Personal Infrastructure as Code

Reproducible Nix configurations for my machines, homelab, and Cloudflare edge, kept declarative, version-controlled, and close at hand.

This repository is my personal infrastructure, managed as code: reproducible Nix/Home Manager system configurations for NixOS (including NixOS via WSL), a self-hosted homelab of containerized services, and the OpenTofu/Cloudflare edge that fronts them.

How it fits together

flowchart LR
  subgraph machines[Personal machines]
    nixstation[NixOS desktop]
    wslstation[NixOS WSL]
  end

  shared[Shared Nix modules<br/>and Home Manager]
  homestation[Homelab server]
  services[Containerized services]
  caddy[Caddy + Cloudflare Tunnel]
  edge[Cloudflare DNS and edge<br/>managed with OpenTofu]

  machines --> shared
  shared --> homestation
  homestation --> services --> caddy --> edge

Loading

What’s in here

• System and user configs — configurations/ and modules/ define NixOS and Home Manager setups for every host, wired together via nixos-unified.
• Homelab services — modules/nixos/homelab/ is the module API for declaring self-hosted apps, their container or host workloads, and how traffic reaches them through Caddy, DNS, and Cloudflare Tunnel. See docs/homelab-services.md.
• Edge and DNS as code — opentofu/cloudflare/ manages Cloudflare-side DNS and zone settings with OpenTofu. See opentofu/cloudflare/README.md.
• Secrets — secrets/ stores encrypted secrets with sops-nix, scoped per host via .sops.yaml.
• Automation — GitHub Actions CI (.github/workflows/) and Renovate keep the flake and container images up to date; see docs/renovate-setup.md.

Requirements

Make sure git is available when you follow the installation sections below.

NixOS

Install the latest version of NixOS.

Either run the graphical installer or install NixOS manually.

WSL (NixOS)

Install the latest version of WSL.

Download nixos.wsl from the latest release.

Either double-click the file or run:

wsl --install --from-file nixos.wsl # wherever nixos.wsl was downloaded

Post-install

This repository uses explicit flake references and disables channels in the managed system configuration. Use the flake commands below rather than updating channels as part of routine operation.

If you want to make NixOS your default distribution, run:

wsl -s NixOS

Getting started

Clone the repository:

git clone https://github.com/Nitestack/infrastructure.git

NixOS

Before continuing with the installation, initialize the Nix system:

sudo nixos-rebuild boot --flake ~/infrastructure#nixstation

Reboot the system.

Server (NixOS)

Before continuing with the installation, initialize the Nix system:

sudo nixos-rebuild boot --flake ~/infrastructure#homestation

Reboot the system.

WSL (NixOS)

Initialize the Nix system inside of NixOS-WSL:

sudo -n nixos-rebuild boot --flake ~/infrastructure#wslstation

After the first installation, ordinary changes use switch and can be checked immediately from the running wslstation instance. Its sudo setup is passwordless; use sudo -n so an agent never waits for a prompt. See configurations/nixos/wslstation/AGENTS.md and docs/operations.md for the fast verification loop.

Execute the following commands on Windows to correctly apply the custom username:

wsl -t NixOS
wsl -d NixOS --user root exit
wsl -t NixOS

Restart WSL.

For Herdr navigation in Windows Terminal, configure the required CSI-u keybindings described in docs/windows-terminal-herdr.md.

Start here

This is personal infrastructure, not a drop-in distribution. It is useful as a reference or starting point, but before applying it elsewhere, replace host names, hardware configuration, secrets, DNS zones, and service-specific settings with your own.

For a guided first deployment, start with the NixOS manual, then adapt the closest host under configurations/.

Hosts at a glance

Target	Role	Apply or evaluate with
nixstation	Primary NixOS desktop	nix-switch
homestation	NixOS homelab server	nix-switch
wslstation	NixOS under WSL	nix-switch

Everyday maintenance

See docs/operations.md for validation, activation, updates, and rollback.

Further reading

• docs/homelab-services.md — homelab module options, validation, and recipes.
• docs/homestation-operations.md — operate and diagnose homestation services.
• docs/homestation-backup-recovery.md — inspect, verify, and recover homestation backups.
• docs/homestation-services.md — current homestation service inventory and exposure.
• docs/operations.md — routine validation, activation, input updates, and recovery.
• docs/wake-on-lan.md — firmware, NixOS, UpSnap, and tailnet wake-up setup for nixstation.
• docs/secrets.md — maintain sops-encrypted configuration safely.
• docs/adguard-home-client-caveats.md — AdGuard Home client configuration caveats.
• docs/renovate-setup.md — one-time Renovate GitHub App setup.
• docs/windows-terminal-herdr.md — Windows Terminal keybindings required by Herdr in NixOS-WSL.
• opentofu/cloudflare/README.md — Cloudflare edge and DNS state with OpenTofu.

License

Licensed under the Apache License 2.0.