The root filesystem filled up, so ~/Code/projects/anotherim moved to
/mnt/data. Bind-mount it back to its old path so tools that refer to it
by path (Claude Code project memory, git worktrees, dev flakes) keep
working. /mnt/data is plain ext4, not LUKS; that tradeoff was accepted
for the move.
Assisted-by: Claude:opus-5-5
DPI on some uplinks throttles WireGuard. Tunnel everything through Xray
VLESS + REALITY with post-quantum VLESS Encryption on tun1. Routes in
the main table that are more specific than the default (LAN, wg*
prefixes) keep priority; prefixes listed in the routes secret are
forced through the tunnel. The client's own uplink is fwmarked so it
never loops back into tun1.
UDP sessions on the tun device stay pinned to a dead mux link after
suspend or Wi-Fi loss, so restart the client on resume and whenever
NetworkManager brings up a new uplink. Stopping the unit removes all
the rules and routes.
Secrets come from secrets/dpi-tunnel.yaml through sops. Only the
.example skeleton is tracked.
Assisted-by: Claude:opus-5-5
A second boot entry with Xfce on Xorg via LightDM, matching the
desktop where another.im's typing jitter shows up (2026-10-19), to
reproduce it here. GDM in GNOME 50 no longer starts Xorg sessions,
hence LightDM. The default entry is untouched.
Assisted-by: Claude:opus-5-5
Add modules/hostel-wifi.nix: per-SSID MAC randomization (iwd), disable
mDNS/LLMNR/NetBIOS, reject hostile IPv6 RAs, firewall LAN-side probing,
an nftables killswitch target allowing only tunnel egress + captive-portal
endpoints, NTS-secured time via chrony, and a captive-portal helper.
Import left commented out; toggle via 'untrusted on|off'.
Add nix-flatpak flake input and modules/gaming.nix managing Flatpak
remotes/packages declaratively: Bolt (Jagex launcher for RS3/OSRS) and
Sober (Roblox). Add Heroic and hyperplay-ext, plus Proton-GE for Steam.
Drops the old imperative runescape-launcher.
