From 7e82b88c6c6f0516cc5108ffe98ee7264bd39c8c Mon Sep 17 00:00:00 2001
From: Patrick Dewey <p@pdewey.com>
Date: Sun, 11 Oct 2026 21:28:58 -0400
Subject: [PATCH] calypso: NixOS build #42

calypso: NixOS build #41

calypso: NixOS build #40
---
 nix/hosts/nixos/calypso/configuration.nix | 10 ++--
 nix/hosts/nixos/default.nix               |  1 +
 nix/services/connectome-ferb.nix          | 56 +++++++++++++++++++++++
 3 files changed, 61 insertions(+), 6 deletions(-)
 create mode 100644 nix/services/connectome-ferb.nix

diff --git a/nix/hosts/nixos/calypso/configuration.nix b/nix/hosts/nixos/calypso/configuration.nix
index 4deceb7..a1ead6a 100644
--- a/nix/hosts/nixos/calypso/configuration.nix
+++ b/nix/hosts/nixos/calypso/configuration.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ pkgs, inputs, ... }:
 
 let
   rocmEnv = pkgs.symlinkJoin {
@@ -163,6 +158,8 @@ in
     beam28Packages.elixir
     pnpm
     herdr
+    inputs.hunk.packages.${pkgs.stdenv.hostPlatform.system}.hunk
+    bun
 
     # Load rocm packages
     rocmEnv
@@ -224,6 +221,7 @@ in
   networking.firewall.allowedTCPPorts = [
     4000
     5173
+    7340
     8000
     8080
   ];
diff --git a/nix/hosts/nixos/default.nix b/nix/hosts/nixos/default.nix
index 68cf310..291d025 100644
--- a/nix/hosts/nixos/default.nix
+++ b/nix/hosts/nixos/default.nix
@@ -53,6 +53,7 @@
         modules = [
           ./calypso/configuration.nix
           ./calypso/home.nix
+          ../../services/connectome-ferb.nix
           inputs.sops-nix.nixosModules.sops
 
           {
diff --git a/nix/services/connectome-ferb.nix b/nix/services/connectome-ferb.nix
new file mode 100644
index 0000000..a83708b
--- /dev/null
+++ b/nix/services/connectome-ferb.nix
@@ -0,0 +1,56 @@
+{ pkgs, ... }:
+
+let
+  host = "/data/connectome-ferb/releases/2026-10-12-host-0.9.0";
+in
+{
+  users.groups.ferb = { };
+  users.users.ferb = {
+    isSystemUser = true;
+    group = "ferb";
+    home = "/var/lib/ferb";
+    createHome = true;
+    shell = "${pkgs.shadow}/bin/nologin";
+  };
+
+  systemd.services.connectome-ferb = {
+    description = "Ferb Connectome resident";
+    wantedBy = [ "multi-user.target" ];
+    unitConfig.ConditionPathExists = "/data/connectome-ferb/recipe.json";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+
+    path = [
+      pkgs.bun
+      pkgs.nodejs_24
+      pkgs.codex
+    ];
+
+    environment = {
+      HOME = "/var/lib/ferb";
+      DATA_DIR = "/var/lib/ferb/data";
+      CODEX_HOME = "/var/lib/ferb/.codex";
+      CODEX_BINARY = "${pkgs.codex}/bin/codex";
+    };
+
+    serviceConfig = {
+      Type = "simple";
+      User = "ferb";
+      Group = "ferb";
+      WorkingDirectory = host;
+      ExecStart = "${pkgs.bun}/bin/bun ${host}/src/index.ts /data/connectome-ferb/recipe.json --headless";
+      StateDirectory = "ferb";
+      StateDirectoryMode = "0700";
+      EnvironmentFile = "/var/lib/ferb/webui.env";
+      UMask = "0077";
+      Restart = "on-failure";
+      RestartSec = 5;
+      NoNewPrivileges = true;
+      PrivateTmp = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      InaccessiblePaths = [ "/data/models" ];
+      ReadWritePaths = [ "/var/lib/ferb" ];
+    };
+  };
+}
-- 
knotmirror 0.0.1