- firewall.nix: allow DNS (UDP/TCP 53) from all podman bridge networks
(10.89.0.0/16); NixOS only auto-adds a rule for podman0 but docker-compose
arion stacks land on podman1/2/3 where container DNS was silently blocked
- vnc-desktop/start.sh: rm stale /tmp/.X1-lock on container start so
container restarts don't leave Xvnc unable to bind display :1
- linux.nix: TasksMax=infinity on arion-vnc-desktop so the systemd cgroup
doesn't cap KDE Plasma's thread count below the container pids limit
- arion-riverside/arion-compose.nix: add ADMIN_PASS env var required by
the riverside entrypoint
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Break systemd ordering deadlock: nginx.after mkForce removes
DNS-challenge ACME services (philippeterson, webdav) from nginx's
After list, which was creating a cycle through nginx-config-reload
back to HTTP-webroot ACME services that need nginx Before them.
- Fix arion services not finding podman socket: arion NixOS module
sets backend=podman-socket but doesn't inject DOCKER_HOST; add
explicit DOCKER_HOST=unix:///run/podman/podman.sock for all three
arion projects.
- Fix gitea-runner startup race: add After/Wants on arion-forgejo so
the runner doesn't try to register before Forgejo is up.
- Fix riverside image reference: pinned digest was stale after a
re-push; switch to :latest.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
riverside needs a postgres sidecar which oci-containers can't express.
Also adds docker to arion PATH (fixes forgejo-arion) and creates
/var/riverside/{files,postgres} state directories.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
