray_subscriptions_dir: /usr/local/etc/xray-subscriptions
xray_caddy_user: caddy

Dev VM

Mon, 01 Jan 0001 00:00:00 +0000

The default task entry point configures package repositories and development packages. It uses the same dev_vm_packages list with either the ordinary package manager or RPM-OSTree layering. dev_vm_package_backend accepts auto, package, or rpm_ostree; auto selects RPM-OSTree when /run/ostree-booted exists. Set dev_vm_install_packages to false to skip repository and package management entirely.

RPM-OSTree changes are staged for the next boot by default. The role reports a pending deployment but does not reboot the host. Set dev_vm_rpm_ostree_apply_live to true only when live application is known to be safe for the selected packages.

DNS

Mon, 01 Jan 0001 00:00:00 +0000

DNS normalization

Mon, 01 Jan 0001 00:00:00 +0000

This child module owns the canonical transformation described by the DNS module. Its document and zone inputs produce normalized_records without a provider, backend, or managed resources. Terraform writers and provider-free inspection consume this output.

DNS records

Mon, 01 Jan 0001 00:00:00 +0000

This reusable module translates an owner’s decoded dnsconfig.json through its provider-free normalizer, then manages individual global Cloudflare and dc1 RouterOS records with caller-provided providers. Owners with only global records use the global entrypoint, which needs only Cloudflare. The combined entrypoint delegates Cloudflare resources to that same module and consumes its normalization for RouterOS. Repository infrastructure roots may consume its Bazel source filegroups; the child normalizer also supports provider-free inspection.

module "dns" {
  source             = "../../../projects/tf_modules/dns_records"
  document           = jsondecode(file("${path.module}/../dnsconfig.json"))
  cloudflare_zone_id = var.dns_cloudflare_zone_id
  enabled            = var.dns_enabled
}

zone defaults to alwaldend.com. An explicit cloudflare_zone_id is optional; when it is null or empty, enabled global records resolve exactly one Cloudflare zone matching zone. The token must permit zone listing and reading. Disabled ownership and declarations without global records skip this lookup. enabled defaults to false so a prepared root owns no provider records. Keep it true after adoption: setting it false in a state that already owns records plans deletion and is not a rollback procedure. Disabling ownership does not suppress provider initialization. Operational Terraform commands still require the caller’s real provider configuration and the owning Vault/AppRole prerequisites. In particular, the pinned RouterOS provider probes its configured API even when no DNS records are enabled. Use the provider-free normalizer for offline inspection. The migration runbook owns cutover, import, and rollback ordering. This module supplies no provider credentials or state backend.

DNS test providers

Mon, 01 Jan 0001 00:00:00 +0000

The test target uses the public rules_terraform wrapper with the same Cloudflare, RouterOS, and Proxmox provider labels as infrastructure targets. The shared extension owns provider versions, release URLs, and checksums. Bazel fetches the declared archives before tests execute; Terraform uses the wrapper’s packaged filesystem mirror without a registry fallback.

Each regression runs Terraform in a caller-owned temporary module directory. Tests retain an explicit environment without inherited provider credentials; provider installation and mocked lifecycles require no network access.

Docker

Mon, 01 Jan 0001 00:00:00 +0000

Dotfiles

Mon, 01 Jan 0001 00:00:00 +0000

This project packages personal configuration files into an installable archive. Make and Bazel entry points compare the packaged files with the local system and install selected configurations.

Features

Archive with dotfiles that can be installed using make

Bazel usage

bazel run //projects/dotfiles:help # Show help
bazel run //projects/dotfiles:diff # Show diff
bazel run //projects/dotfiles:install # Install files

Archive usage

oras pull --output "${PWD}" docker.io/alwaldend/src:projects_dotfiles_dotfiles_tar_head
cd releases/projects/dotfiles/head/files
tar -xf dotfiles.tar
cd dotfiles
make help # Show help
make diff # Check diff between system files and those from the archive
make diff/nvim # Check diff for all nvim files
make diff/nvim/.config/nvim/lazy-lock.json # Diff specific file
make install # Install all files from the archive
make install/nvim # Install nvim files
make install/nvim/.config/nvim/lazy-lock.json # Install a specific file

Help

help: Show help
install: Install files from the archive
diff: Show diff between archive files and system files
install/bin: Install bin files
diff/bin: Diff bin files
install/home: Install home files
diff/home: Diff home files
install/nvim: Install nvim files
diff/nvim: Diff nvim files
make: Nothing to be done for 'help'.

Facts

Mon, 01 Jan 0001 00:00:00 +0000

Filesystem

Mon, 01 Jan 0001 00:00:00 +0000

Firewall

Mon, 01 Jan 0001 00:00:00 +0000

Forgejo

Mon, 01 Jan 0001 00:00:00 +0000

Forgejo

Mon, 01 Jan 0001 00:00:00 +0000

Forgejo runner

Mon, 01 Jan 0001 00:00:00 +0000

Global DNS records

Mon, 01 Jan 0001 00:00:00 +0000

Global-only owners use this entrypoint with the shared module API to avoid requiring RouterOS configuration. The combined module also delegates its Cloudflare resources here, so both entrypoints share one implementation. Normalization returns all declared views, but this entrypoint owns only global records. Mixed-view owners use the parent module to manage dc1 as well.

Enabled global records use the explicit cloudflare_zone_id when supplied. Otherwise, the pinned cloudflare_zone data source resolves the configured zone name and rejects missing or ambiguous matches. This requires zone-list and zone-read access in addition to record permissions. Disabled ownership and declarations without global records perform no zone lookup.

Gpg

Mon, 01 Jan 0001 00:00:00 +0000

Harboer

Mon, 01 Jan 0001 00:00:00 +0000

head

Mon, 01 Jan 0001 00:00:00 +0000

Changelog6

Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

head

Mon, 01 Jan 0001 00:00:00 +0000

Changelog141

Lay the project index out as a single-column section list

The card grid read as a separate component next to the rest of the site. The /projects/ index now uses the same section list as the documentation index: one entry per project under the Projects heading, separated by panel lines, each entry carrying its description, status, and tags. The entries stay in alphabetical order.

head

Mon, 01 Jan 0001 00:00:00 +0000

Changelog117

Lay the project index out as a single-column section list

The card grid read as a separate component next to the rest of the site. The /projects/ index now uses the same section list as the documentation index: one entry per project under the Projects heading, separated by panel lines, each entry carrying its description, status, and tags. The entries stay in alphabetical order.

head

Mon, 01 Jan 0001 00:00:00 +0000

Changelog40

Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

head

Mon, 01 Jan 0001 00:00:00 +0000

Changelog33

Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

head

Mon, 01 Jan 0001 00:00:00 +0000

Changelog19

Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

head

Mon, 01 Jan 0001 00:00:00 +0000

Changelog50

Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

head

Mon, 01 Jan 0001 00:00:00 +0000

Changelog33

Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

head

Mon, 01 Jan 0001 00:00:00 +0000

Changelog19

Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

head

Mon, 01 Jan 0001 00:00:00 +0000

Changelog50

Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

head

Mon, 01 Jan 0001 00:00:00 +0000

Changelog28

Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

head

Mon, 01 Jan 0001 00:00:00 +0000

Changelog30

Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

head

Mon, 01 Jan 0001 00:00:00 +0000

Changelog52

Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

Hermes

Mon, 01 Jan 0001 00:00:00 +0000

Hiddify manager

Mon, 01 Jan 0001 00:00:00 +0000

Hiddify manager with host

Mon, 01 Jan 0001 00:00:00 +0000

Host

Mon, 01 Jan 0001 00:00:00 +0000

Infinitime

Mon, 01 Jan 0001 00:00:00 +0000

This InfiniTime firmware fork adds a text watchface and a Pomodoro app. The repository packages the pinned firmware source and its build dependencies.

Features

Extra Watchface: Text
Extra app: Pomodoro
C++, embedded

Usage

The root workspace declares the pinned firmware with use_repo_rule in include.MODULE.bazel, preserving recursive Git submodules and the CMake toolchain patch. Firmware source is fetched when referenced, rather than during module resolution. Its Python/npm lockfiles and SDK archives retain the upstream pins; Python and Node runtimes use the root workspace toolchains. The project re-exports pip and npm with separate extension identities so unrelated Python/npm targets do not fetch firmware to read those lockfiles. The isolated pip extension declares the Linux x86_64 host platform used by the pinned ARM compiler archive. bazel mod deps deliberately evaluates all extensions and can still fetch it.

Install CA

Mon, 01 Jan 0001 00:00:00 +0000

K3s

Mon, 01 Jan 0001 00:00:00 +0000

K3s bootstrap

Mon, 01 Jan 0001 00:00:00 +0000

K3s cluster

Mon, 01 Jan 0001 00:00:00 +0000

K3s kubeconfig

Mon, 01 Jan 0001 00:00:00 +0000

Kustomization

Mon, 01 Jan 0001 00:00:00 +0000

This project contains Kubernetes Kustomization resources for Flux, Traefik, and cert-manager. It is still in progress.

Leetcode downloader

Mon, 01 Jan 0001 00:00:00 +0000

This project exports LeetCode submissions and generates documentation from submission files using a CLI and Bazel rules. A Tampermonkey script provides a browser-based download path; direct CLI downloads are currently blocked by LeetCode bot protection.

Features

CLI and bzl code to generate submission docs
Tampermonkey script to download submissions
CLI to download submissions (Doesn’t work because of bot protection)

Usage

Generate submission from a submission file

bazel run //projects/leetcode_downloader -- \
    --submissions-file "${PWD}/out/submissions.json" \
    --root-dir "${PWD}" \
    generate

Help

Usage of flags:
  -base_url string
    	 (default "https://leetcode.com")
  -cookie string

  -limit uint
    	 (default 20)
  -offset uint

  -root-dir string
    	 (default "${PWD}")
  -submissions-file string

lvg

Mon, 01 Jan 0001 00:00:00 +0000

lvg_volume_groups describes the complete desired physical-volume list for each volume group. Extra physical volumes are not removed unless a caller sets remove_extra_pvs: true.

Creating a volume group initializes every listed device as an LVM physical volume. Callers must resolve stable device paths and verify that each device is the intended, unused disk before applying this role; pvcreate may overwrite an existing disk signature.

lvol

Mon, 01 Jan 0001 00:00:00 +0000

Each lvol_volumes entry can constrain allocation with pvs, pass creation arguments with opts, and disable shrinking with shrink: false.

MCP Cordis

Mon, 01 Jan 0001 00:00:00 +0000

mcp_cordis is a standalone stdio MCP server that mounts runtime JavaScript packages through Cordis. It is intentionally an MCP server, not a Codex plugin bundle.

Reusable definitions are ordinary ESM files in projects/mcp_cordis/plugins, listed by projects/mcp_cordis/cordis.yaml. Disposable definitions use the same layout under out/<task>/mcp_cordis/runs/<run>/. Each run writes a bounded manifest with explicit task, run, worker, information, budget, retention, lock, and cleanup fields. AGENT_TASK_ID, AGENT_RUN_ID, and AGENT_WORKER_ID may provide stable identities; the launcher otherwise creates process-scoped identities. Every package is addressed by both scope and name, so a scratch package never silently shadows a reusable package.

Model

Mon, 01 Jan 0001 00:00:00 +0000

`org.sonatype.nexus.repository.view.Response`

etag: c849a44121f823c806f604d6568d9e89 (class java.lang.String)
last_modified: 2021-10-22T15:57:10.000Z (class org.joda.time.DateTime)
hashCodesMap: (class java.util.HashMap)
    org.sonatype.nexus.common.hash.HashAlgorithm@7ce01bd8: bcbb583a5a4b4767de8ac020dea3d54011fee961
    org.sonatype.nexus.common.hash.HashAlgorithm@5a3efc26: deaf32dcd9ab821e359cd8330786bcd077604b5c5730c0b096eda46f95c24a2d
    org.sonatype.nexus.common.hash.HashAlgorithm@5b0c0740: c849a44121f823c806f604d6568d9e89
org.sonatype.nexus.repository.storage.Asset:
  metadata: (AttachedEntityMetadata)
    schema: assetPath
    document:
      "#74:0": >-
        bucket:#57:1,format:pypi,last_updated:Fri Jul 01 12:46:21 UTC 2022,attributes:[5],component:#65:0,
        name:packages/pip/21.3.1/pip-21.3.1-py3-none-any.whl,size:1723581,content_type:application/zip,created_by:anonymous,
        created_by_ip:80.78.253.49,blob_ref:default@E1F281C2-0A159DAD-4208CEFD-524F990B-0B4DDE11:739a4ecb-73fc-4422-a7d7-c93c8ad069c6,
        last_downloaded:Fri Jul 01 04:44:03 UTC 2022,blob_created:Wed Jun 29 07:01:34 UTC 2022,blob_updated:Wed Jun 29 07:01:34 UTC 2022
    name: packages/pip/21.3.1/pip-21.3.1-py3-none-any.whl
org.sonatype.nexus.repository.cache.CacheInfo:
  lastVerified: 2022-07-01T12:46:21.457Z
  cacheToken: 'null'

`org.sonatype.nexus.repository.view.Request`

org.apache.shiro.subject.support.DefaultSubjectContext.SESSION_CREATION_ENABLED: false (class java.lang.Boolean)
Key[type=org.sonatype.nexus.security.SecurityFilter, annotation=[none]].FILTERED: true (class java.lang.Boolean)
authcAntiCsrf.FILTERED: true (class java.lang.Boolean)
nx-authc.FILTERED: true (class java.lang.Boolean)
org.apache.shiro.web.servlet.ShiroHttpServletRequest_SESSION_ID_URL_REWRITING_ENABLED: false (class java.lang.Boolean)
javax.servlet.include.servlet_path: /repository/pypi/packages/pip/21.3.1/pip-21.3.1-py3-none-any.whl (class java.lang.String)
nexus.user.principal: admin (class java.lang.String)
nx-anonymous.FILTERED: true (class java.lang.Boolean)
nexus.user.id: admin (class java.lang.String)
nx-apikey-authc.FILTERED: true (class java.lang.Boolean)

`org.sonatype.nexus.repository.view.Context`

security.authorized: true (class java.lang.Boolean)
nexus.analytics.format_request_rates.marked: true (class java.lang.Boolean)
com.sonatype.nexus.repository.pypi.AssetKind: PACKAGE (class com.sonatype.nexus.repository.pypi.AssetKind)
local.attribute.org.sonatype.nexus.repository.view.handlers.HandlerContributor.extended: true (class java.lang.Boolean)
org.sonatype.nexus.repository.view.matchers.token.TokenMatcher$State: >-
  org.sonatype.nexus.repository.view.matchers.token.TokenMatcher$1@19f23c0b ((class org.sonatype.nexus.repository.view.matchers.token.TokenMatcher$1))

`org.sonatype.nexus.repository.Repository`

proxy: (class java.util.HashMap)
  contentMaxAge: 0.0
  remoteUrl: https://pypi.org
  metadataMaxAge: 0.0
negativeCache: (class java.util.HashMap)
  timeToLive: 0.0
  enabled: false
storage: (class java.util.HashMap)
  strictContentTypeValidation: false
  blobStoreName: default
httpclient: (class java.util.HashMap)
  blocked: false
  connection:
    useTrustStore: true
    autoBlock: false

`org.sonatype.nexus.repository.storage.Asset`

checksum: (class org.sonatype.nexus.common.collect.DetachingMap)
  sha1: bcbb583a5a4b4767de8ac020dea3d54011fee961
  sha256: deaf32dcd9ab821e359cd8330786bcd077604b5c5730c0b096eda46f95c24a2d
  md5: c849a44121f823c806f604d6568d9e89
cache: (class org.sonatype.nexus.common.collect.DetachingMap)
  last_verified: Fri Jul 01 13:07:08 UTC 2022
provenance: (class org.sonatype.nexus.common.collect.DetachingMap)
  hashes_not_verified: false
pypi: (class org.sonatype.nexus.common.collect.DetachingMap)
  summary: The PyPA recommended tool for installing Python packages
  author: The pip developers
  description: ...
content:
  etag: c849a44121f823c806f604d6568d9e89
  last_modified: Fri Oct 22 15:57:10 UTC 2021

`org.sonatype.nexus.repository.view.Content`

etag: c849a44121f823c806f604d6568d9e89
last_modified: 2021-10-22T15:57:10.000Z (class org.joda.time.DateTime)
hashCodesMap: (class java.util.HashMap)
  org.sonatype.nexus.common.hash.HashAlgorithm@3d97cbd0: deaf32dcd9ab821e359cd8330786bcd077604b5c5730c0b096eda46f95c24a2d, org.sonatype.nexus.common.hash.HashAlgorithm@675317cb=c849a44121f823c806f604d6568d9e89
  org.sonatype.nexus.common.hash.HashAlgorithm@67bcbee7: bcbb583a5a4b4767de8ac020dea3d54011fee961
  org.sonatype.nexus.repository.storage.Asset: (class org.sonatype.nexus.repository.storage.Asset)
    metadata: (AttachedEntityMetadata)
      schema: assetPath
      document: (#74:0)
        bucket: #57:1
        format: pypi
        last_updated: Fri Jul 01 13:25:15 UTC 2022
        attributes: [5]
        component: #65:0
        name: packages/pip/21.3.1/pip-21.3.1-py3-none-any.whl
        size: 1723581
        content_type: application/zip
        created_by: anonymous
        created_by_ip: 80.78.253.49
        blob_ref: default@E1F281C2-0A159DAD-4208CEFD-524F990B-0B4DDE11:739a4ecb-73fc-4422-a7d7-c93c8ad069c6
        last_downloaded: Fri Jul 01 04:44:03 UTC 2022
        blob_created: Wed Jun 29 07:01:34 UTC 2022
        blob_updated: Wed Jun 29 07:01:34 UTC 2022
      name: packages/pip/21.3.1/pip-21.3.1-py3-none-any.whl
org.sonatype.nexus.repository.cache.CacheInfo: (class org.sonatype.nexus.repository.cache.CacheInfo)
  lastVerified: 2022-07-01T13:25:14.841Z
  cacheToken: 'null'

Mount

Mon, 01 Jan 0001 00:00:00 +0000

Mount entries can set opts, dump, and passno; state: mounted keeps the mount active and writes its persistent /etc/fstab entry.

Nexus security plugin

Mon, 01 Jan 0001 00:00:00 +0000

This plugin allows you to perform a check every time an artifact is requested from a repository

Features

A request handler that checks all requests to repositories
Capability controlling the request handler
A task that periodically updates the capability using a remote source
Sonatype Nexus 3 plugin
Java

Flow

Opencode

Mon, 01 Jan 0001 00:00:00 +0000

OpenHands automation

Mon, 01 Jan 0001 00:00:00 +0000

Runs the OpenHands automation server natively from a uv-managed virtual environment. It stores schedules and event triggers, tracks run lifecycle, and dispatches conversations to the agent server.

The automation server is not a sandbox. It records which agent server should run a dispatched conversation and hands that work to AUTOMATION_AGENT_SERVER_URL; setting that variable selects the agent server’s local mode, which uses a persistent local agent server instead of managed OpenHands Cloud sandboxes.

OpenHands canvas

Mon, 01 Jan 0001 00:00:00 +0000

Runs the OpenHands Agent Canvas browser client from the published npm package. The service listens on loopback port openhands_canvas_port; TLS, the public hostname, and routing to the agent server and automation API belong to the deployment’s Traefik role.

The service runs the package’s scripts/static-server.mjs directly with Node, an explicit loopback host, and the package’s build/ directory. It serves the browser client without starting an agent server, an automation server, or the npm launcher’s additional ingress process. Agent Canvas owns no conversation or automation state and executes no tools.

Openhands server

Mon, 01 Jan 0001 00:00:00 +0000

Runs the OpenHands agent server natively from a uv-managed virtual environment. It hosts conversations, executes tools, and streams events for Agent Canvas. The service binds loopback only; TLS and external reachability belong to the calling deployment.

Set openhands_server_secure to true to require a session API key. The unsecured mode omits the session key and is only appropriate where the loopback boundary is trusted.

The caller can set openhands_server_install_packages to false and install openhands_server_packages through its host-specific package workflow. OSTree hosts use the shared dev_vm package entry point and must boot into a deployment containing those dependencies before installing the service. They also set openhands_server_service_path under /etc/systemd/system.

OS

Mon, 01 Jan 0001 00:00:00 +0000

Playbooks

Mon, 01 Jan 0001 00:00:00 +0000

Posgresql

Mon, 01 Jan 0001 00:00:00 +0000

Proto

Mon, 01 Jan 0001 00:00:00 +0000

Pve

Mon, 01 Jan 0001 00:00:00 +0000

PVE cluster

Mon, 01 Jan 0001 00:00:00 +0000

PVE VM

Mon, 01 Jan 0001 00:00:00 +0000

Pve vm qemu

Mon, 01 Jan 0001 00:00:00 +0000

PVE VM remove

Mon, 01 Jan 0001 00:00:00 +0000

Changelog52

Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

Renders

Mon, 01 Jan 0001 00:00:00 +0000

This project owns reusable Blender assets, their controlling references, and acceptance evidence bound to exact candidate bytes. Maintained work uses the project OpenSpec workspace.

The Reimu Fumo work lives under assets/reimu_fumo/. Its reusable asset target will be added only after a candidate passes the visual, structural, animation, and exact-byte delivery gates in Reimu Fumo change. That change preserves the open outcome, blocked execution and original goal history.

Working candidates and intermediate renders belong under the repository-root out/reimu_fumo_finish/ directory. They are not accepted or durable merely because they exist there. A historical packet may move into the source tree only when exact bytes and provenance are verified and it is labeled with its actual rejected or accepted state.

Roles

Mon, 01 Jan 0001 00:00:00 +0000

Rules

Mon, 01 Jan 0001 00:00:00 +0000

Sri

Mon, 01 Jan 0001 00:00:00 +0000

sri calculates Subresource Integrity hashes for files using OpenSSL. Its command-line interface accepts an input file and a digest algorithm, such as SHA-256.

Features

Cli app that calculates SRI using OpenSSL
C, OpenSSL

Usage

Usage: sri [OPTION...]
Generate sri of a file

Example:
    bazel run //projects/sri -- --digest sha256 --file ${PWD}/README.md

  -d, --digest=String        Digest type (sha256, for example)
  -f, --file=Path            Path to the file to parse
  -?, --help                 Give this help list
      --usage                Give a short usage message

SSH

Mon, 01 Jan 0001 00:00:00 +0000

SSH port forwarding

Mon, 01 Jan 0001 00:00:00 +0000

SSH update known hosts

Mon, 01 Jan 0001 00:00:00 +0000

T3 Code

Mon, 01 Jan 0001 00:00:00 +0000

Terraform backend

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

This service stage consumes the project DNS declaration through the shared global DNS module. The DNS workflow uses the project’s AppRole, HTTP state backend, and Cloudflare credentials. This public-only module does not require RouterOS. Ordinary service commands retain their tf=main authentication, including PVE login.

Operational commands require the project AppRole and Vault provider fields in the migration prerequisites. dns_enabled defaults to true after verified adoption. Keep it enabled to retain existing records; disabling it would propose deletion. The zone input remains optional.

Tf modules

Mon, 01 Jan 0001 00:00:00 +0000

This project contains reusable Terraform modules for Vault configuration, Proxmox virtual machines, backup storage, and related infrastructure. The module collection is still in progress.

Features

Terraform modules

Traefik

Mon, 01 Jan 0001 00:00:00 +0000

Traefik (old)

Mon, 01 Jan 0001 00:00:00 +0000

Update all packages

Mon, 01 Jan 0001 00:00:00 +0000

Useless QT GUI

Mon, 01 Jan 0001 00:00:00 +0000

Useless QT GUI is a desktop application built with C++ and Qt. Its Bazel build uses a pinned Qt distribution without requiring a system Qt installation.

Features

Desktop GUI
C++, Qt

Build

The Bazel build downloads a SHA-256-pinned Qt 6.8.3 distribution through rules_qt; a system Qt installation is not required. The project previously targeted Qt 6.9.0. Using 6.8.3 is a deliberate downgrade to the LTS version supported and tested by the pinned rules_qt release.

Users

Mon, 01 Jan 0001 00:00:00 +0000

Vault

Mon, 01 Jan 0001 00:00:00 +0000

Vault approle

Mon, 01 Jan 0001 00:00:00 +0000

Vault approle

Mon, 01 Jan 0001 00:00:00 +0000

Vault OIDC provider

Mon, 01 Jan 0001 00:00:00 +0000

Vault pki server

Mon, 01 Jan 0001 00:00:00 +0000

Vault ssh server role

Mon, 01 Jan 0001 00:00:00 +0000

Vault transit key

Mon, 01 Jan 0001 00:00:00 +0000

Wireguard

Mon, 01 Jan 0001 00:00:00 +0000

Xray

Mon, 01 Jan 0001 00:00:00 +0000

Links:

https://xtls.github.io/en/

Yc folder

Mon, 01 Jan 0001 00:00:00 +0000