k1/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
9 commits 1 branch 0 tags 56 KiB
  • Nix 97.2%
  • Shell 2.8%
Find a file
Exact
Kidan Nelson e465b1214d
All checks were successful
Infra CI / Validate NixOS config (push) Successful in 32s
Details
fix: keep forgejo internal http route
2026-08-11 19:44:29 -04:00
.forgejo/workflows feat: basic CI 2026-08-11 19:12:56 -04:00
home Add k3s and Forgejo deployment 2026-08-10 23:41:10 -04:00
hosts/nuc Add Porkbun ACME for Ignis 2026-08-11 01:09:48 -04:00
kubernetes/apps/forgejo fix: keep forgejo internal http route 2026-08-11 19:44:29 -04:00
modules/nixos Ignore stale ACME challenge CNAMEs 2026-08-11 01:21:12 -04:00
scripts Add Porkbun ACME for Ignis 2026-08-11 01:09:48 -04:00
secrets Add Porkbun ACME for Ignis 2026-08-11 01:09:48 -04:00
.gitignore Add Forgejo runner and sops secrets 2026-08-11 00:31:40 -04:00
.sops.yaml Add Forgejo runner and sops secrets 2026-08-11 00:31:40 -04:00
flake.lock Add Forgejo runner and sops secrets 2026-08-11 00:31:40 -04:00
flake.nix Add Forgejo runner and sops secrets 2026-08-11 00:31:40 -04:00
README.md feat: expose forgejo via ddns 2026-08-11 19:40:08 -04:00

README.md

Home Infrastructure

NixOS source of truth for the home server.

Hosts

  • nuc: Intel NUC home server, reachable on the LAN as nuc.home.arpa.

Deploy

From this machine:

nixos-rebuild switch --flake /home/k1/infra#nuc --target-host k1@nuc.home.arpa --use-remote-sudo

The remote sudo prompt should ask for the k1 password on the NUC.

If running from the NUC after copying or cloning this repo there:

sudo nixos-rebuild switch --flake /path/to/infra#nuc

Notes

  • Keep secrets out of git. Use secrets/README.md until sops-nix or agenix is added.
  • The current NUC egress firewall assumes:
    • router: 192.168.8.1
    • NUC: 192.168.8.151
    • trusted LAN: 192.168.8.0/24
  • Public DNS:
    • ignis.nrve.dev -> CNAME gh1d1e7.glddns.com
  • Flint WAN port forwards:
    • TCP 80 -> 192.168.8.151:80
    • TCP 443 -> 192.168.8.151:443
    • TCP 32222 -> 192.168.8.151:32222 for Forgejo SSH
  • Do not expose the Kubernetes API port 6443 publicly unless there is a narrow source allowlist or VPN in front of it. Prefer WireGuard/Tailscale/Flint VPN access to the LAN, then reach 192.168.8.151:6443.
  • LAN DNS should resolve internal names to the NUC:
    • nuc.home.arpa -> 192.168.8.151
    • git.home.arpa -> 192.168.8.151
  • If the Flint does not support NAT loopback, optionally override ignis.nrve.dev on LAN to 192.168.8.151.
  • ACME uses Porkbun DNS-01, so certificate issuance does not require public inbound HTTP.
  • When the NUC moves to its own subnet/VLAN, update modules/firewall.nix.