discover · compare · collections · requirements · contribute · feed · watching · stats · help with your tokens

Nitestack/infrastructure · source

Snapshot 0 · 2026-11-04T12:47:27Z · Nix · Apache-2.0

GitHub description at capture

Personal infrastructure as code: Nix system configs, a self-hosted homelab, and Cloudflare DNS/edge managed with OpenTofu.

README at capture

# Personal Infrastructure as Code

> Reproducible Nix configurations for my machines, homelab, and Cloudflare edge, kept declarative, version-controlled, and close at hand.

[![Repository checks](https://github.com/Nitestack/infrastructure/actions/workflows/check.yml/badge.svg)](https://github.com/Nitestack/infrastructure/actions/workflows/check.yml)
[![GitHub stars](https://img.shields.io/github/stars/Nitestack/infrastructure)](https://github.com/Nitestack/infrastructure/stargazers)
[![Last commit](https://img.shields.io/github/last-commit/Nitestack/infrastructure)](https://github.com/Nitestack/infrastructure/commits/main)
[![Created](https://img.shields.io/github/created-at/Nitestack/infrastructure)](https://github.com/Nitestack/infrastructure)
[![License](https://img.shields.io/github/license/Nitestack/infrastructure)](LICENSE)
[![NixOS](https://img.shields.io/badge/NixOS-unstable-5277C3?logo=nixos&logoColor=white)](https://nixos.org/)

This repository is my personal infrastructure, managed as code: reproducible [Nix](https://nixos.org)/[Home Manager](https://nix-community.github.io/home-manager) system configurations for [NixOS](https://nixos.org) (including [NixOS via WSL](https://nix-community.github.io/NixOS-WSL)), a self-hosted homelab of containerized services, and the [OpenTofu](https://opentofu.org)/Cloudflare edge that fronts them.

## How it fits together

```mermaid
flowchart LR
  subgraph machines[Personal machines]
    nixstation[NixOS desktop]
    wslstation[NixOS WSL]
  end

  shared[Shared Nix modules<br/>and Home Manager]
  homestation[Homelab server]
  services[Containerized services]
  caddy[Caddy + Cloudflare Tunnel]
  edge[Cloudflare DNS and edge<br/>managed with OpenTofu]

  machines --> shared
  shared --> homestation
  homestation --> services --> caddy --> edge
```

## What’s in here

- **System and user configs** — `configurations/` and `modules/` define NixOS and Home Manager setups for every host, wired together via [nixos-unified](https://github.com/srid/nixos-unified).
- **Homelab services** — `modules/nixos/homelab/` is the module API for declaring self-hosted apps, their container or host workloads, and how traffic reaches them through Caddy, DNS, and Cloudflare Tunnel. See [`docs/homelab-services.md`](docs/homelab-services.md).
- **Edge and DNS as code** — `opentofu/cloudflare/` manages Cloudflare-side DNS and zone settings with OpenTofu. See [`opentofu/cloudflare/README.md`](opentofu/cloudflare/README.md).
- **Secrets** — `secrets/` stores encrypted secrets with [sops-nix](https://github.com/Mic92/sops-nix), scoped per host via `.sops.yaml`.
- **Automation** — GitHub Actions CI (`.github/workflows/`) and Renovate keep the flake and container images up to date; see [`docs/renovate-setup.md`](docs/renovate-setup.md).

## Requirements

Make sure [`git`](https://git-scm.com) is available when you follow the installation sections below.

### NixOS

Install the latest version of [NixOS](https://nixos.org/download).

Either run the graphical installer or install NixOS manually.

### WSL (NixOS)

Install the latest version of [WSL](https://learn.microsoft.com/windows/wsl).

Download `nixos.wsl` from [the latest release](https://github.com/nix-community/NixOS-WSL/releases/latest).

Either double-click the file or run:

```nu
wsl --install --from-file nixos.wsl # wherever nixos.wsl was downloaded
```

#### Post-install

This repository uses explicit flake references and disables channels in the
managed system configuration. Use the flake commands below rather than
updating channels as part of routine operation.

If you want to make NixOS your default distribution, run:

```nu
wsl -s NixOS
```

## Getting started

Clone the repository:

```nu
git clone https://github.com/Nitestack/infrastructure.git
```

### NixOS

Before continuing with the installation, initialize the Nix system:

```sh
sudo nixos-rebuild boot --flake ~/infrastructure#nixstation
```

Reboot the system.

### Server (NixOS)

Before continuing with the installation, initialize the Nix system:

```sh
sudo nixos-rebuild boot --flake ~/infrastructure#homestation
```

Reboot the system.

### WSL (NixOS)

Initialize the Nix system inside of NixOS-WSL:

```sh
sudo -n nixos-rebuild boot --flake ~/infrastructure#wslstation
```

After the first installation, ordinary changes use `switch` and can be checked
immediately from the running `wslstation` instance. Its sudo setup is
passwordless; use `sudo -n` so an agent never waits for a prompt. See
[`configurations/nixos/wslstation/AGENTS.md`](configurations/nixos/wslstation/AGENTS.md)
and [`docs/operations.md`](docs/operations.md) for the fast verification loop.

Execute the following commands on Windows to correctly apply the custom username:

```nu
wsl -t NixOS
wsl -d NixOS --user root exit
wsl -t NixOS
```

Restart WSL.

For Herdr navigation in Windows Terminal, configure the required CSI-u
keybindings described in [`docs/windows-terminal-herdr.md`](docs/windows-terminal-herdr.md).

## Start here

This is personal infrastructure, not a drop-in distribution. It is useful as a reference or starting point, but before applying it elsewhere, replace host names, hardware configuration, secrets, DNS zones, and service-specific settings with your own.

For a guided first deployment, start with the [NixOS manual](https://nixos.org/manual/nixos/stable/), then adapt the closest host under [`configurations/`](configurations/).

## Hosts at a glance

| Target | Role | Apply or evaluate with |
| --- | --- | --- |
| `nixstation` | Primary NixOS desktop | `nix-switch` |
| `homestation` | NixOS homelab server | `nix-switch` |
| `wslstation` | NixOS under WSL | `nix-switch` |

## Everyday maintenance

See [`docs/operations.md`](docs/operations.md) for validation, activation,
updates, and rollback.

## Further reading

- [`docs/homelab-services.md`](docs/homelab-services.md) — homelab module options, validation, and recipes.
- [`docs/homestation-operations.md`](docs/homestation-operations.md) — operate and diagnose homestation services.
- [`docs/homestation-backup-recovery.md`](docs/homestation-backup-recovery.md) — inspect, verify, and recover homestation backups.
- [`docs/homestation-services.md`](docs/homestation-services.md) — current homestation service inventory and exposure.
- [`docs/operations.md`](docs/operations.md) — routine validation, activation, input updates, and recovery.
- [`docs/wake-on-lan.md`](docs/wake-on-lan.md) — firmware, NixOS, and tailnet wake-up setup for nixstation.
- [`docs/secrets.md`](docs/secrets.md) — maintain sops-encrypted configuration safely.
- [`docs/t3code.md`](docs/t3code.md) — T3 Code desktop and headless Home Manager setup.
- [`docs/adguard-home-client-caveats.md`](docs/adguard-home-client-caveats.md) — AdGuard Home client configuration caveats.
- [`docs/renovate-setup.md`](docs/renovate-setup.md) — one-time Renovate GitHub App setup.
- [`docs/windows-terminal-herdr.md`](docs/windows-terminal-herdr.md) — Windows Terminal keybindings required by Herdr in NixOS-WSL.
- [`opentofu/cloudflare/README.md`](opentofu/cloudflare/README.md) — Cloudflare edge and DNS state with OpenTofu.

## License

Licensed under the [Apache License 2.0](LICENSE).