* incus-pet: per-app incus container CLI ("pet PaaS"); drop webapps/
Phase 1 of the incus-pet design. Adds the deployment infrastructure
under modules/nixos/linux/incus/ — a CLI, a container-essentials NixOS
module, a SKILL.md for agent-driven adoption — and deletes the webapps/
tree (nspawn-based, weaker isolation defaults, no live consumers).
Pairs with srid/anywhen#15 (nixosModules.incus on the anywhen flake)
for end-to-end deployment of anywhen as an incus container.
Surface added:
- modules/nixos/linux/incus/container.nix container essentials
(sshd, hostname, flakes, firewall, base packages); imported by the
marshaling flake incus-pet generates per app
- modules/nixos/linux/incus/incus-pet/ CLI tree:
default.nix writeShellApplication; subcommands deploy/list/rm
SKILL.md 3-branch agent recipe (deploy / wrapper / add
contract upstream)
README.md human docs with the full network-model section
- modules/flake-parts/incus-pet.nix exposes packages.incus-pet
Surface removed:
- modules/nixos/linux/anywhen.nix anywhen runs as a
container now, not as a host-installed service
- configurations/nixos/pureintent drops the anywhen import
and the services.anywhen.host wiring
- webapps/ deleted entirely
Port convention: every containerized service binds 8080 inside its
own netns. The host-side <listen-ip>:<host-port> is unique per app,
chosen at first deploy via --port + --listen (or INCUS_PET_LISTEN
env), and recorded in container metadata so re-deploys are flagless.
Run:
nix run .#incus-pet -- deploy github:srid/anywhen \
--port 7700 --listen 100.122.32.106
See modules/nixos/linux/incus/incus-pet/README.md for the operator
flow and the network model in full.
* incus-pet: fixes discovered while deploying the hello-web example
Three small fixes that fall out of doing the first live deploy on
pureintent. None change the design — they make the documented flow
actually work against the real images:nixos/25.11 container image and
the real `nixos-rebuild --target-host` activation path.
* container.nix imports `${modulesPath}/virtualisation/lxc-container.nix`
so the rebuilt config knows it's a container — without it,
`nixos-rebuild` fails the `boot.loader.grub.devices` / `fileSystems`
assertions. Same module the upstream NixOS incus image's
/etc/nixos/configuration.nix imports.
* container.nix carries the same dbus-broker reload workaround
pureintent already has (NixOS#180175-ish symptom — broker has long-
lived clients holding the bus, reload times out,
switch-to-configuration exits 4 despite activation succeeding).
* incus-pet/default.nix:
- bootstrap step simplified: the official nixos/25.11 image already
runs sshd via systemd socket activation on :22 — we only need to
push the operator's pubkey. The earlier in-container
`nixos-rebuild switch` is unnecessary (and breaks because the
image ships without a nixpkgs channel).
- `NIX_SSHOPTS='-o StrictHostKeyChecking=accept-new'` for the
--target-host rebuild (fresh containers have fresh host keys).
- `incus config set <name> key=value` form (the space-separated
form deprecated in incus 6.x; was emitting a warning per metadata
key on every deploy).
- Image baseline `images:nixos/25.05` → `images:nixos/25.11`
(25.05 isn't published on the LXC image server; 25.11 is the
current stable).
End-to-end verified: `incus-pet deploy github:srid/anywhen` deploys
into a container reachable on the host's tailscale IP; the same path
works for the hello-web example (stacked PR).
* incus-pet: hello-web example flake — minimal contract demonstration
Self-contained reference under
modules/nixos/linux/incus/incus-pet/example/hello-web/ that satisfies
the incus-pet contract in the smallest possible form:
- packages.<sys>.default a darkhttpd wrapper that serves a
one-page index.html, reading HOST/PORT
from the environment
- nixosModules.default services.hello-web.{enable, package,
host, port} + a DynamicUser=true systemd
unit
- nixosModules.incus the deploy contract: services.hello-web
bound to 8080, hostname "hello-web"
Useful as a copy-paste template for new apps. Less moving parts than
the anywhen reference (no bun, no SQLite, no state dir, no e2e tests
to keep green) — just three flake outputs and a static HTML response.
Live-deployed end-to-end on pureintent during this PR's bring-up:
$ incus-pet deploy path:./.../example/hello-web hello-web \
--port 8081 --listen 100.122.32.106
$ curl http://100.122.32.106:8081/
<!doctype html>
<h1>Hello from incus-pet</h1>
Idempotent re-deploy verified (no flags needed — host-port + listen
read back from container metadata; container name auto-detected from
incus.container.hostname).
* incus-pet: drop anywhen wiring from this PR — defer to follow-up
Per request: keep this PR strictly to the incus-pet infrastructure +
the hello-web example. The anywhen migration (replacing the host-
installed services.anywhen on pureintent with an incus-pet container)
lands in a separate follow-up PR after srid/anywhen#15 merges.
Restored from master:
- modules/nixos/linux/anywhen.nix (was deleted)
- configurations/nixos/pureintent/default.nix (had anywhen import
+ services.anywhen.host
removed; now back)
- flake.nix anywhen.url (was repinned to
incus-contract; back to
abject-turn)
- flake.lock anywhen entry (matches the abject-turn
pin again)
The hello-web example remains the live verification for this PR.
* docs: Ralph report scaffolding + pureintent eval baseline (10.87s)
* cycle-1: drop nixvim — pureintent eval 10.87s → 6.98s (-36%)
nixvim's home-manager module system is by far the dominant cost of
evaluating `nixosConfigurations.pureintent`: a profile of selective
imports puts it at 3.97s of the 10.87s baseline (~36%).
Replace it with a minimal `programs.neovim.enable = true` configuration.
The runtime behaviour of `nvim` changes (no plugins, no LSP, no
mapleader/telescope/treesitter/etc.) — accepted by the user.
Measured on srid-nc (nixos, 6.12.85 kernel), 7 warm-cache runs with
`--option eval-cache false`:
baseline: 10.85 10.86 10.86 10.87 10.87 10.88 10.91 -> median 10.87s
cycle-1: 6.94 6.96 6.98 6.98 7.02 7.02 7.73 -> median 6.98s
Other configurations still evaluate:
- nixosConfigurations.naiveintent
- darwinConfigurations.infinitude-macos
- homeConfigurations."srid@zest"
Removes flake input `nixvim` (+ its `flake-parts`, `nixpkgs`, `systems`
sub-inputs from the lock).
* docs: wrap up Ralph report (10.87s -> 6.99s = -35.7%)
7 dead-ends documented so they don't have to be re-tried. Key
finding: after dropping nixvim (cycle 1), the eval floor is
home-manager's per-entry submodule materialisation
(systemd.user.services / programs.ssh.matchBlocks), not the
option-declaration count of any wrapper module. Inlining
jumphost-nix or vira moves the cost; it does not eliminate it.
* Enable incus on pureintent, rename lxd.nix, drop unused flake-parts
- Add incus module import to pureintent and bind the UI to its
Tailscale IP (no firewall change needed since tailscale0 is trusted).
- Rename modules/nixos/linux/lxd.nix -> incus.nix since the module
configures virtualisation.incus, and enable the bundled web UI.
- Drop the unused modules/flake-parts/incus-image helper; the
`images:nixos/*` community images cover container/VM launches.
* Move incus module into a directory with a README
The troubleshooting notes used to live as comments in the module; they
belong in docs alongside a quick-start on launching containers/VMs and
configuring the UI listener.
* Expand incus README with VM gotchas
Document the sharp edges hit while bringing up a NixOS VM for the first
time: secureboot, memory/cpu/disk limits (with the error signatures
that point at each), configuring the guest (flakes, firewall), and a
three-step guide to exposing a service from inside.
