tadata

configurations/home/srid@zest.nix

@@ -16,7 +16,7 @@ in
 
     "${homeMod}/services/obsidian.nix"
     "${homeMod}/services/kolu.nix"
-    "${homeMod}/services/drishti.nix"
+    "${homeMod}/services/drishti"
 
     # Remote builders
     "${homeMod}/nix/buildMachines"
@@ -31,6 +31,16 @@ in
 
   services.kolu.host = "100.90.229.113"; # Tailscale IP of zest
 
+  # The pu-managed kolu-ci-* hosts are reachable only from pureintent, so they
+  # live in pureintent's drishti (see configurations/nixos/pureintent), not here.
+  services.drishti.hosts = [
+    "localhost"
+    "sincereintent"
+    "pureintent"
+    "vanjaram.tail12b27.ts.net"
+    "nix-infra@rasam.tail12b27.ts.net"
+  ];
+
   home.packages = [
     inputs.disc-scrape.packages.${pkgs.stdenv.hostPlatform.system}.default
     pkgs.zellij-one

configurations/nixos/pureintent/default.nix

@@ -4,6 +4,10 @@ let
   inherit (flake) inputs;
   inherit (inputs) self;
   homeMod = self + /modules/home;
+  # pu-managed CI fleet (kolu-ci-1 .. kolu-ci-8). These are ssh_config aliases
+  # provided by `pu` (Include ~/.pu-state/*/ssh_config) and are reachable only
+  # from pureintent, so drishti monitors them from here.
+  ciHosts = map (n: "kolu-ci-${toString n}") (lib.range 1 8);
 in
 {
   nixos-unified.sshTarget = "srid@pureintent";
@@ -45,8 +49,11 @@ in
     "${homeMod}/work/juspay.nix"
     "${homeMod}/services/vira.nix"
     "${homeMod}/services/kolu.nix"
+    "${homeMod}/services/drishti"
     {
       services.kolu.host = "100.122.32.106"; # Tailscale IP of pureintent
+      # Watch the pu-managed CI fleet from here (only reachable from pureintent).
+      services.drishti.hosts = [ "localhost" ] ++ ciHosts;
     }
 
     # "${homeMod}/services/dropbox.nix"

flake.lock

@@ -284,15 +284,16 @@
         "bun2nix": "bun2nix"
       },
       "locked": {
-        "lastModified": 1780322958,
+        "lastModified": 1780748089,
-        "narHash": "sha256-j6byUEKeSQTU0RzicwQYzmA/LXsb8R4HfSQiVEBql80=",
+        "narHash": "sha256-sKO9DI/RSKxuFdhS/wacG+jcmxSgqIMKx4LSYV+NTQE=",
         "owner": "srid",
         "repo": "drishti",
-        "rev": "348ba132c8ca2c56346b554c9f93a1f9a3f8a070",
+        "rev": "df90c231c250105d2123fb77468ad2d1e03e164a",
         "type": "github"
       },
       "original": {
         "owner": "srid",
+        "ref": "surface-siblings",
         "repo": "drishti",
         "type": "github"
       }
@@ -855,15 +856,16 @@
     },
     "kolu": {
       "locked": {
-        "lastModified": 1780419147,
+        "lastModified": 1780754638,
-        "narHash": "sha256-8L95BwxCF2yb2q1dfoKR/EoJUOjfMLz4RGt/ZnTuABU=",
+        "narHash": "sha256-c3Kd2VyMbAE8rSce05DmvnakMqa/u8Tx9gk7Q1TONlE=",
         "owner": "juspay",
         "repo": "kolu",
-        "rev": "43ac4be0153d6c49a3289e56c527507edcf8b1b7",
+        "rev": "30e28f72dca5ea9e817d63fc31b2c6244c7c547d",
         "type": "github"
       },
       "original": {
         "owner": "juspay",
+        "ref": "surface-nested-mounts",
         "repo": "kolu",
         "type": "github"
       }

flake.nix

@@ -36,10 +36,11 @@
     jumphost-nix.flake = false;
 
     # KOLU
-    kolu.url = "github:juspay/kolu";
+    kolu.url = "github:juspay/kolu/surface-nested-mounts";
 
     # drishti remote host monitor (home-manager module)
-    drishti.url = "github:srid/drishti";
+    # Temporarily on PR #49 (surface-siblings); revert to master once merged.
+    drishti.url = "github:srid/drishti/surface-siblings";
 
     # anywhen is NOT a flake input — it's deployed as an incus-pet
     # container, with the flake ref passed at deploy time (see

modules/home/services/drishti/default.nix

@@ -1,4 +1,4 @@
-{ flake, config, pkgs, ... }:
+{ flake, pkgs, ... }:
 
 let
   inherit (flake) inputs;
@@ -8,10 +8,12 @@ in
     inputs.drishti.homeManagerModules.default
   ];
 
+  # Generic enabler. The host list is machine-specific (zest watches the
+  # tailnet boxes; pureintent watches its pu-managed CI fleet), so each
+  # consuming config sets `services.drishti.hosts`.
   services.drishti = {
     enable = true;
     package = inputs.drishti.packages.${pkgs.stdenv.hostPlatform.system}.default;
     port = 7720;
-    hosts = [ "localhost" "sincereintent" "pureintent" "vanjaram.tail12b27.ts.net" "nix-infra@rasam.tail12b27.ts.net" ];
   };
 }

modules/home/services/drishti/kolu-ci.nix

@@ -1,16 +0,0 @@
-{ lib, ... }:
-let
-  # kolu-ci-1 .. kolu-ci-8
-  ciHosts = map (n: "kolu-ci-${toString n}") (lib.range 1 8);
-in
-{
-  # The CI hosts are reachable only *through* pureintent, so hop via ProxyJump.
-  # `ssh kolu-ci-N` then works transparently — and so does drishti's agent
-  # spawn / nix-system probe / `nix copy`, which are all just `ssh <host>`.
-  # See drishti's "Hosts behind a bastion (SSH hops)" docs (PR #50).
-  # NOTE: drishti forces BatchMode=yes, so pureintent must be key-based
-  # (non-interactive) from wherever this runs — which it already is.
-  programs.ssh.matchBlocks = lib.genAttrs ciHosts (_name: {
-    proxyJump = "pureintent";
-  });
-}