nixconf
lanbat/nixconf · MIT
A production homelab as one NixOS flake. An x86_64 server and a Raspberry Pi 5 run more than
20 self-hosted services with single sign-on and no Kubernetes. Each service is one short
lanbat.services.<name> block, and the flake generates the Caddy vhost,
systemd ordering, accounts, secrets and dashboard tile from it.
- Authentik SSO wired into every service from its one-line description
- Two security tiers: infrastructure boots without a key, personal data waits for an unlock
- Fail-safe storage: NFS-backed services stop cleanly and resume by themselves
- disko, agenix, deploy-rs, plus an assertion and VM test suite on every PR