Remove Open WebUI Computer from exe.dev image

Author: assistant-ngalaiko[bot]

README.md

@@ -39,21 +39,9 @@ nodes; use an ephemeral key so retired ones auto-clean (see step 3).
      "users":  ["nikita"]
    }],
    // required for `funnel = true` serve entries (the public ingress).
-   "nodeAttrs": [{ "target": ["tag:computer"], "attr": ["funnel"] }],
-   // the cptr dashboard is a Tailscale Service: let tag:computer nodes host it
-   // without manual approval, and let my devices reach it. The svc: name lives
-   // here (in the tailnet), so it outlives any single machine.
-   "autoApprovers": { "services": {
-     "svc:cptr": ["tag:computer"]
-   } },
-   "grants": [{ "src": ["autogroup:member"], "dst": ["svc:cptr"], "ip": ["443"] }]
+   "nodeAttrs": [{ "target": ["tag:computer"], "attr": ["funnel"] }]
    ```
 
-   Tailscale Services are configured in the policy, not on the box. If your
-   tailnet requires the Service object to exist before it can be hosted, add it
-   once under **Services → Add a service** (`svc:cptr`) — a one-time tailnet
-   step, not per-machine.
-
    Place the secret on the machine (ephemeral, so retired VMs' nodes auto-clean):
 
    ```
@@ -71,11 +59,7 @@ nodes; use an ephemeral key so retired ones auto-clean (see step 3).
 
 4. Enable **HTTPS Certificates** (admin console → DNS → *Enable HTTPS*, needs
    MagicDNS on). Required to provision the `*.ts.net` certs. The `computer`
-   node's `tailscale-serve` service re-asserts both on every boot:
-   - `https://cptr.<tailnet>.ts.net/` → cptr dashboard, **tailnet-private**, a
-     Tailscale **Service** (`svc:cptr`). Because the Service is defined in the
-     tailnet, this URL is **stable across recreations** — a fresh machine just
-     re-hosts it (auto-approved) even though it registers as a new node.
+   node's `tailscale-serve` service re-asserts this on every boot:
    - `https://computer.<tailnet>.ts.net/<tenant>/` → ingress, **public via
      Funnel** (needs the `nodeAttrs` above). Unauthenticated — see the note in
      `hosts/exedev/default.nix`. This one is named after the *node*, so on a

hosts/exedev/default.nix

@@ -6,8 +6,7 @@
     name = "computer.exe";
     labels = {
       "org.opencontainers.image.title" = "computer.exe";
-      "org.opencontainers.image.description" =
-        "exe.dev image: s6-overlay, Tailscale SSH, and Open WebUI Computer (cptr)";
+      "org.opencontainers.image.description" = "exe.dev image: s6-overlay and Tailscale SSH";
       "exe.dev/login-user" = "nikita";
     };
     packages = with pkgs; [
@@ -28,15 +27,9 @@
   services.tailscale = {
     enable = true;
     # One tailnet node, `computer`: ssh + the public ingress funnel on its own
-    # name, and it also hosts the cptr dashboard as a Tailscale *Service*. Both
-    # bind :443 but on different IPs (the node's own IP for the funnel, the
-    # service VIP for the dashboard), rebuilt on every boot.
+    # name, rebuilt on every boot.
     nodes.computer = {
       ssh = true;
-      # let the unprivileged cptr account read the LocalAPI (tailscale status /
-      # funnel status) to report the current public hostname; writes stay
-      # root-only. See the public-hostname skill.
-      localApiReadable = true;
       serve = [
         # public path-routed ingress via node Funnel:
         # https://computer.<tailnet>.ts.net/<tenant>/. World-reachable with NO
@@ -48,15 +41,6 @@
           port = 443;
           funnel = true;
         }
-        # cptr dashboard as a stable Tailscale Service:
-        # https://cptr.<tailnet>.ts.net/, tailnet-private. svc:cptr lives in the
-        # tailnet policy (autoApprover + grant, see README), so the URL survives
-        # this node re-registering as a fresh device on every recreation.
-        {
-          target = "localhost:9999";
-          port = 443;
-          service = "svc:cptr";
-        }
       ];
     };
   };

hosts/exedev/users/assistant.nix

@@ -1,8 +1,7 @@
 { pkgs, ... }:
 let
   # pi (the coding agent) is an npm CLI, packaged from its published tarball.
-  # MIT, all-JS deps, so it builds against the pinned nixpkgs directly (no
-  # unstable / allowUnfree, unlike cptr).
+  # MIT, all-JS deps, so it builds against the pinned nixpkgs directly.
   pi = import ../../../packages/pi { inherit pkgs; };
   # the pi-gateway plugin, self-contained (peers + native better-sqlite3 bundled).
   piGateway = import ../../../packages/pi-gateway { inherit pkgs; };
@@ -16,8 +15,8 @@ in
     shell = "/bin/sh";
     description = "Assistant (pi coding agent)";
 
-    # pi plus the tools it drives (git, gh, ripgrep, …) and a node runtime for
-    # its TypeScript extensions / any node subprocesses. The account is
+    # pi plus the tools it drives (git, gh, ripgrep, Chromium, …) and a node
+    # runtime for its TypeScript extensions / any node subprocesses. The account is
     # unprivileged (no sudo, not nix-trusted), which caps what the agent can do
     # on the box; BYOK provider keys are supplied at runtime, not baked in.
     packages = with pkgs; [
@@ -30,6 +29,7 @@ in
       curl
       coreutils
       uv
+      chromium
     ];
   };
   users.groups.assistant.gid = 2001;

hosts/exedev/users/cptr.nix

@@ -2,7 +2,6 @@
 {
   imports = [
     ./nikita.nix
-    ./cptr.nix
     ./assistant.nix
   ];
 }

hosts/exedev/users/default.nix

@@ -47,7 +47,7 @@ in
           environment = mkOption {
             type = types.attrsOf types.str;
             default = { };
-            description = "Per-user environment: exported by login shells; service modules that run as the user inject it too (cf. services.cptr).";
+            description = "Per-user environment: exported by login shells; service modules that run as the user inject it too.";
           };
           files = mkOption {
             type = types.nullOr types.package;

modules/exedev/home.nix

@@ -59,8 +59,8 @@ in
     '';
 
     # nix-ld reads these to find the real loader + libraries. image.env covers
-    # PID1-descended processes (the cptr service); ssh scrubs the env, so
-    # login shells re-export via /etc/profile (cf. profile.d/nix.sh).
+    # PID1-descended processes; ssh scrubs the env, so login shells re-export
+    # via /etc/profile (cf. profile.d/nix.sh).
     image.env = [
       "NIX_LD=${nix-ld-libraries}/share/nix-ld/lib/ld.so"
       "NIX_LD_LIBRARY_PATH=${nix-ld-libraries}/share/nix-ld/lib"