homelab
Configuration for homelab systems @ bunniesin.space
Star
Fork
Watch
30 4 0
Files
secrets
services
systems
users
.gitignore
bunnies.nix
CONTRIBUTING.md
flake.lock
flake.nix
README.md
README.md

bunniesin.space homelab manual #

adding users #

To add a new user to the homelab, make a new file in users/ that declares it's configuration. This is done using the bunnies.<name> attribute set.

  bunnies.rosie = {
    keys = [];
  };
}

Users are, by default, unpriviledged and are inside the bunny group. To be able to log into your account via SSH, add a key to the bunnies.<name>.keys list.

To add packages to the user, use bunnies.<name>.packages; for groups, bunnies.<name>.extraGroups.

You can pass attributes to the underlying users.users.<name> attribute set by using bunnies.<name>.passthru.

User passwords are provided through agenix-backed hashedPasswordFile entries; see systems/common.nix.

secrets (agenix) #

Run agenix from secrets/, where it finds agenix-rules.nix. Add a recipient rule before creating a secret; use public SSH keys for the people or machines that should be able to decrypt it. For example, add "my-secret.age".publicKeys = [ amelia autumnSystem ]; to agenix-rules.nix to allow Amelia and autumn to decrypt it. Then edit/encrypt it with agenix:

cd secrets
nix develop .. -c agenix -e my-secret.age

The editor contents become the encrypted file. Never commit plaintext secrets. To add a recipient to existing secrets, update the rules and rekey them with nix develop .. -c agenix -r; check that encrypted recipients match the rules with nix develop .. -c agenix -c.

Declare secrets with age.secrets.<name>.file in NixOS configuration and use config.age.secrets.<name>.path where needed. For example, the Caddy secret is an environment file of NAME=value entries.

services #

Caddy #

Caddy is configured in services/caddy.nix; add service-specific virtual hosts in the relevant service module. For autumn, import the module from systems/autumn/services/default.nix. A simple reverse proxy can use a tailnet hostname like this:

services.caddy.virtualHosts."http://app.tail014ad1.ts.net".extraConfig = ''
  reverse_proxy 127.0.0.1:8080
'';

Caddy serves HTTP on port 80, which autumn's firewall allows only on tailscale0. Keep apps behind that listener rather than adding a separate Tailscale Caddy plugin listener. Deploy the NixOS configuration after adding the route.

Navidrome is accessible on port 4533 and users inside the navidrome group can add files to the default library.

AudioMuse #

AudioMuse shares the audiomuse Docker network with Navidrome.

Install the AudioMuse Navidrome plugin in /srv/navidrome/data/plugins/, then configure the plugin to reach AudioMuse at http://audiomuse-flask:8000. Set the same AudioMuse API token in the Setup Wizard and the Navidrome plugin, and run the initial library analysis in AudioMuse before trying Instant Mix.

tempstore #

tempstore is accessible on port 33881 and mounts itself to /srv/tempstore.

contributing #

to contribute to our homelab, please read CONTRIBUTING.md which outlines our guidelines on opening pull requests, setting up new services, and creating issues.

deployment notes #

Autumn is a headless Dell Latitude E7270 with a btrfs partition layout configured in /systems/autumn/disko.nix.

To deploy:

nixos-rebuild switch \
  --flake .#autumn \
  --target-host amelia@autumn \
  --sudo

testing with virtual machines #

To test your changes before creating an pull request you must need to do the following:

rm autumn.qcow2

nix run \
  .#nixosConfigurations.autumn.config.system.build.vm