Lets two recipes be tested in parallel (operator request — immich + plausible under
active dev at once). Safe on the current node: measured a full immich CI stack at
~1GiB with multiple GiB free on the 7.6GiB cpx22, and the janitor is already
age-based + run-app-scoped so it never reaps a concurrent in-flight run. Updates the
stale '28GiB node' comment. Revert to 1 if OOM/IO contention shows up.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
flake.nix/flake.lock STAY at root so the build ref #cc-ci is unchanged; only flake's internal
configuration.nix path updated. Root-relative refs inside moved modules re-based ../X -> ../../X
(secrets/bridge/dashboard); configuration.nix's ../../modules imports unchanged (both dirs under nix/).
Living docs (README, architecture/install/secrets/enroll) + .drone.yml comment updated to nix/...;
append-only history logs left as-is. DECISIONS.md records RL5 + the deferred-coordinated RL6.
Verified on cc-ci: nixos-rebuild build 'path:#cc-ci' -> toplevel 8i3jcad9 (BYTE-IDENTICAL to the
pre-move build — store derivations are content-addressed on file contents, module .nix not in the
runtime closure); scripts/lint.sh -> lint: PASS.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
