LAN BAT

github.com/lanbat · open source · runs in a real home

Home infrastructure you can read.

LAN BAT publishes the code behind one working home network: the router, the servers, the cameras and the voice assistant. Everything is declarative, tested and written up, so you can fork the whole stack or take the one pattern that saves you a weekend.

Four repositories, one network

Each project stands on its own. Together they cover a home network from the WiFi edge to the language models.

NixOS · flake

nixconf

lanbat/nixconf · MIT

A production homelab as one NixOS flake. An x86_64 server and a Raspberry Pi 5 run more than 20 self-hosted services with single sign-on and no Kubernetes. Each service is one short lanbat.services.<name> block, and the flake generates the Caddy vhost, systemd ordering, accounts, secrets and dashboard tile from it.

  • Authentik SSO wired into every service from its one-line description
  • Two security tiers: infrastructure boots without a key, personal data waits for an unlock
  • Fail-safe storage: NFS-backed services stop cleanly and resume by themselves
  • disko, agenix, deploy-rs, plus an assertion and VM test suite on every PR
OpenWrt · shell + nftables

openwrt-kestrel

lanbat/openwrt-kestrel

Two toolkits for OpenWrt routers. extra-networks splits your WiFi into isolated trust zones for guests and IoT, with join approval, per-device controls and a live dashboard. split-routing sends chosen domains through a WireGuard VPN without moving your default route. No LuCI required.

  • One script per network: install.sh configs/guest.conf deploys a whole zone
  • Join approval through a push notification with an Approve button
  • Filtered DNS, blocked DNS bypass, rate limits and MAC allowlists via fw4
  • Domain-based VPN routing with lazy dnsmasq resolution and daily list updates
nixconf plugin · Frigate LPR

parking-guard

lanbat/nixos-lanbat-justpark-parking

Automatic parking enforcement for a shared car park. It syncs JustPark bookings and resident plates into a local allowlist, listens for Frigate licence-plate reads on MQTT, and raises an alert when an unknown plate turns up. It is also a worked example of an external nixconf plugin.

  • Bookings from the JustPark API or a CSV drop, with no API contract needed to start
  • MQTT in and out: every decision goes to parking-guard/event
  • Notifications through Pushover, Telegram or Home Assistant automations
  • One flake input and a deployment.parkingGuard block to enable
LLMs · RunPod serverless

runpod-llm-fleet

lanbat/runpod-llm-fleet

Open-weight language models on your own serverless GPU endpoints instead of a hosted API. Each purpose gets its own model, scaling policy and test suite: a Qwen coding model for the opencode agent, and a small Qwen model tuned for Home Assistant tool calls.

  • Scale-to-zero endpoints, so you pay only while a request is running
  • One script to deploy, refresh or smoke-test the whole fleet
  • Behaviour tests per model, including real tool calling against Home Assistant intents
  • Measured trade-offs: the cost, latency and model choices are written down with the numbers

Get started in a few commands

Pick what you want to build. Each guide lists what you need, then the shortest path from a fresh clone to a working setup, with the full walk-through one click away.

You need

  • An x86_64 server
  • A Raspberry Pi 5 with NVMe storage and a 64 GB microSD card
  • A domain, with local DNS that resolves <service>.<domain> to the server
  • A workstation with Nix and flakes enabled

Just looking? The interactive tour shows the wiring without any hardware.

  1. Clone and enter the dev shell

    It provides deploy-rs, agenix and nixos-anywhere.

    git clone https://github.com/lanbat/nixconf
    cd nixconf
    nix develop
  2. Create your site's deploy files

    They are gitignored. Set your domain, host IPs and plugins in the second one.

    cp deploy.nix.example deploy.nix
    cp deployments/homelab/deploy.nix.example \
       deployments/homelab/deploy.nix
  3. Encrypt your secrets and install the server

    Follow the secrets guide, then install the server with nixos-anywhere as described in phase 1 of the checklist. It lays out the disks with disko and LUKS.

  4. Deploy each host

    From then on, every change ships with deploy-rs.

    deploy --skip-checks path:.#homelab-server
    deploy --skip-checks path:.#homelab-pi-storage

Full guide: Deployment checklist, from bare hardware to a running site.

You need

  • A router running OpenWrt with fw4 / nftables
  • SSH access to it as root
  • For split-routing, a WireGuard VPN provider such as Mullvad

No LuCI needed. Everything installs from shell scripts and survives sysupgrade.

  1. Clone onto the router

    git clone https://github.com/lanbat/openwrt-kestrel /root/openwrt-router
    cd /root/openwrt-router
  2. Describe a network

    Each network is one config file. Set at least WIFI_KEY, SSID and SUBNET.

    cp extra-networks/configs/guest.conf.example \
       extra-networks/configs/guest.conf
    vi extra-networks/configs/guest.conf
  3. Install it

    This creates the subnet, firewall zone, filtered DNS, rate limits and dashboard. Repeat for untrusted.conf to isolate IoT devices.

    sh extra-networks/install.sh extra-networks/configs/guest.conf
  4. Optional: route chosen domains through a VPN

    Put your tiers and domain lists in /etc/split-routing/, then run the installer.

    sh split-routing/install.sh

Full guides: extra-networks · split-routing · troubleshooting

You need

  • A RunPod account and API key
  • curl, python3, sqlite3 and npm

Endpoints scale to zero, so you pay only while a request is running. The first request after an idle period waits for a cold start.

  1. Clone and store your key

    git clone https://github.com/lanbat/runpod-llm-fleet
    cd runpod-llm-fleet
    mkdir -p ~/.config/envman
    echo 'export RUNPOD_API_KEY="rpa_..."' > ~/.config/envman/RUNPOD.env
  2. Deploy the fleet

    This deploys or refreshes both endpoints, installs the opencode config and runs smoke tests. Use coding for the coding endpoint only.

    ./scripts/deploy-fleet.sh all
  3. Point opencode at it

    npm install -g @opencode/cli
    ./scripts/setup-opencode.sh
    ./scripts/validate-opencode.sh
  4. Optional: give Home Assistant a voice

    Install the extended_openai_conversation integration and copy the settings from models/home-assistant/ha-integration.yaml.

Full guides: opencode setup · new RunPod endpoint

You need

  • A nixconf server with the services plugin (Frigate, Mosquitto, Home Assistant)
  • A camera on the car park with Frigate licence-plate recognition
  • Your JustPark site ID. API access is optional: a CSV export works too
  1. Add the flake input

    In your nixconf flake.nix:

    inputs.lanbat-justpark-parking.url = "github:lanbat/nixos-lanbat-justpark-parking";
    inputs.lanbat-justpark-parking.inputs.nixpkgs.follows = "nixpkgs";
  2. Enable the plugin and describe your site

    In deployments/homelab/deploy.nix:

    hosts.server.plugins = [
      inputs.self.lanbatPlugins.services
      inputs.lanbat-justpark-parking.lanbatPlugin
    ];
    
    deployment.parkingGuard = {
      siteId = "YOUR_JUSTPARK_SITE_ID";
      cameras = [ "c1" ];
      graceMinutes = 5;
      cooldownMinutes = 30;
    };
  3. Add secrets and deploy

    Create parking-guard-mqtt-pass.age, and optionally the JustPark and notification secrets, as listed in the secrets guide. Then deploy the server.

    deploy --skip-checks path:.#homelab-server

Full guides: README · Home Assistant automations

What the projects have in common

  • Declared, not clicked

    Config lives in files you can diff and review. Rebuilding a machine means running a command, not following a wiki page.

  • Your hardware, your data

    Services stay on your LAN behind your own CA and sign-on. Even the language models run on endpoints you control.

  • Failure is a normal state

    Storage drops, routers reboot and GPUs go cold. Each project says what happens when they do, and recovers by itself.

  • Small, boring parts

    systemd, nftables, dnsmasq and MQTT. Tools you can debug at midnight beat clever orchestration.

  • Tested and written up

    CI checks, VM tests and model test suites run alongside docs that explain why each choice was made.

  • Built to be forked

    Site-specific values stay out of git. Copy a template, fill in your domain, and the rest is yours.

Start with the homelab

nixconf is the centre of LAN BAT. The interactive tour lets you edit a service and see the wiring the flake generates.

Take the tour