infra

    /\_____/\
   /  o   o  \
  ( ==  ^  == )
   )         (
  (           )
 ( (  )   (  ) )
(__(__)___(__)__)

where my servers live. they purr when healthy.

---

the setup

hetzner cloud, provisioned with opentofu, configured with nixos (flake-parts). everything declarative, everything reproducible. if a server explodes i can just... make another one.

secrets live in sops (secrets/), backed by 1password. ssh keys get generated by opentofu and tucked safely into the vault. the opentofu state is encrypted with a key from sops.

---

what lives here

matrix - chat server, encrypted and private

memos - simple note-taking for thoughts that need saving

firefly - personal finance tracker, theoretically useful

affine - workspace for docs and planning, notion alternative

pocket id - clean oidc provider for single sign-on

netbird - wireguard-based mesh vpn with proper access control

attic - a nix binary cache connected to a s3 bucket

---

commands

direnv allow then:

---

layout

every directory owns the nix that builds it; flake.nix only wires them together (plus the devshell and formatter).

• hosts/ - inventory.nix (domain, admin age keys, servers) and one directory per machine
• modules/nixos/ - core/ (site, ssh, caddy, dns, nix), services/, profiles/
• secrets/ - sops files; creation rules are generated from the inventory
• infra/ - opentofu; servers and dns come from the inventory and host configs
• scripts/ - one <name>.nix or <name>/default.nix per script, discovered automatically; shared bash in lib/

---

adding a new server

1. add it to hosts/inventory.nix with hcloud.serverType (plus ageKey once it has secrets)
2. make a home for it in hosts/<name>/
3. tf apply to birth the box (dns comes from its caddy sites and personal.dns.records)
4. deploy <name> to give it life

---

notes to self

• caddy renews certs automatically, stop checking on them
• the cloudflare api token needs dns edit permissions

---

meow