Skip to content

README.md

Latest commit

 

History

History
52 lines (47 loc) · 2.65 KB

README.md

File metadata and controls

52 lines (47 loc) · 2.65 KB
Raw

My Nixos Homelab

This repositry defines all my private devices. Laptops, desktops, RaspberryPis, remote servers and maybe some day my smartphones.

Dependencies

  • Secrets are encrypted in nix/secrets/*. Without decryption or mocking, this repository is not reporducible for you.
  • External dotfiles repository gets cloned into $HOME. These dotfiles are not managed by nix and get copied blindly.

TODO

  • ACLs for NFS share, services and blob. Maybe Apparmor profiles.
  • nix tests before update appliance.
  • LAN carnary.
  • IPsec for known services/hosts.
  • Update flake.lock in auto-update service.
  • RSS feeds OPML.
  • Script to partition new RAID drives.
  • Check if expected IP as DHCP lease?
  • create cfg.debug bool and pass it down to crucial services: sshd, nfsd, systemd, auto-update
  • Deprecate either 'output.homeConfigurations.${user_name}' or 'common.nix:imports.home-manager...'.
  • Secrets string scanning in all but 'secrets.nix' nix files.
  • Encrypt RAID drives.
  • Collect drives SMART data and setup alerts and RAID scrub schedule.
  • Media server/bridge on raspi + TV.
  • Email/thunderbird setup.
  • IRC/weechat setup.
  • Hardened Systemd service template.
  • Parameterized/Automatic isolated NAS folder creation for every given service
  • Full vim IDE setup to replace current manual steps.
  • Move contents = []; from installerMedium.nix to common.nix
  • Move all nix/installer/* into corresponding nix/system/*.
  • Populate the intaller mediums /nix/store with all packages required by target nixos/host to make offline intalls possible
  • Offline installs from installer mediums, see list item above.
  • Raid auto-repair systemd service.
  • Conditional nixos-upgrade.service reboot, so it doesn't interrupt eg. service above.
  • Remote scan / security audit of running services.
  • SIEM. Dedicated, isolated systemd service for aggregated logging.
  • DNS prefetch/cache of known domains (bookmarks, feeds, etc.).
  • Fetch RSS feeds via tor, maybe replace akregator, since it only respects KDE config.
  • Security system + autmoation with smartphone LAN detection.
  • Use local DNS server as system provider and check router for passthru.
  • Optional import of email data into thunderbird. Keep it encrypted separately, not in the nix store.
  • Add air quality sensors to raspi + logging SIEM.
  • git repo code signing and updater verification.
  • Service to mirror all git projects across several platforms as migration away from github.
  • Finish i2p service.
  • fetchRadicle nix source fetcher and seeds of home git.
  • PoE + PSU power supply.