some

configurations/home/srid@zest.nix

@@ -37,6 +37,7 @@ in
     "localhost"
     "sincereintent"
     "pureintent"
+    "naiveintent"
     "vanjaram.tail12b27.ts.net"
     "nix-infra@rasam.tail12b27.ts.net"
   ];

configurations/nixos/naiveintent/default.nix

@@ -6,7 +6,7 @@ let
   homeMod = self + /modules/home;
 in
 {
-  nixos-unified.sshTarget = "srid@192.168.2.219";
+  nixos-unified.sshTarget = "srid@naiveintent";
   nixos-unified.localPrivilegeMode = "sudo-nixos-rebuild";
 
   security.sudo.extraRules = [
@@ -24,13 +24,17 @@ in
   imports = [
     self.nixosModules.default
     ./configuration.nix
+    (self + /modules/nixos/linux/llm-debugging.nix)
   ];
 
   users.users.${flake.config.me.username}.linger = true;
   home-manager.sharedModules = [
     "${homeMod}/services/kolu.nix"
     {
-      services.kolu.host = "192.168.2.219"; # Tailscale IP of pureintent
+      services.kolu.host = "100.78.88.70"; # Tailscale IP of naiveintent
+      # Browser origin differs from the Host kolu sees (served via Tailscale
+      # MagicDNS reverse proxy), so allow it for the CSWSH origin gate.
+      services.kolu.allowedOrigins = [ "https://naiveintent.rooster-blues.ts.net" ];
     }
 
     "${homeMod}/nix/gc.nix"

configurations/nixos/pureintent/default.nix

@@ -32,6 +32,7 @@ in
     ./devbox.nix
     (self + /modules/nixos/linux/beszel.nix)
     (self + /modules/nixos/linux/incus)
+    (self + /modules/nixos/linux/llm-debugging.nix)
   ];
 
   # anywhen runs as an incus-pet container (see modules/nixos/linux/incus/incus-pet).