Aner Zakobar
2f0d0b5e4c
Replaces the Helm/k3s setup with a declarative NixOS configuration targeting
a Raspberry Pi 4. Services run as podman containers under systemd, with data
on an external HD at /mnt/data. Key components:
- flake.nix: multi-host flake with pi-main (aarch64) and a placeholder for a
second machine
- modules/common.nix: shared system config (nix, podman, sops, SSH)
- modules/storage.nix: external HD mount with per-service subdirs
- modules/caddy.nix: Caddy with cloudflare DNS-01 ACME + authelia forward_auth
- modules/cloudflared.nix: Cloudflare tunnel for remote access
- modules/backup.nix: restic daily backups with NC maintenance mode pre-hook
- modules/services/{openldap,authelia,gitea,nextcloud,phpldapadmin}.nix: core services
- modules/services/{jellyfin,transmission}.nix: media services (disabled by default)
- secrets/: sops-nix scaffold with .sops.yaml age key config
- hosts/pi-main/: hardware config + service selection for the Pi
- PORTING.md: step-by-step migration guide (SD card → data restore → verify)
11 lines
382 B
Plaintext
11 lines
382 B
Plaintext
# Never commit an unencrypted secrets file.
|
|
# The encrypted version (produced by `sops -e -i secrets.yaml`) IS committed.
|
|
#
|
|
# If you accidentally add the plaintext version, sops-encrypted files
|
|
# contain a `sops:` key at the top — check before committing.
|
|
#
|
|
# Paranoia: ignore any plaintext variants you might create while editing.
|
|
secrets.yaml.plaintext
|
|
secrets.yaml.bak
|
|
*.plain
|