# infrastructure

Mono-repo for all homelab infrastructure as code. Manages configuration, provisioning,
service stacks, and documentation for the `sweet.home` LAN and edge nodes.

## Layout

```
infrastructure/
├── terraform/        Infrastructure state — Proxmox VMs, DNS, container catalog
├── ansible/          Configuration management for non-NixOS hosts
├── nixos/            NixOS flake (populated via git subtree — see implementation plan)
├── stacks/
│   ├── docker/       Main self-hosted app stack (Traefik, Nextcloud, Passbolt, Gitea…)
│   └── raspi/        Raspberry Pi edge monitoring stack
├── docs/             Unified internal + external documentation (MkDocs)
└── scripts/          Cross-cutting tooling (drift detection, docs build, hooks)
```

## Hosts managed

| Host | Role | OS | Managed by |
|------|------|----|-----------|
| `pve1.sweet.home` | Production hypervisor | Proxmox VE | Ansible (`proxmox-hardening` role) |
| `pve-test.sweet.home` | Sandbox hypervisor | Proxmox VE | Ansible (`proxmox-hardening` role) |
| `domain-controller.sweet.home` | FreeIPA / Kerberos / DNS | Rocky Linux 9 | Ansible (`freeipa` role) |
| `pihole.sweet.home` | DNS filtering / DHCP | Pi-hole v6 | Ansible (`pihole` role) |
| `raspberrypi.tail13f623.ts.net` | Edge monitoring | Debian 12 | Ansible (`raspberrypi` role) |
| NixOS VMs / LXCs on pve1 | Docker host, nix-cache, PXE, router… | NixOS | `nixos/` flake |

## CI/CD

| Workflow | Trigger | What it does |
|---------|---------|--------------|
| `secret-scan` | Push / PR | gitleaks across full git history |
| `drift-detect` | Daily 06:00 AEST | `terraform plan` + `ansible --check` on all managed hosts |
| `docs-build` | Push to `docs/` or `stacks/` | Rebuild and deploy internal + external MkDocs sites |

## Quick start

```bash
# Secrets pre-commit hook
./scripts/install-hooks.sh

# Validate everything (dry-run, no changes)
./scripts/drift-detect.sh --check-only

# Build docs locally
./scripts/docs-build.sh
```

## Related repos (migrating into this one)

The following repos are being absorbed. See `docs/internal/implementation-plan.md`.

- `nixos` → `nixos/`
- `docker` → `stacks/docker/`
- `raspi` → `stacks/raspi/`
- `debian-configuration` → `ansible/` (dissolved into roles)