Sovran_Systems/Sovran_SystemsOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 11 Wiki Activity
2,326 Commits 2 Branches 15 Tags
09d4cc9b837b42d4ed6d8e6706b90df10c31742e
Commit Graph
170 Commits
Author SHA1 Message Date
Sovran Contributor 09d4cc9b83 nextcloud, postgresql: fix Nextcloud 35 DB warnings on 32 GB hosts 
Nextcloud 35's Database checks flag three Performance issues out of the
box: buffer cache hit ratio ~96% (wants 99%+), 100k+ dead tuples, and
million-plus sequential scans on oc_mail_tags / oc_guests_users.

Root causes in Sovran: stock 128MB shared_buffers, stock 60s autovacuum
naptime, APCu file locking, and db:add-missing-indices running exactly
once at install time (never on upgrades or app installs).

Size Postgres for the README's Server + Desktop recommendation (32 GB
RAM, NVMe): 2GB shared_buffers, 12GB effective_cache_size, 512MB
maintenance_work_mem, 32MB work_mem, 4GB max_wal_size, 30s autovacuum
naptime with 4 workers. shared_buffers stays below the 25% rule because
Postgres shares the box with bitcoind, Electrs, LND, MariaDB and PHP-FPM.

Scope the aggressive autovacuum to nextclouddb via ALTER DATABASE so the
shared matrix-synapse DB keeps the milder cluster defaults.

Add a local Redis (127.0.0.1:6379, Nextcloud only) and move
memcache.distributed/locking to Redis; migrate existing installs with a
one-shot since nextcloud-init never re-runs.

Add a weekly nextcloud-db-maintenance timer (VACUUM ANALYZE +
db:add-missing-*) so upgrades and later app installs can't regress the
checks again.

Note: shared_buffers needs one 'systemctl restart postgresql', which
briefly takes down both Nextcloud and Matrix. Everything else is
reload-only or scoped to nextclouddb.
 2026-09-21 13:59:52 -05:00
Sovran Systems 9ae4e34fe0 Switch LibreOffice from fresh to stable version 2026-09-03 16:31:12 -05:00
Sovran Systems 67ae53ad3f Add tor-browser to the package list 2026-08-17 19:10:19 -05:00
naturallaw777 5edf594eac Switch default browser to Brave Origin (brave-origin) 2026-08-15 16:58:33 -05:00
copilot-swe-agent[bot]andnaturallaw777 947c04834d Fix all 8 security hardening blockers for PR #423 
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-11 15:38:08 +00:00
copilot-swe-agent[bot]andnaturallaw777 a111de1ece Security hardening: fix all 8 blocking findings for PR #419 
Fix 1: Update support.js to collect SSH public key and POST JSON
Fix 2: Legacy njalla.sh migration - parse safely, archive non-executable, replace cron with systemd timer
Fix 3: DDNS SSRF prevention - allowlist only njal.la, reject other hosts, disable curl redirects
Fix 4: Legacy root support-key removal migration (_remove_legacy_root_support_key)
Fix 5: Automatic support-key expiration (expires_at + _expire_support_if_stale)
Fix 6: Move security helpers to security_helpers.py, tests import production code
Fix 7: Real NIP-19/Bech32 npub validation (_bech32_decode + _validate_npub)
Fix 8: Replace journalctl sudo wildcard with restricted sovran-journal-helper.py
Also: Make _write_hub_overrides() atomic with tempfile+os.replace
94 tests passing

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-11 12:07:18 +00:00
naturallaw777 bf9c6dd627 added onlyoffice 2026-06-24 13:19:41 -05:00
naturallaw777 1a8b18f5bc removed uneeded livekit-cli 2026-06-18 16:51:15 -05:00
naturallaw777 6c48a9e239 sync and removed element-desktop and bitwarden desktop 2026-06-05 10:29:20 -05:00
naturallaw777 2e9a2644d9 updated config for gnome 50 support 2026-05-27 11:15:09 -05:00
copilot-swe-agent[bot] 48428c9a82 Add resilient Nix download/fallback settings for hub update flows 2026-05-27 16:02:37 +00:00
copilot-swe-agent[bot]andnaturallaw777 c11910c2bd Harden flatpak-repo systemd service retries 
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/42ce6628-372d-4bd8-82c5-b10097fc8003

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-05-17 14:06:58 +00:00
naturallaw777 eff48cafa2 blocked rxrpc kernal moduel 2026-05-08 15:20:18 -05:00
naturallaw777 970b9a6741 fix for gnome keyring 2026-04-30 11:42:35 -05:00
copilot-swe-agent[bot]andnaturallaw777 e58c645429 Fix GNOME Keyring permission issue: move tmpfiles rules to user level 
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/3ed85d6b-ada9-48e1-941f-1150e1491157

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-04-30 16:32:36 +00:00
naturallaw777 64371c5572 fix for gnome keyring 2026-04-30 10:46:58 -05:00
copilot-swe-agent[bot]andnaturallaw777 25e00bd1f1 refactor: use systemd.tmpfiles for GNOME Keyring, simplify reset scripts 
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/71dab9c7-081f-4e45-80c2-080e88ae6207

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-04-30 13:52:27 +00:00
copilot-swe-agent[bot]andnaturallaw777 2c2b2c6687 Remove Plymouth, add quiet boot params, add cpu-performance module 
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/eda71495-cd38-4408-8d3b-b9d793f6445f

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-04-30 00:33:32 +00:00
naturallaw777 19fa297b24 cleaned up code 2026-04-14 08:49:26 -05:00
copilot-swe-agent[bot]andnaturallaw777 c97406a915 Move firewall ports to their respective service modules 
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/e4dbc0e0-e273-4e3e-a1ec-059ae9b06a50

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-04-14 13:45:51 +00:00
copilot-swe-agent[bot]andnaturallaw777 b6ac6174fe Fix: BTCPay off by default in Node role, Caddy conditional ACME/ports 
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/2e2b84a8-c5e9-4eea-8bee-fc587bb3a6fa

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-04-13 22:55:37 +00:00
copilot-swe-agent[bot]andnaturallaw777 2b26472505 fix: disable auto-login, diceware passwords, improved security reset UX, fix GNOME keyring 
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/82a54a25-4844-4a41-afcc-c034cebbd6ed

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-04-12 15:08:25 +00:00
copilot-swe-agent[bot]andnaturallaw777 6c8627ae25 fix: suppress Brave keyring prompt via --password-store=basic and PAM GNOME Keyring auto-unlock 
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/731f35e7-10c0-4641-8ec4-bd02f0dc98b4

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-04-09 00:03:09 +00:00
naturallaw777 988af9ecc7 updated locals 2026-04-08 12:18:52 -05:00
naturallaw777 2e84f83d37 updated for user timezonez and languges and removed unsued code 2026-04-08 12:12:47 -05:00
copilot-swe-agent[bot]andnaturallaw777 203e3495f5 Fix Hub false closed port detection: is_listening alone is sufficient; add nftables package 
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/b57cc894-c639-400e-93f0-c1dc5d48870b

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-04-07 12:47:03 +00:00
copilot-swe-agent[bot]andnaturallaw777 ef1e2706f2 feat: move sshd into its own Nix feature module, gate Tech Support behind it 
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/d45dc36f-0b3b-48bb-950f-700afe45dd06

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-04-05 15:09:02 +00:00
naturallaw777 d2bd55d166 syntax error 2026-04-05 09:27:38 -05:00
naturallaw777 1655b0bc10 closed unused ports 2026-04-05 09:16:03 -05:00
copilot-swe-agent[bot]andnaturallaw777 7000435552 Add Avahi mDNS hostName override and Caddy .local block for sovransystemsos.local LAN access 
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/ca3945d7-a2cb-4121-bd89-a5e3fe31fc47

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-04-04 00:40:24 +00:00
copilot-swe-agent[bot]andnaturallaw777 4e70a267d8 Revert hostName/mDNS/Caddy .local block changes from PR #34 
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/8d17fed2-7329-442e-bfa5-a96a38fb31e4

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-04-04 00:24:10 +00:00
copilot-swe-agent[bot]andnaturallaw777 4c237f7aa7 feat: enable mDNS (Avahi) and local reverse proxy for sovransystemsos.local 
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/4159c571-2bfb-48fc-a6bc-e0765ef88ef6

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-04-03 21:08:21 +00:00
copilot-swe-agent[bot]andnaturallaw777 7cc53e1763 Eliminate hub-overrides.nix: write feature toggles into custom.nix instead 
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/db82f216-af3e-4d7f-a972-86c03f23e069

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-04-03 14:28:24 +00:00
naturallaw777 91004c06b6 updated wiring for hub feature enable 2026-04-03 09:07:07 -05:00
naturallaw777 9ad9b7505e Remove systemd-manager GNOME extension, replaced by Sovran Hub 2026-03-31 16:46:02 -05:00
naturallaw777 ff27c3fb4c fixed retooling for flake.nix 2026-03-29 07:41:26 -05:00
naturallaw777 5747a18691 small retooling for flake.nix 2026-03-29 07:38:06 -05:00
naturallaw777 5accb18e7c updated branding and some retooling 2026-03-29 07:13:22 -05:00
naturallaw777 0343077c7c remove erronius gnome setting 2026-03-29 00:38:38 -05:00
naturallaw777 fc56919ee8 updated pdf creator and overall theme 2026-03-29 00:33:21 -05:00
naturallaw777 01f2912960 added robust iso 2026-03-28 08:47:35 -05:00
naturallaw777 4fafa1cd17 removed agenix 2026-03-27 20:45:09 -05:00
naturallaw777 be984d0293 removed x11 2026-03-27 15:53:24 -05:00
naturallaw777 0899ddd55c updated configuration 2026-03-27 15:04:54 -05:00
naturallaw777 0af9dce098 initial retooling 2026-03-27 14:29:26 -05:00
naturallaw777 e1e9376792 initial retooling 2026-03-27 14:23:08 -05:00
naturallaw777 2b5bc3a036 added livekit lk-jwt 2026-03-25 07:19:08 -05:00
naturallaw777 af00a49ac4 added modules link 2026-03-24 17:10:37 -05:00
naturallaw777 4c646883dc fixed typo 2026-03-24 16:45:02 -05:00
naturallaw777 0427d85220 fixed loop 2026-03-24 16:43:38 -05:00