Personal Infrastructure as Code

Reproducible Nix configurations for my machines, homelab, and Cloudflare edge, kept declarative, version-controlled, and close at hand.

This repository is my personal infrastructure, managed as code: reproducible Nix/Home Manager system configurations for NixOS (including NixOS via WSL) and macOS, a self-hosted homelab of containerized services, and the OpenTofu/Cloudflare edge that fronts them.

How it fits together

flowchart LR
  subgraph machines[Personal machines]
    nixstation[NixOS desktop]
    macstation[macOS]
    wslstation[NixOS WSL]
  end

  shared[Shared Nix modules<br/>and Home Manager]
  homestation[Homelab server]
  services[Containerized services]
  caddy[Caddy + Cloudflare Tunnel]
  edge[Cloudflare DNS and edge<br/>managed with OpenTofu]

  machines --> shared
  shared --> homestation
  homestation --> services --> caddy --> edge

Loading

What’s in here

• System and user configs — configurations/ and modules/ define NixOS, nix-darwin, and Home Manager setups for every host, wired together via nixos-unified.
• Homelab services — modules/nixos/homelab/ is the module API for declaring self-hosted apps, their containers, and how traffic reaches them through Caddy, DNS, and Cloudflare Tunnel. See docs/homelab-services.md.
• Edge and DNS as code — opentofu/cloudflare/ manages Cloudflare-side DNS and zone settings with OpenTofu. See opentofu/cloudflare/README.md.
• Secrets — secrets/ stores encrypted secrets with sops-nix, scoped per host via .sops.yaml.
• Automation — GitHub Actions CI (.github/workflows/) and Renovate keep the flake and container images up to date; see docs/renovate-setup.md.

Requirements

Make sure git is available when you follow the installation sections below.

NixOS

Install the latest version of NixOS.

Either run the graphical installer or install NixOS manually.

WSL (NixOS)

Install the latest version of WSL.

Download nixos.wsl from the latest release.

Either double-click the file or run:

wsl --install --from-file nixos.wsl # wherever nixos.wsl was downloaded

Post-install

After the initial installation, update your channels to use nixos-rebuild:

sudo nix-channel --update

If you want to make NixOS your default distribution, run:

wsl -s NixOS

macOS

Install the latest version of macOS and Nix.

Install Nix with the Nix Installer from Determinate Systems:

curl -fsSL https://install.determinate.systems/nix | sh -s -- install

Getting started

Clone the repository:

git clone https://github.com/Nitestack/infrastructure.git

NixOS

Before continuing with the installation, initialize the Nix system:

sudo nixos-rebuild boot --flake ~/infrastructure#nixstation

Reboot the system.

Server (NixOS)

Before continuing with the installation, initialize the Nix system:

sudo nixos-rebuild boot --flake ~/infrastructure#homestation

Reboot the system.

macOS

Before continuing with the installation, initialize the Nix system:

sudo nix run nix-darwin/master#darwin-rebuild -- switch --flake ~/infrastructure#macstation

Reboot the system.

WSL (NixOS)

Initialize the Nix system inside of NixOS-WSL:

sudo nixos-rebuild boot --flake ~/infrastructure#wslstation

Execute the following commands on Windows to correctly apply the custom username:

wsl -t NixOS
wsl -d NixOS --user root exit
wsl -t NixOS

Restart WSL.

For Herdr navigation in Windows Terminal, configure the required CSI-u keybindings described in docs/windows-terminal-herdr.md.

Start here

This is personal infrastructure, not a drop-in distribution. It is useful as a reference or starting point, but before applying it elsewhere, replace host names, hardware configuration, secrets, DNS zones, and service-specific settings with your own.

For a guided first deployment, start with the NixOS manual or nix-darwin, then adapt the closest host under configurations/.

Hosts at a glance

Target	Role	Apply or evaluate with
nixstation	Primary NixOS desktop	sudo nixos-rebuild boot --flake .#nixstation
homestation	NixOS homelab server	sudo nixos-rebuild boot --flake .#homestation
macstation	macOS via nix-darwin	sudo darwin-rebuild switch --flake .#macstation
wslstation	NixOS under WSL	sudo nixos-rebuild boot --flake .#wslstation

Everyday maintenance

# Format Nix files
nix fmt

# Check formatting and evaluate the flake without building full systems
nix run .#check

# Smoke-test the primary NixOS host
nix eval .#nixosConfigurations.nixstation.config.system.build.toplevel.drvPath --no-write-lock-file

# Smoke-test the macOS host
nix eval .#darwinConfigurations.macstation.system --apply 's: s.drvPath' --no-write-lock-file

Further reading

• docs/homelab-services.md — homelab module options, validation, and recipes.
• docs/homestation-operations.md — operate and diagnose homestation services.
• docs/homestation-services.md — current homestation service inventory and exposure.
• docs/operations.md — routine validation, activation, input updates, and recovery.
• docs/secrets.md — maintain sops-encrypted configuration safely.
• docs/adguard-home-client-caveats.md — AdGuard Home client configuration caveats.
• docs/renovate-setup.md — one-time Renovate GitHub App setup.
• docs/windows-terminal-herdr.md — Windows Terminal keybindings required by Herdr in NixOS-WSL.
• opentofu/cloudflare/README.md — Cloudflare edge and DNS state with OpenTofu.

License

Licensed under the Apache License 2.0.