personal nixos infrastructure managed with clan-core. modules are feature-oriented: feature modules export reusable features through flake.modules.*, while clan roles and machine imports compose them into concrete systems. the repo covers host configuration, user environments, secrets, storage, networking, and self-hosted services.
- clan-core - machine inventory, secrets (sops-nix/age), disk partitioning (disko), service roles and clan-services
- flake-parts - modular flake framework
- feature-oriented module structure - feature modules export features through
flake.modules.*, composed through clan roles and machine imports - home-manager - user environments and desktop integration
- preservation - opt-in state persistence with ephemeral roots; see why preservation over impermanence
- openwrt home network declarative router/ap management
inventory/ clan inventory: machines, tags, service instances and role assignment
machines/<name>/ host-local composition, hardware, disks
modules/
nixos/ nixos features: common roles, services, hardware, filesystems, boot
home-manager/ home-manager features: shell, cli, editors, desktop
clan-services/ reusable clan services with roles and vars
llm/ coding agent configs, skills, souls
flake-parts/ flake-level wiring: hosts, domains, packages, ci effects, openwrt
users/ per-user home-manager composition
packages/ local packages, exposed as flake packages and pkgs.local.*
openwrt/ router and access point config, rendered to uci
templates/ flake templates for new projects, modules, and clan services
imports are the enable mechanism. each feature owns its integrations: dashboard tile, health check, reverse proxy route, grafana dashboards, and alerts; homepage and gatus collect them across hosts, so there is no central service registry.
system & state
- zfs snapshot before every switch - a broken migration rolls back to the moment before the switch
- ephemeral root - root rolled back on boot, state persisted explicitly through preservation
- immutable /etc -
/etcas an erofs overlay - snapshot-backed backups - filesystem snapshots as the source for borgbackup
local llm & agents
- llama.cpp - local model router with pinned models; model selection
- hermes - hermes agents as clan service instances, each sealed in a fencr microvm sandbox
- agent tooling - coding agents configured from one place, with pi-pack and local skills
- remote workspace - a headless dev host that uses the workstation's agents and browser through forwarded sockets
build & ci
- nixbot ci with scheduled effects and an updater pipeline that opens update prs
- remote builds over nix-grpc-store and self-hosted binary caches
network & security
- netbird - self-hosted overlay network and public ingress; why netbird
- sso with authelia and lldap; why
- openwrt - router and access points managed declaratively from nix
- yubikey as openpgp ssh key; why
observability
- monitoring - metrics, logs, dashboards, and alerts as a clan service
desktop
- niri with noctalia-shell
- noctalia v5 plugins - luau plugins shipped straight from the repo as a local plugin source
everything else
- self-hosted services
- local packages - packages not in nixpkgs
- templates - flake templates
i work heavily with ai coding agents, in this repo and elsewhere, and i am open about it. i also try not to annoy anyone with ai slop: my agents follow shared writing instructions, ai-tells-lint catches llm writing tells, and i review every change before it lands. commits written with an agent carry the linux kernel's Assisted-by: LLM trailer.
notable migrations and tradeoffs get a decision record in docs/decisions:
- preservation over impermanence
- openpgp card ssh key over fido2 and piv
- github over codeberg
- netbird over tailscale and pangolin
- authelia + lldap over pocket-id, kanidm, and the enterprise idps
- caddy over nginx
- opencloud over nextcloud + paperless
- local llama.cpp model selection
- zfs: legacy mountpoints for every mounted dataset
topology, networks, and per-machine details are in machines/README.md.
| machine | type | description | specs |
|---|---|---|---|
| desktop | desktop | daily driver workstation | dyi: ryzen 7 7800x3d, rx 7800xt, 32gb ddr5 |
| lpt-titan | laptop | remote work | framework 13: ryzen ai 5 340, radeon 840m, 32gb |
| nixbox | home server | self-hosted services | dyi: ryzen 7 5700x, 64gb, nvidia rtx pro 4000 backwell sff, 4x6tb + 2x960gb ssd, 2x16gb optane |
| nixworker | home server | ci, remote builder, cache | minisforum ms-a2: ryzen 9 9955hx, intel arc pro b50, 96gb ddr5 |
| gateway | vps | gw/reverse proxy (netbird) | hetzner cx23: 2vcpu, 4gb ram, 40gb ssd |