chad/cn
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
No description
1,086 commits 138 branches 0 tags 24 MiB
  • Nix 56.3%
  • Shell 17.3%
  • Just 7%
  • Lua 6%
  • HTML 5.3%
  • Other 8.1%
Find a file
Exact
Chad Russell 415634e216
All checks were successful
ci / changes (push) Successful in 2s
Details
ci / check (push) Successful in 14s
Details
deploy / deploy (push) Successful in 18s
Details
ci / thinkpad-image (push) Has been skipped
Details
think: realize bubblebox profile.lock (umbriel roots + railway digest)
2026-11-06 18:54:41 -05:00
.forgejo/workflows ci: gate thinkpad-image on host-image/ only, not all of hosts/thinkpad/ 2026-10-27 16:09:12 -04:00
docs bee/sweatshop: rustfs skills sidecar (bucket skills) + bucket-init + dedicated keypair 2026-10-30 16:45:47 +00:00
hosts think: realize bubblebox profile.lock (umbriel roots + railway digest) 2026-11-06 18:54:41 -05:00
lib nix cleanup: dedup NFS mounts via lib helper, drop unused module args 2026-09-16 22:49:12 -04:00
modules modules/dsh: pin pnpm store dir for the plugin manager (ERR_PNPM_UNEXPECTED_STORE) 2026-11-06 14:14:51 +00:00
nebula format: add treefmt + nixfmt-classic, format all .nix files 2026-08-10 23:23:21 -04:00
pkgs/dsh pkgs/dsh: real npmDepsHash for 0.2.2-rc.1 2026-11-06 04:26:20 +00:00
scripts bees: immich v3.1.0 -> v3.2.4 (server + ML) 2026-10-01 18:29:47 -04:00
secrets bee/sweatshop: rustfs skills sidecar (bucket skills) + bucket-init + dedicated keypair 2026-10-30 16:45:47 +00:00
.gitignore cleanup: remove dev-quadlets, ninerouter, kan, qrcode-qa, immich-dryrun, tasty route; tastyquant declarative; sweatshop path 2026-10-23 03:54:05 -04:00
AGENTS.md docs: purge stale buzz/NIP-42 + kanban-is-truth claims (review nits) 2026-11-06 04:35:52 +00:00
flake.lock hermes-agent: bump to 7520c4e (2026-10-15) 2026-10-15 12:06:13 -04:00
flake.nix bee: hermes fresh-start — strip legacy declarations (mem0/qdrant, kanban, drift-check, prune scripts, dashboard unit) 2026-11-06 04:24:54 +00:00
README.md docs: add README 2026-10-20 18:33:58 +00:00
result fix(caddy): nest header_up inside reverse_proxy for lane-hooks bridge — restores caddy startup (all internal sites down since 5ace763 deploy) 2026-09-07 18:46:46 -04:00
treefmt.toml format: add treefmt + nixfmt-classic, format all .nix files 2026-08-10 23:23:21 -04:00

README.md

cn

Unified NixOS configurations for my homelab infrastructure — one flake, every machine: home servers, the public ingress VPS, the NAS, and a Bluefin-based laptop, all tied together by a Nebula overlay network.

Source of truth: flake.nix, hosts/*/*.nix, modules/*.nix, and live host state. Prefer these over older docs when facts disagree. Agent-facing operating guide: AGENTS.md.

Hosts

Host Hardware Role
bee Beelink mini PC Dev server + local Nebula lighthouse (dev quadlets, filebrowser, hindsight)
bees Production server Shared + media + internal services behind Caddy ingress (Immich, Jellyfin, *arr, linkding, papra, ntfy, …)
gateway Hetzner Cloud VPS Public TLS ingress (Caddy, HTTP-01), Nebula lighthouse/relay
nas NFS storage server NFS + Samba exports, shared RustFS S3 (10.10.0.3:9000), btrfs maintenance
homeassistant HAOS appliance Home Assistant OS + local Nebula add-on, incident notes
think ThinkPad Custom Bluefin (bootc) image — managed by its Justfile/cjust, not a NixOS deploy target

Host addressing and deploy metadata live in lib/host-meta.nix — the single source of truth. Add a host there and the deploy scripts and /etc/hosts overlay follow automatically.

Layout

flake.nix              # hosts, deploy/install apps, checks
hosts/                 # per-machine NixOS configs (see table above)
modules/               # shared NixOS modules (nebula, restic, vector, …)
lib/                   # host-meta.nix, nfs-mount helper
pkgs/                  # in-repo packages (dsh)
nebula/                # overlay network PKI, configs, scripts, reference
scripts/               # deploy.sh, ci-log.sh, verify-immich.sh
docs/                  # topic deep-dives (rustfs migration, immich loop, …)
secrets/               # agenix-encrypted secrets
.forgejo/workflows/    # CI: PR checks, merge → auto-deploy, flake updates

Network

Nebula overlay 10.10.0.0/24 — full topology in nebula/README.md. At home, peers discover each other via the local lighthouse on bee; away, via the Hetzner lighthouse/relay on gateway. Public ingress routes through gateway to bees without exposing the home WAN.

Workflow

  • Origin is Forgejo (git.crussell.io/chad/cn). GitHub chad-russell/cn is an automatic push mirror — never push to GitHub directly.
  • PRs run ci.yml (nix flake check + treefmt); merging to main triggers deploy.yml to auto-deploy.
  • Deploy by hand with nix run .#deploy -- <host> from bees (the deploy origin).
  • Formatting: treefmt (nixfmt-classic).
  • Secrets: agenix — never commit plaintext.