| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
The unconditional change-password re-keyed the account on every run,
clobbering any password changed in-band and locking out clients.
|
|
nginx terminates tls on 6697 and proxies to the socket, created 0770
ergo:ergo. With the ergo group empty the workers got EACCES and every
client saw a tls handshake then silence (bitten on web after the 26.04
reboot).
|
|
Nothing references them: no play in main.yaml, no meta dependency.
|
|
26.04 ships nodejs 22, so no repo.homebridge.io vendor repo (its
package bundled a private node runtime). npm installs homebridge, the
role provides the unit, and the previously undefined dir and package
vars get defaults.
|
|
The v2 api was sunset july 2026 (http 410). Fill v3 returns the
download url and sha256 directly. Passing the checksum to get_url also
makes version bumps take effect: without it the download was skipped
whenever server.jar existed.
|
|
- rpi-base: log2ram from the archive, drop the azlux repo (which still
pointed at debian buster)
- aws-s3-backup: apt awscli (v2) instead of pip v1; drop boto3, nothing
used it
- scrypted, koreader-sync: docker.io and docker-compose-v2 instead of
the docker.com repo pinned to noble; the docker-ce removal lives in
cleanup-third-party.yaml since the packages collide on files
- miniflux: the archive package with a dbconfig preseed; drops the
github binary download and the bundled unit
- prometheus/client: note the nginx and postgres exporters are in apt
- dendrite/build, nostr/build: unversioned golang-go instead of pinned
golang-1.21-go and a hand symlink that shadowed the real go
|
|
Nothing consumes it: no play in main.yaml and no role dependency.
26.04 ships nodejs 22 in apt anyway, so any future consumer can just
apt install it.
|
|
26.04 ships elixir 1.18.3, the exact version the role pinned from
upstream zips, so the download/unarchive tasks and version vars go
away. Resolves the TODO waiting on this release.
|
|
|
|
26.04 no longer ships setfacl by default; without it, ansible tasks
that become an unprivileged user (postgres) fail on temp-file perms
when pipelining is unavailable (async tasks).
|
|
|
|
relayer had Requires= without After=, which does not order startup;
soju's packaged unit has no postgres ordering at all, so both raced
the postgres socket at boot and stayed failed. Adds After= to the
relayer unit and a systemd drop-in for soju.
|
|
Passwords containing '/' are invalid unencoded in a url authority and
break Go's url.Parse (invalid port after host). Latent until a restart
forced a config re-read. jinja urlencode leaves '/' unescaped, hence
the extra replace.
|
|
26.04 ships rustc 1.93, past the rs-matter 1.87 floor that forced
rustup on 24.04. Drops the toolchain install tasks and RUSTUP_HOME.
|
|
infocmp fails when ansible runs from a terminal without a compiled
terminfo entry (e.g. emacs eshell, TERM=emacs); treat that as skip
instead of failing the play.
|
|
The role only started the unit; nothing enabled it, so a reboot left
transmission down until the next playbook run.
|
|
- Rename role dir and all vars from mattertimesync to mattertimectl
- Rename the server subrole to controller
- Build via cargo instead of npm; run the binary directly (no node)
- Default fabricLabel to "Matter Time Controller"
|
|
Renders the new mattertimesync fabricLabel field (the label other Matter
ecosystems display for this controller, e.g. the Apple Home Connected
Services subtitle) with the app default. Labels must be unique per
device, so instance overrides should not reuse another admin's label.
|
|
Each build role now creates build_work_dir itself and sets its own toolchain's
cache env (GOPATH/GOCACHE/GOMODCACHE, CARGO_HOME, npm cache, MIX/HEX) on its
build tasks, so the roles are self-contained instead of relying on a play-level
environment and pre_task.
|
|
community.general.archive (>=10) compresses a lone file into a bare .gz instead
of a tarball, so the mattertimesync/bin/nostr artifacts failed the server-side
unarchive. Set force_archive: true so the archive module emits a real
single-member .tar.gz, consistent with the multi-file dendrite/pleroma builds.
|
|
Node release tarballs use arm64/x64, not the kernel's aarch64/x86_64, so the
download URL 404'd on the arm64 Pis. Map the common arches and fall back to the
raw architecture value.
|
|
Move every build role's working dir off /tmp (the SD card) to {{build_work_dir}},
which the playbook points at the SSD on the build host. nostr and pleroma stage
their artifacts inside their own build dirs so the shared work dir can't collide,
while preserving the archive top-level names (relayer, release) that the server
roles depend on.
|
|
Build role compiles the tagged source on the build host (npm ci + npm run
bundle) into a versioned mattertimesync-<ver>.tar.gz in build_srv_dir. Server
role installs the single bundled .mjs, creates the mattertimesync service user
and a 0700 storage dir for the Matter fabric keys, templates config.json, and
runs a hardened oneshot sync via a systemd timer. Both roles depend on the
nodejs role for Node >=20.
|
|
Deploys the openHop MeshCore repeater on a Raspberry Pi with a RAK6421
WisMesh Pi HAT: installs the daemon into a venv from a versioned git tag,
templates config.yaml and a systemd unit, and loads board pin maps and RF
region presets by name from vars/. identity_file is configurable and
defaults to null (daemon generates its own keypair).
|
|
|
|
cred.conf.j2 now emits the single-line dns_cloudflare_api_token form (scoped
Cloudflare API Token) instead of the legacy account-wide email + global API key.
prosody.sh.j2 deploy hook now no-ops unless $RENEWED_LINEAGE matches the prosody
vhost, so unrelated lineage renewals (haskell.social, etracapital.com) no longer
report a spurious "Hook reported error code 1 / No certificate for host found".
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
|
|
|
|
- Add pleroma/build role to compile from source (OTP binaries no longer published)
- Install Elixir 1.18.3 manually on Ubuntu Noble (ships 1.14, needs 1.15+)
- Standardize all build roles to produce versioned .tar.gz artifacts
- Add version defaults to all server roles (bin, dendrite, nostr/relayer)
- Switch server roles from get_url to unarchive for .tar.gz installs
- Add build_srv_dir variable to all build roles
- Deploy pleroma styles.json so custom FE themes appear in picker
- Fix pleroma OTP install: version check, root ownership, auto-cleanup old releases
- Fix pleroma config: log level :warn -> :warning, remove availableStyles
- Add wait_for grafana readiness before dashboard install
- Set minecraft ops changed_when: false
|
|
|
|
|
|
|
|
Add cgit_css_src, cgit_header_src, cgit_footer_src, cgit_owner variables to
optionally install a custom theme without hardcoding nth.io. Move scan-path
after enable-git-config in cgitrc so gitweb.owner is read from repo git
configs. Switch repo owner loop from find|while to glob for loop to avoid
subshell issues.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- Flatten DisplayController: remove _set() middle layer
- Inline on_ring() into _handle_protect_event (was a 2-line wrapper)
- Collapse triggered flag in touch monitor to single boolean expression
|
|
Always use sysfs backlight. vcgencmd resets DRM planes under fkms
making it incompatible with the drm video output. Removes
libraspberrypi-bin dependency and panel/vcgencmd dead code.
|
|
Always start mpv on demand (cold start). The warm path was fragile on
the RPi4 with fkms and added complexity without reliable benefit.
|
|
- prebuffer_mode=cold: mpv starts on demand at ring/touch event
- Add tty group to service user for DRM TTY access
- Log backlight brightness changes for diagnostics
- Remove --really-quiet suppression during debug (now restored)
|
|
- Switch to sysfs backlight (drm backend) to avoid DRM plane reset on
display power cycle caused by vcgencmd display_power
- Add udev rule and sysfs permissions for rpi_backlight
- Fix multi-packet WebSocket decoder (ring events were being dropped)
- Fix mpv loop/cache flags (--loop=no, bounded --demuxer-max-bytes)
- Remove hardware decode (caused SIGSEGV on RPi4 with fkms)
|
|
- Fix websockets headers kwarg via inspect (works across all versions)
- Use full path /usr/bin/vcgencmd; add libraspberrypi-bin dependency
- Fix UniFi Protect WS packet decoder to handle multiple concatenated
packets per message (action+data in single frame)
- Fetch lastUpdateId from bootstrap for WS URL
- Switch fbcon disable from video=HDMI-A-1:D to fbcon=map:99 (fkms compat)
- Default drm_connector to DSI-1 for fkms; drop hardcoded drm_mode
- Add --no-audio and --hwdec=no to mpv; fix DRM mode-setting race on startup
- Add PoE HAT fan control with configurable temp thresholds
|
|
|
|
Prevents emergency mode on boot if the external drive is absent.
|
|
RPi4 portrait touchscreen that shows a live UniFi Protect RTSP stream
on doorbell ring or touch, with display fully off at idle. Supports
warm prebuffer, vcgencmd/drm/panel display backends, evdev touch input,
and configurable DRM device/connector/mode.
|
|
|
