From 169dab71a063f4fab6c46f95e11d6e85b140cb8f Mon Sep 17 00:00:00 2001 From: Craig Jennings Date: Sun, 9 Aug 2026 11:20:43 -0500 Subject: feat: enable the podman API socket and ship the camera udev grant Two one-time machine setups from the winvm handoffs now happen at install time. - The devops podman block enables the rootless podman API socket. Socket-activated, so it costs nothing idle, and API clients like Pods fail with an empty window without it. enable_user_service grew an optional wants-target argument because a socket unit's [Install] is WantedBy=sockets.target. The old default.target link would never socket-activate. - install_camera_passthrough_rules ships 72-usb-passthrough-cameras.rules: GROUP="video", MODE="0660" plus the uaccess tag on the OBSBOT and BRIO USB IDs, so usbredirect can claim them for VM passthrough. The filename is load-bearing: logind's ACL is applied by 73-seat-late.rules, so the tag only works from a file sorting below 73. A test pins that property. Both are live on ratio (the old 99- rules file is retired there). Whether uaccess alone would suffice from the corrected position is untested and stays documented as a hypothesis. --- todo.org | 92 +++++++++++++++++++++++++++++++++++++++++----------------------- 1 file changed, 59 insertions(+), 33 deletions(-) (limited to 'todo.org') diff --git a/todo.org b/todo.org index 5daacf2..68f790d 100644 --- a/todo.org +++ b/todo.org @@ -54,20 +54,22 @@ The full todo.org sweep you asked for before sleeping, ranked by what I'd fix before departure (~2026-08-15, velox travels). Approve, reorder, or strike; items needing your call say so. -1. Velox reliability (the anchor — [#A] sleep/suspend, scheduled Monday). - Prerequisite: velox powered on and on the tailnet; it's been offline since - ~2026-08-05. Riders already folded in: the tlp.d radio-enable line, a - dotfiles pull, the touchpad-detection spot-check. +1. Velox reliability (the anchor — [#A] sleep/suspend, rescheduled Wed + 2026-08-12). Velox is out for repair/upgrade until Tuesday or Wednesday + (Craig, 2026-08-08), so every velox item waits for its return — a tight + but workable window before the ~08-15 departure. Riders already folded + in: the tlp.d radio-enable line, a dotfiles pull, the touchpad-detection + spot-check. 2. Velox machine health for travel (NEW — filed nowhere else): resolve the ~/code/auto-dim-other-buffers.el merge conflict (literal conflict markers in a loaded .el; its emacs suite has been red since 2026-08-01), clear the stale password prompt sitting on its screen since 2026-07-31, and run a maint doctor pass. 3. Remote access verified from OUTSIDE the LAN while you're still home: - tailscale to ratio, truenas, and truenas-kvm from a phone hotspot. Decide - whether the wolf WireGuard profile should also work from velox on the road - (it exists on ratio only, inactive). Cheap now, expensive to debug from a - hotel. + tailscale to ratio, truenas, and truenas-kvm from a phone hotspot. + DECIDED (Craig, 2026-08-08): the wolf WireGuard profile gets set up on + velox when it returns Tue/Wed — added to the velox-return riders. Cheap + at home, expensive to debug from a hotel. 4. The cgit secrets/privacy audit ([#B] below): a world-readable secret standing while you're away is the worst timing. The repo-by-repo scan is mine to run; the public-vs-private call per repo is yours. The archsetup @@ -82,11 +84,20 @@ items needing your call say so. if you disagree). Found tonight, low priority: the orchestrator sequence pin can't see an added-but-unstubbed call (it caught drops only) — worth a harness hardening pass someday. -** TODO [#B] Podman API socket and camera-passthrough udev rule :feature:solo: +** DONE [#B] Podman API socket and camera-passthrough udev rule :feature:solo: +CLOSED: [2026-08-09 Sun] :PROPERTIES: :CREATED: [2026-08-07 Fri] :LAST_REVIEWED: 2026-08-07 :END: +Shipped 2026-08-09: the installer enables the rootless podman socket at +install time (enable_user_service grew a wants-target arg so socket units +land in sockets.target.wants) and ships +=72-usb-passthrough-cameras.rules= — numbered below 73 per the winvm +rule-ordering correction, GROUP/MODE as the verified grant, uaccess tag kept. +Applied live on ratio (socket enabled+active, 99- file retired, udev +reloaded); velox apply rides the velox-return riders on the sleep/suspend +task. The uaccess-alone hypothesis stays untested until a camera is attached. From winvm 2026-08-07 (ratio). Two one-time machine-level setups, both live on ratio and absent on velox; full evidence and rationale in [[file:docs/design/2026-08-07-podman-socket-and-camera-udev.md]]. @@ -97,12 +108,17 @@ ratio and absent on velox; full evidence and rationale in (Pods opens to an empty window). The installer already carries the "=systemctl --user enable= fails during install" workaround pattern (=archsetup:1270=, =:2722=) — use it. -- Ship =/etc/udev/rules.d/99-usb-passthrough-cameras.rules= granting - GROUP="video", MODE="0660" on the OBSBOT (3564:ff02) and BRIO (046d:085e) - USB nodes so =usbredirect= can claim them for VM passthrough. The - hard-won finding: =TAG+="uaccess"= alone does NOT work — logind doesn't ACL - raw =/dev/bus/usb/*= nodes; the GROUP/MODE grant is what works. Keep the tag - anyway (harmless, correct in principle). +- Ship a udev rule granting GROUP="video", MODE="0660" on the OBSBOT + (3564:ff02) and BRIO (046d:085e) USB nodes so =usbredirect= can claim them + for VM passthrough. CORRECTED (winvm, 2026-08-08): the original "uaccess + can't ACL raw USB nodes" claim was wrong — the mechanism is rule ordering. + The ACL is applied by =73-seat-late.rules=, so a =99-= rule adds the tag + after that already ran; distro rules that add the tag all sort at or below + 70. So number our file below 73 (e.g. =72-usb-passthrough-cameras.rules=), + keep the verified GROUP/MODE grant, and keep the tag — correctly ordered it + may make uaccess work on its own (untested hypothesis; a tighter grant if + it holds, needs the camera plugged in to verify). Reconcile ratio's + existing =99-= file (winvm installed it) when the installer version lands. Scope: installer step + rule file + tests per existing shapes, and apply both live to velox over tailscale (daily-driver sync — neither exists there today). @@ -1182,7 +1198,7 @@ Read recommended resources to make informed security decisions (see metrics for Practical guidelines for working in public spaces ** TODO [#A] Ensure sleep/suspend works on laptops -SCHEDULED: <2026-08-10 Mon> +SCHEDULED: <2026-08-12 Wed> :PROPERTIES: :LAST_REVIEWED: 2026-08-08 :END: @@ -1192,12 +1208,18 @@ drain must be verified working before departure. Verification plan: apply the params, suspend velox, measure overnight drain; the hands-on resume check is Craig's (a manual-testing entry rides the fix). -While on velox for this (it was offline 2026-08-08, so these ride along): +While on velox for this (out for repair until ~2026-08-11/12, so these ride +along when it returns): - Append =DEVICES_TO_ENABLE_ON_STARTUP="bluetooth wifi"= to its =/etc/tlp.d/01-custom.conf= (the installer now writes it; velox predates that) and confirm radios unblocked after reboot. - Pull dotfiles so the touchpad auto-detection lands; spot-check =touchpad-auto --detect= prints the pixa name on real hardware. +- Set up the wolf WireGuard profile (Craig's 2026-08-08 decision: velox + should reach home over wolf on the road; profile exists on ratio only). +- Enable the rootless podman socket and install the + =72-usb-passthrough-cameras.rules= file (both live on ratio as of + 2026-08-09; the installer now ships both, velox predates it). Critical functionality for laptop use - current battery drain unacceptable *NOTE:* This applies to Framework Laptop (velox), not Framework Desktop (ratio) Add kernel parameter: ~rtc_cmos.use_acpi_alarm=1~ (will become systemd default) @@ -1960,33 +1982,37 @@ Grading: Minor severity (legibility on a shipped chip, nothing broken) × freque Offer a period-appropriate selector for timer duration, likely drawing on the tape-counter idiom, while preserving the existing direct-entry path. -** TODO [#C] Order network-panel connections by availability :feature:network: +** TODO [#C] Order network-panel connections by availability :feature:network:solo: :PROPERTIES: -:LAST_REVIEWED: 2026-08-08 +:LAST_REVIEWED: 2026-08-09 :END: Present saved and currently available networks in this order: available saved profiles, available unsaved networks, then saved profiles that are unavailable. -Held on a design conflict (recorded 2026-07-19, folded in at the 2026-08-08 -review): this wants one tiered list, but the network-panel spec says "three -labelled groups, never one merged list" with Saved MRU-first. Craig's call -before build: reorder within the Saved group only, or merge into one list and -override the spec. Not :solo: until that's answered. +*** 2026-08-09 Sun @ 11:13:15 -0500 Design conflict resolved; now :solo: +Craig, 2026-08-09: sort available-first within the Saved group (available +saved MRU-first, unavailable saved below), keeping the spec's three labelled +groups intact — no merged list. Escalate to a merge later only if it still +reads wrong in use. -** TODO [#C] Indicate hotspot or metered WiFi in amber :feature:network:waybar: +** TODO [#C] Indicate hotspot or metered WiFi in amber :feature:network:waybar:solo: :PROPERTIES: -:LAST_REVIEWED: 2026-08-08 +:LAST_REVIEWED: 2026-08-09 :END: Detect hotspot/metered connectivity and render the WiFi icon plus SSID amber, while ordinary WiFi stays white. -Held on two design questions (recorded 2026-07-19, folded in at the 2026-08-08 -review), both Craig's call before build: -- "Hotspot" is ambiguous — connected to a phone's hotspot, or this machine - running an AP? Which one (or both) goes amber? -- Metered detection needs new nmcli reads on the status fast path, whose - contract is one nmcli call. Bend the contract, or find a zero-cost signal? -Not :solo: until both are answered. +*** 2026-08-09 Sun @ 11:13:15 -0500 Both design calls answered; now :solo: +Craig, 2026-08-08/09: amber means connected to a phone's hotspot (this +machine running an AP does not trigger it), and the one-nmcli-call fast-path +contract stays intact. Build shape: NetworkManager's metered flag is the +detector (Android tethering auto-flags via the DHCP vendor hint; NM's +GENERAL.METERED yes/guessed-yes on the active wifi device), read by the +slow-path probe and written into the connectivity cache the fast path +already consumes, so the indicator pays nothing new. Where NM can't guess +(some iPhones), the per-connection metered flag is the manual override; a +panel affordance for it can come later. Live phone-hotspot check is Craig's +manual-testing entry; everything else verifies with fakes. ** CANCELLED [#C] Add a whole-display dim mode :feature:hyprland: CLOSED: [2026-08-08 Sat] -- cgit v1.2.3