forge
The lab's native arm64 build host. Boots off its installed NVMe and runs
services.buildHost(nix/services/build-host.nix) — Nix remote builder (nix.distributedBuilds), docker + buildx for native arm64 OCI image builds, and a harmonia binary cache fronted by nginx onforge.lolwtf.ca:80.NVMe-rooted. Config:
nix/hosts/forge.nix. Standard sd-image single-partition layout (sdImage.expandOnBoot = true); the NVMe is dedicated to root, unlike spore'sgrow-root-and-partition-storageservice which reserves the disk tail for/nfs/data.Fleet/spore publishes the signed RAM image used by forge's EEPROM HTTP fallback through
spore-native-boot-rackpi5.service.The EEPROM's own boot-order configuration lives outside the Nix closure and is applied by hand with
rpi-eeprom-config --edit— a stock EEPROM firmware update erases the enrolled signing key for the legacy HTTP path, so it needs re-enrolling before the next reboot after any such update.harmonia's signing key is decrypted from
nix/secrets/forge.sops.yaml; the public half is committed in the clear atnix/secrets/forge-harmonia-cache.puband is what clients pin innix.settings.trusted-public-keys. Cache URL:http://forge.lolwtf.ca.
Linked references 6
Operator-run ARM host builds always use Fleet/forge; use the exact pre-PR build command in Runbooks/Validate Infra Changes.
Operator-run ARM host builds always use Fleet/forge. Select forge as the Nix store so evaluation inputs, substitutions, and builds stay on the builder:
NFS/PXE, signed native-boot, and production DNS server. The HTTP/RAM chain is Fleet/forge's EEPROM fallback; folly monitors each service.
spore-native-boot-rackpi5.service (nix/services/spore-native-boot.nix) is the signed-RAM-image publisher for Fleet/forge. It signs boot.img with /var/lib/pi-boot-sign/private.pem, atomically switches the stable boot.img/boot.sig pair under /rackpi5-ram/, and publishes each squashfs as /<sha256>.squashfs. The signed initrd requests its pinned digest, so an activation cannot mix boot and root generations.
In the flake as nixosConfigurations.radiopi0 (nix/hosts/radiopi0.nix + nix/hardware/pi0.nix, shared with Fleet/blinkypi0). armv6l has no upstream binary cache and no board-support module, so Fleet/forge supplies its aarch64 cross-build platform — see Architecture/NixOS. Config is minimal: tailscale + ssh + wiringpi only.
| Host | Purpose | Hardware |
|---|---|---|
| Fleet/spore | NFS, PXE, signed native-boot, DNS and NTP | Pi 5 8 GB, NVMe |
| Fleet/capsule | DNS sinkhole and NTP | Pi 5 8 GB, NVMe |
| Fleet/forge | arm64 build host, harmonia cache, OCI builder | Pi 5 8 GB, NVMe |
| Fleet/homepi4 | kiosk | Pi 4B 8 GB, 7" touch display |
| Fleet/weatherpi4 | weather kiosk | Pi 4B 8 GB |
| Fleet/cloudpi4 | utility and CoreDNS canary | Pi 4B 4 GB |
| Fleet/radiopi0 | radio | Pi Zero W |
| Fleet/blinkypi0 | LED display | Pi Zero W |