Skip to content

🧭 NeXuS Compass — Wreckin' Ballz · BOM Wiki · .sfs Node Standard

Stamped 2026-07-14 · Reboot imminent — pick up here

This session: settled the time layer, built the BOM→install-script wiki, brought Ghost Gate under maintenance, and located the .sfs-on-Alpine Node Standard.

✅ DONE this session

  • Time layer SETTLED. chrony-nts (apk, +NTS, GnuTLS/Nettle) is the keeper — authenticated NTS time, tooling (nexus-time*.sh) intact, config already correct. ntpsec chosen for removal (redundant, UDP/123 conflict). Reversed the earlier "compile chrony from source / switch to ntpsec" ideas — Alpine ships the chrony-nts package (Sustainable win).
  • BOM WIKI built → ~/claude/docs/nexus-bom/
  • NEXUS_BOM.md (index, 6 layers, Open Decisions, End-goal)
  • pkg/chrony-nts.md, pkg/ghost-gate.md (schema: Name·Description·Help File·Config File + 🔨 Build block)
  • files/chrony.conf, files/ghost-gate.nft (canonical configs = source of truth)
  • build/nexus-node-install.sh (dry-run default + emergency-stop + backup-first; layer 1 wired, verified via dry-run)
  • Ghost Gate under maintenance — config (v1.0 NXS-CONFIG-0001) + protocol (NEXUS_GHOST_GATE_SPEC.md, Cerberus 3-heads) both in BOM. Live /etc/nftables.nft is stale/generic, NOT Ghost Gate, and unbolted.

🔀 THE PIVOT (key realization)

The real target is the NeXuS Node Standard (~/claude/docs/NXS-NODE-STANDARD.md): immutable core.sfs (built from source, no blobs) + writable overlay, iPXE→RAM boot, resettable. Builder exists: ~/NeXuS/forge/01-alpine-hardener/sfs-builder.sh (reads apps.txt NAME|DESC|PACKAGES|SERVICES|SIZE, chroots Alpine minirootfs, apk add, mksquashfs -comp zstd). Blueprints = config-as-code (~/NeXuS/build/BLUEPRINTS.md, nexus-compose --blueprint).

So the BOM should emit an apps.txt + blueprint (feed the .sfs forge), not just a mutate-in-place installer. The forge's gap: apps.txt has packages+services but NO config deploy — the BOM's files/ + Build blocks are exactly that missing config layer. nexus-node-install.sh becomes the migration tool for the dirty box; the .sfs overlay is the real node.

⏳ PENDING doas ops (dirty box — Anon runs)

  1. Clock (do before reboot): doas date -s "2026-07-14 19:30:00" && doas hwclock -w (was ~4h slow; offline so chrony can't fix it)
  2. Cut ntpsec: doas rc-update del ntpd default && doas apk del ntpsec ntpsec-dev ntpsec-openrc ntpsec-doc ntpsec-pyc

📌 OPEN DECISIONS

  • Alpine-LTS vs edge — Anon wants LTS base; sfs-builder.sh currently points at edge. Reconcile.
  • /etc/nexus/ namespace — make it real (all NeXuS configs there, wiki files/ ↔ /etc/nexus/), or stock paths? (/etc/nexus/ is currently empty/nonexistent)
  • ghost-gate.nft v1.1 — add tcp dport 4460 (NTS-KE, or Time layer breaks) + flush ruleset
  • nftables loader path — /etc/nftables.nft (standard svc, Simple) vs /etc/nexus/ + conf.d
  • apps.txt config-gap — how the .sfs build bakes in files/ configs

▶️ NEXT

  1. Decide LTS vs edge + /etc/nexus/ namespace (both shape everything downstream)
  2. Cut ghost-gate v1.1 (4460) → then Enforcement layer is settleable
  3. Add chrony-nts + ghost-gate as apps.txt entries; teach the forge/BOM a config-deploy step
  4. Continue settling layers: Egress (opensnitch commit/cut), Reputation (fail2ban vs crowdsec), Detection (psad), Overlay (Reticulum — LoRa radio arrives ~2026-07-21)

Backups this session: ~/claude/archive/wreckinballz_2026-07-14/. Nothing touched the live system.