hmm

systems/x86_64-linux/jallen-nas/default.nix

@@ -287,6 +287,9 @@ in
       options = [
         "version_upgrade=incompatible"
         "nofail"
+        # Allow bcachefs to self-heal journal errors (e.g. duplicate entries from unclean shutdown)
+        # instead of refusing to mount with fsck_errors_not_fixed.
+        "errors=fix_safe"
       ];
     };
   };

systems/x86_64-linux/jallen-nas/disabled.nix

@@ -23,22 +23,29 @@ in
             ai = mkForce disabled;
             arrs = mkForce disabled;
             attic = mkForce disabled;
+            bookshelf = mkForce disabled;
             authentik = mkForce disabled;
             authentikRac = mkForce disabled;
+            caddy = mkForce disabled;
             calibre = mkForce disabled;
             calibre-web = mkForce disabled;
             code-server = mkForce disabled;
             collabora = mkForce disabled;
+            coturn = mkForce disabled;
             crowdsec = mkForce disabled;
+            databasus = mkForce disabled;
             dispatcharr = mkForce disabled;
             tunarr = mkForce disabled;
             free-games-claimer = mkForce disabled;
             gitea = mkForce disabled;
             glance = mkForce disabled;
             glances = mkForce disabled;
+            grafana = mkForce disabled;
+            guacd = mkForce disabled;
             headscale = mkForce disabled;
             immich = mkForce disabled;
             jellyfin = mkForce disabled;
+            kavita = mkForce disabled;
             seerr = mkForce disabled;
             lubelogger = mkForce disabled;
             manyfold = mkForce disabled;
@@ -56,8 +63,12 @@ in
             paperless-ai = mkForce disabled;
             protonmail-bridge = mkForce disabled;
             restic-server = mkForce disabled;
+            sparky-fitness-server = mkForce disabled;
+            sparky-fitness = mkForce disabled;
+            suggestarr = mkForce disabled;
             sunshine = mkForce disabled;
             tdarr = mkForce disabled;
+            termix = mkForce disabled;
             unmanic = mkForce disabled;
             uptime-kuma = mkForce disabled;
             wyoming = mkForce disabled;
@@ -65,6 +76,7 @@ in
         };
 
         services = {
+          mysql = mkForce disabled;
           postgresql = mkForce disabled;
         };
       };

systems/x86_64-linux/jallen-nas/sops.nix

@@ -351,19 +351,6 @@ in
         ];
       };
 
-      # Grafana reads ntfy credentials via systemd EnvironmentFile so the
-      # $__env{} provider works in alerting provisioning YAML.  The file
-      # provider ($__file{}) only works in grafana.ini, not in provisioning.
-      "grafana.env" = {
-        content = ''
-          GRAFANA_NTFY_USER=${config.sops.placeholder."jallen-nas/ntfy/user"}
-          GRAFANA_NTFY_PASSWORD=${config.sops.placeholder."jallen-nas/ntfy/password"}
-        '';
-        mode = "0400";
-        owner = "grafana";
-        restartUnits = [ "grafana.service" ];
-      };
-
       # CrowdSec HTTP notification plugin config with credentials baked in.
       # The plugin process spawned by crowdsec/cscli reads this file directly.
       # Credentials are embedded in the URL using HTTP basic auth so no

systems/x86_64-linux/jallen-nas/users.nix

@@ -53,6 +53,14 @@ in
 
       # Prometheus reads bearer_token_file for the Gitea scrape job at runtime.
       prometheus = {
+        isSystemUser = true;
+        group = "prometheus";
+        extraGroups = [ "keys" ];
+      };
+
+      grafana = {
+        isSystemUser = true;
+        group = "grafana";
         extraGroups = [ "keys" ];
       };
 
@@ -67,6 +75,8 @@ in
     groups = {
       nextcloud-exporter = { };
       crowdsec = { };
+      prometheus = { };
+      grafana = { };
       nut.name = "nut";
       "jallen-nas".name = "jallen-nas";
     };