prod-pins/modules/README.md

NixOS modules

import ./default.nix { inherit self; } returns default, iota, omikron, omega, and client. default imports all four component modules. The flake's existing conditional import accepts this interface directly.

These new files must be included in the consuming Git checkout for Git-backed flake evaluation. Verification used path: to include the untracked modules.

All options live under tensamin, with no services.tensamin wrapper or legacy services.iota, services.omikron, or services.omega aliases.

Interfaces

All components have enable, package, bindAddress, port, and openFirewall. Services are disabled by default. Package defaults resolve via self.packages.${pkgs.stdenv.hostPlatform.system}.

Component	Package	Bind address	Port	Open firewall
tensamin.iota	iota-daemon	0.0.0.0	1984	true
tensamin.omikron	omikron	0.0.0.0	443	true
tensamin.omega	omega	0.0.0.0	443	true
tensamin.client	client-web	127.0.0.1	8080	false

Iota, Omikron, and Omega open TCP and UDP. Client opens only TCP when requested.

Iota

• stateDir, cacheDir, runtimeDir, logDir default to /var/lib/iota, /var/cache/iota, /run/iota, /var/log/iota.
• assetDir defaults to the central iota package's pinned source static/web directory. This is upstream's shipped asset directory, currently containing its 404 page, not the client application. Override it to serve other assets.
• webMode is network by default, or loopback or disabled. Upstream requires TLS for both enabled modes. Set bindAddress explicitly for loopback.
• certFile and keyFile are nullable runtime path strings, supplied together. An enabled listener requires them unless settingsFile supplies complete TLS configuration.
• omegaApiUrl defaults to https://omega.tensamin.net.
• environmentFiles is a list of runtime path strings, defaulting to [].
• settings contains YAML-compatible operator configuration, defaulting to {}. Module listener and asset options take precedence. Startup rewrites the mutable stateDir/config.yaml, preserving omitted iota_id, omikron_host, omikron_port, and omikron_id. Explicit values, including null, override them. Other daemon/operator edits to this file are replaced at the next startup.
• settingsFile is a nullable runtime path string. It replaces generated settings, with the same preservation of omitted discovery fields. Its listener and TLS settings must agree with the module's firewall and capability options. Relative paths resolve against stateDir, not the source file's directory.

The systemd service and socket are named iota. IPC uses ${runtimeDir}/iota.sock, mode 0660, owned by iota:iota. Add authorized operators to the iota group. Daemon identities remain under ${stateDir}/identity; the module does not reseed them. Exit code 75 forces a restart. Config paths, deployment mode, supervisor, and all mutable directories are passed through the upstream IOTA_* environment contract.

Omikron and Omega

• stateDir defaults to /var/lib/omikron or /var/lib/omega and is the working directory of the matching systemd service and service user.
• Set either acmeCertDir, containing fullchain.pem and key.pem, or both certFile and keyFile. All are nullable runtime path strings. Startup copies the certificate to certs/cert.pem and converts the key to unencrypted PKCS8 at certs/key.pem, owned by the service user with mode 0600.
• identityFile and publicIdentityFile are nullable runtime path strings, supplied together. Startup copies them to omikron.mk and omikron.mpkb, or omega.mk and omega.mpkb. Null retains existing state or lets upstream generate an identity. Supplied identities are reapplied on every startup.
• environment is an attribute set of non-secret string settings, default {}. Module-generated listener and Omikron discovery variables take precedence.
• environmentFiles is a list of runtime environment paths, default []. Systemd loads these after the declared environment, so they can override it. Keep listener variables consistent with firewall options. Omega requires DB_URL; it uses file-based identities, not PRIVATE_KEY/PUBLIC_KEY.

Omikron also requires positive id and omegaTrustFile, the runtime Omega public key bundle copied to omega.mpkb. omegaHost defaults to tensamin.net and omegaPort to the upstream default 9187. Set it to the deployed Omega listener port, whose module default is 443. These become ID, OMEGA_HOST, OMEGA_PORT, RHO_PORT, and BIND_ADDRESS. Omega uses PORT and BIND_ADDRESS.

Trust and identity installation runs for both manual TLS and ACME. Configure certificate issuance separately and restart the corresponding service after renewal so it recopies certificates. Environment and secret path strings do not copy secret contents into the Nix store.

Client

hostName defaults to localhost. The module enables nginx and adds that virtual host with an explicit HTTP listener at bindAddress:port, using client-web's output root and SPA fallback to /index.html. Configure public TLS/proxy routing separately. It does not configure Anubis, guest accounts, or install the Electron client.

Verification

The combined module was evaluated with actual central package outputs in minimal x86_64-linux and aarch64-linux NixOS container configurations. All assertions passed and system.build.toplevel.drvPath evaluated. Checks included both server TLS branches, all services disabled, Iota disabled-listener mode, a custom Iota runtime directory, and a custom nginx listener. Missing Omikron TLS produces the intended assertion. Evaluation does not build or start the applications.