Papzi homelab configurations

The homelab is split across several hosts configured as LXC containers on a Proxmox machine.

Troubleshooting

Immich

How to use immich-admin. Find the hash of the current version via systemd:

systemctl edit --runtime immich-server.service
sudo -u immich REDIS_SOCKET=/run/redis-immich/redis.sock DB_URL=postgresql:///immich?host=/run/postgresql /nix/store/1z28h62s8vn2rnmd8ja06dzwjpcbz3gp-immich-2.2.3/bin/immich-admin

IP

For convenience, once an IP is assigned it should be configured in PiHole with a .internal domain to simplify routing.

Auto-repair

PRs created by auto-update-pr.yaml (branch auto-update/<date>) are validated by .forgejo/workflows/auto-update.yaml:

1. Build — nix build for each LXC host (colmena). If all pass, nothing else happens.
2. Repair — on failure, comment on the PR, collect logs, and run the local Cursor SDK agent (scripts/auto-repair/auto-repair.mjs). The workflow then commits fix: auto-repair attempt N and pushes to the PR branch. A new synchronize event retriggers the loop.

Max 3 repair attempts (counted via commits on the PR branch). After that, the workflow comments and stops.

Model defaults to auto-smart. Override with a Forgejo repository variable CURSOR_MODEL.

Setup

Forgejo repo secrets (Settings → Actions → Secrets):

Secret	Purpose
MINE_API_TOKEN	Forgejo API (PR comments)
CURSOR_API_KEY	Cursor SDK auto-repair (local agent)

Optional repository variable CURSOR_MODEL overrides the default model (auto-smart).

Headless SDK runs with auto-smart require autoReview: true (set automatically in auto-repair.mjs when the model id contains auto). The repair agent is restricted to read/edit/grep/glob — shell and MCP need interactive approval the CI runner cannot provide.

The runner only needs nodejs in hostPackages (already configured in modules/services/forgejo-runner.nix).

Local workflow dry-run (same host packages as CI):

nix develop .#ci-test
ci -W .forgejo/workflows/auto-update.yaml --list

Services up and running

• Caddy
• Nextcloud
• Paperless-ngx
• Vaultwarden
• Authentik
• Immich
• Technitium DNS
• Plex
• Jellyfin
• Docker
• Searxng
• Zigbee2Mqtt
• Metrics: Grafana and Promethus

Services missing and TODO

• Uptime Kuma
• Authentik for Arr services
• Change mail notification provider
• Remove pc key from agenix secrets
• Remove passwordless SSH login for normal user

How to

Build

colmena apply

Check config

nix flake check

Jellyfin GPU (Minerva CT 121)

Unprivileged LXC: pass /dev/dri with Proxmox devN (PVE 8.1+). Guest GIDs are pinned to video=26 and render=303. On minerva:

ls -l /dev/dri
pct set 121 --dev0 /dev/dri/card0,gid=26
pct set 121 --dev1 /dev/dri/renderD128,gid=303
pct reboot 121

See hosts/jellyfin/proxmox-ct-121.conf. In the guest: ls -ln /dev/dri and sudo -u jellyfin vainfo.