You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This repo is for rapid prototyping and wild tests!
Feel free to copy code, take inspiration, but review before push into prod!
TLDR;
Your entire company as a service!
Server, services, cloud, client, and network — managed through a single NixOS configuration repo.
532+ NixOS modules across 40+ service categories.
Stateless root, declarative deployments, secrets via agenix
Cloud SSO via PassKey, YubiKey/Smardcard Tickets and Signatures
`
🤖 **This Document is (co-) generated by AI **
The docs are written by CrushAI (me).
The code? That's strictly human only!
✨ What Is This, Exactly
Welcome to a fully declarative, stateless, cloud infrastructure empire — all described idempotently in Nix, all reproducible on demand, all version-controlled to within an inch of its life.
Yes, this is a single git repo that controls:
2 server profiles (srv, srv2) with stateless+LUKS root, home-manager, SOPS/agenix secrets, and a feature-flag-style catalog of 100+ enabled/disabled services
1 full-spectrum build (srv-full) that compiles every service (commented-out = disabled, uncomment to ship)
3 desktop/workstation profiles (kiosk — stateless + no encryption, internet — stateless + LUKS) with full GNOME, AI, and AV package sets
Each service is a self-contained NixOS module. Import into a profile's modules list in flake.nix to activate. Disabled services remain visible as a feature catalog — like a Spotify playlist where some tracks are muted but still in the queue.
📂 Directory Layout
Each directory has its own README — click through for deep dives:
EcoFlow (power station API integrations — email, access key, secret key, devices), HomeAssistant, Moode (audio), Tibber (smart energy), DAB
lora/
1
Meshtastic-Web (LoRa mesh networking dashboard)
Translation & Libraries
Category
Modules
Services
translate/
1
LibreTranslate (self-hosted translation API)
lang/
1
LibreTranslate
Wikis, Bookmarking & Extras
Category
Modules
Services
wiki/
4
DocMost (Docker), MediaWiki + LDAP variant
bookmarks/
1
Readeck (read-it-later / bookmark manager)
win/
2
Windows update/start helpers
nixos/
1
NixOS-specific configuration module
server/
1
WebDAV server
network/
2
Networking toolbox, UniFi controller
it/
3
Networking toolbox, Rackula, Web-check
Feature Flag Catalog
Services in srv-full that are commented out (#) are declared but disabled — like a menu at a restaurant where you can order anything, but the kitchen only preps what's unblocked. Uncomment to enable. This catalog is intentional visibility, not cleanup debt.
💻 Development Workflow
make switch # Build + deploy to your current host (auto-detects hostname)
make boot # Build + reboot (same as switch, reboots after deploy)
make build # Build only — no deploy. Inspect first.
make check # Type-check + dry-run (also runs alejandra formatter)
make rollback # Switch to the previous generation. Undo button.
make gc # Garbage collect generations older than 12 days
make clean # GC old profiles + rebuild from scratch
make world # Update flake.lock + full build + switch + GC (one command)
make sdb # Build a NixOS install image for /dev/sdb
make clean-profiles # Nuke all boot profiles and rebuild
make pre-commit # Run alejandra + git add your changes
# Direct nixos-rebuild (when you don't want to trust Make's good intentions)
nixos-rebuild switch --flake .#srv
nixos-rebuild boot --flake .#srv
nix flake check # Run all flake checks
nix flake update # Update flake.lock from upstream mirrors# Formatting (alejandra is the only formatter — it's the law)
alejandra --quiet .
Target a different profile: TARGET=kiosk make build
🔐 Secrets & Authentication
52 encrypted secrets. All managed via agenix. All derived from hardware keys. No plaintext passwords in git. Ever.
Mechanism
Implementation
Encryption
.age files via age encryption (XChaCha20-Poly1305)
Key derivation
YubiKey via age-plugin-yubikey — your hardware key IS your decryption key
Smartcard
also supported as a key source
Location
modules/resources/*.age — one file per service (e.g. vaultwarden.age, bind.age)
SSH host keys
Persisted at /nix/persist/etc/ssh/ (survives root rebuilds)
Golden rule: Never edit .age files directly. Use paper-age or the agenix decryption process. Messing with them raw is like opening a sealed envelope and wondering why the wax is melted.
🧠 Design Philosophy (The "Why We're Like This" Section)
Principle
What It Means (No Jargon)
Stateless root
/ is tmpfs. Reboot = fresh OS. Persistent data lives under /nix/persist.
Declarative
What you describe is what you get. Period. No apt-get install in runbooks.
Modular
40+ service modules, independently importable, independently breakable.
Secrets locked down
YubiKey + agenix. If you don't have your hardware key, you don't have your secrets.
Offline-first
All upstream flakes are mirrored locally (git-mirror.home.corp). Air-gapped builds supported.