NixOS Homelab

My personal configuration for a NixOS homelab running on nixos-pc. It manages the server, services, networking, backups, and integrations I use at home. Runtime secrets and personal data are intentionally kept out of this repository.

Architecture

• NixOS flakes define the host configuration.
• Caddy routes HTTP services.
• Cloudflare Tunnel provides public access to therealrishabh.com and its subdomains.
• cfctl, wrangler, and flarectl provide Cloudflare command-line access.
• Tailscale and CoreDNS provide private access through *.internal.therealrishabh.com.
• Docker runs lab and CUDA workloads.
• sops-nix loads runtime secrets from the local-only /home/rishabh/.config/homelab/secrets.yaml.
• Apple Passwords and Vaultwarden store human-managed credentials.

Common commands

just build
just switch
just routes
just route-add demo public http://127.0.0.1:3000
just route-add vault internal http://127.0.0.1:8222
just cloudflare-store-token
just tailscale-store-oauth
just remote-phone-doctor
just remote-phone-check
just canvas-doctor
just canvas-pair
just t3code-doctor
just local-model-use bonsai-ternary-27b
just local-model-doctor mach1-additive-35b
just agent-index
just agent-work
just agent-gc
just public-site-deploy
just github-profile-sync
just rollback

Initial setup

Services that require credentials are disabled by default. A new installation can be bootstrapped in this order:

1. Install this repo at /srv/ops.
2. Configure sops recipients and create the local-only /home/rishabh/.config/homelab/secrets.yaml.
3. Enable homelab.secrets.
4. Enable ACME, Cloudflare Tunnel, private DNS, Vaultwarden, Backrest, Syncthing, and Samba as credentials become available.

Runbooks

• First-time setup
• Cloudflare administration
• Backups
• Vaultwarden and sops
• Codex integration
• T3 Code and Pi
• Local models in Pi
• Remote Phone microphone capture
• UMD Canvas bridge
• Agent environment
• Beeper Desktop MCP
• Syncthing

Repository boundaries

/srv/ops contains infrastructure code and operational documentation. Personal source material remains under /home/rishabh, outside this repository. Deploy commands copy only the required build output into /srv/state.