feat(vps): enable IP forwarding for exit node support

Required so the host can route traffic as a Tailscale/Headscale exit node.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.codex/config.toml

@@ -0,0 +1,5 @@
+## Me
+
+[mcp_servers.nixos]
+command = "nix"
+args = ["run", "github:utensils/mcp-nixos", "--"]

TODO.md

@@ -1,3 +1 @@
-- Evaluate Plasma Manager when Plasma 6.7 support improves
 - Review system-wide package list periodically
-- Add additional hosts

home/emmatherock/neovim.nix

@@ -130,22 +130,23 @@
     plugins.which-key.enable = true;
 
     # --- AI agent: CodeCompanion, curated natively in nixvim ---
-    # Configured to reuse your existing `claude`/`gemini` CLI auth via ACP
+    # Configured to reuse your existing `claude`/`codex` CLI auth via ACP
-    # adapters instead of a separate Anthropic Console API key.
+    # adapters instead of a separate Anthropic Console/OpenAI API key.
     #
     # Verified against https://codecompanion.olimorris.dev/configuration/adapters-acp
     # (CodeCompanion >= v18.0.0, which is what's pinned by nixvim's nixpkgs as of
     # 2026-08). Two things changed from an older/assumed layout:
     #   - the default-adapter key is `interactions.chat.adapter`, not
     #     `strategies.chat.adapter` (renamed in v18.0.0);
-    #   - the built-in adapter names are `claude_code` and `gemini_cli` (no
+    #   - the built-in adapter name is `claude_code` (no `_acp` suffix) and
-    #     `_acp` suffix) and live under `adapters.acp.<name>`.
+    #     lives under `adapters.acp.<name>`.
     #
     # Neither adapter has a true zero-config mode that silently piggybacks on
     # an already-logged-in CLI session:
-    #   - gemini_cli: `defaults.auth_method = "oauth-personal"` reuses the
+    #   - codex: extends the built-in `codex` preset. `defaults.auth_method`
-    #     `gemini` CLI's own login — no key needed, closest thing to "just
+    #     accepts "api-key" | "chat-gpt" (confirmed against the docs above,
-    #     use my existing session".
+    #     not "chatgpt"/"openai-api-key"/"codex-api-key"). "chat-gpt" reuses
+    #     your ChatGPT/Codex CLI login instead of an OPENAI_API_KEY.
     #   - claude_code: there's no oauth-personal equivalent. Run
     #     `claude setup-token` once (ties to your Pro/Max subscription rather
     #     than a Console API key) and save the result to
@@ -155,8 +156,10 @@
     plugins.codecompanion = {
       enable = true;
       settings = {
-        interactions.chat.adapter = "claude_code"; # switch to "gemini_cli" per-chat
+        interactions.chat.adapter = "claude_code"; # switch to "codex" per-chat
+        interactions.inline.adapter = "claude_code";
         adapters.acp = {
+          opts.show_presets = false;
           claude_code.__raw = ''
             function()
               return require("codecompanion.adapters").extend("claude_code", {
@@ -166,16 +169,17 @@
               })
             end
           '';
-          gemini_cli.__raw = ''
+          codex.__raw = ''
             function()
-              return require("codecompanion.adapters").extend("gemini_cli", {
+              return require("codecompanion.adapters").extend("codex", {
                 defaults = {
-                  auth_method = "oauth-personal",
+                  auth_method = "chat-gpt",
                 },
               })
             end
           '';
         };
+        adapters.http.opts.show_presets = false;
           display.chat.window = {
           layout = "vertical";
           position = "right";

hosts/miku-homelab/default.nix

@@ -5,6 +5,7 @@
     ./hardware-configuration.nix
     ../../modules/profiles/desktop.nix
     ../../modules/profiles/server.nix
+    ../../modules/services/ollama.nix
     ../../modules/services/samba.nix
     ../../modules/system/home-profile.nix
     ../../modules/system/nix-ld.nix
@@ -157,5 +158,12 @@
     experimental-features = [ "nix-command" "flakes" ];
   };
 
+  zramSwap = {
+    enable = true;
+    algorithm = "zstd";
+    memoryPercent = 50;
+    priority = 100;
+  };
+
   system.stateVersion = "25.11";
 }

hosts/vps/default.nix

@@ -71,6 +71,12 @@
   boot.loader.systemd-boot.configurationLimit = 10;
   boot.loader.efi.canTouchEfiVariables = true;
 
+  # Required for this host to act as a Tailscale/Headscale exit node.
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+    "net.ipv6.conf.all.forwarding" = 1;
+  };
+
   time.timeZone = "America/Argentina/Buenos_Aires";
   i18n.defaultLocale = "en_US.UTF-8";
 

modules/services/ollama.nix

@@ -0,0 +1,35 @@
+{ pkgs, ... }:
+
+{
+  services.ollama = {
+    enable = true;
+    # `services.ollama.acceleration` does not exist (that option only lives on
+    # services.tabby); GPU backend selection for ollama is done by package choice.
+    package = pkgs.ollama-rocm;
+
+    # Same "don't expose services directly" pattern as the rest of the homelab:
+    # bind to localhost only. If this needs to be reachable from other devices
+    # later, put it behind Traefik + Headscale like the other services instead
+    # of opening it up directly.
+    host = "127.0.0.1";
+    port = 11434;
+
+    environmentVariables = {
+      # Ollama is on-demand by design: it loads a model into VRAM on the first
+      # request and unloads it after this much idle time. 5m is already the
+      # ollama default, set explicitly so it's not an implicit behavior.
+      OLLAMA_KEEP_ALIVE = "5m";
+    };
+
+    # RDNA4 (gfx1200/gfx1201, incl. the RX 9060 XT) has official ROCm support
+    # since ROCm 6.4.4. Verified on this host (2026-08-30) with rocmPackages.clr
+    # 7.2.3: `rocminfo` correctly reports "Name: gfx1200" and `rocm-smi
+    # --showmeminfo vram` reports the full 16GiB, so the "detected with 0 VRAM,
+    # falls back to CPU" issue does not reproduce here and rocmOverrideGfx is
+    # not needed. If a future nixpkgs bump regresses this, re-check with:
+    #   nix shell nixpkgs#rocmPackages.rocminfo -c rocminfo | grep -i gfx
+    #   nix shell nixpkgs#rocmPackages.rocm-smi -c rocm-smi --showmeminfo vram
+    # and only then set rocmOverrideGfx = "12.0.0"; (gfx1200) if VRAM reports 0.
+    # rocmOverrideGfx = "12.0.0";
+  };
+}