Archived
beatzaplentyandClaude Sonnet 4.6
78fdf3d94c
- Document bidirectional LAN ↔ Tailscale routing via tailscale-router (static route on router for 100.64.0.0/10, subnet advertisement into Tailnet) - Document DNS proxy chain: FreeIPA conditional forwarder for *.ts.net → tailscale-router → MagicDNS; reverse for *.sweet.home from Tailscale clients - Remove stale pihole.sweet.home from IP table (decommissioned) - Fix freeipa role: remove Pi-hole IP from ipa_dns_forwarder, document ts.net conditional forwarder as a post-install step - Fix inventory: remove Pi-hole forwarder IP, add ts.net forwarder note Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP
infrastructure
Mono-repo for all homelab infrastructure as code. Manages configuration, provisioning,
service stacks, and documentation for the sweet.home LAN and edge nodes.
Layout
infrastructure/
├── terraform/ Infrastructure state — Proxmox VMs, DNS, container catalog
├── ansible/ Configuration management for non-NixOS hosts
├── nixos/ NixOS flake (populated via git subtree — see implementation plan)
├── stacks/
│ ├── docker/ Main self-hosted app stack (Traefik, Nextcloud, Passbolt, Gitea…)
│ └── raspi/ Raspberry Pi edge monitoring stack
├── docs/ Unified internal + external documentation (MkDocs)
└── scripts/ Cross-cutting tooling (drift detection, docs build, hooks)
Hosts managed
| Host | Role | OS | Managed by |
|---|---|---|---|
pve1.sweet.home |
Production hypervisor | Proxmox VE | Ansible (proxmox-hardening role) |
pve-test.sweet.home |
Sandbox hypervisor | Proxmox VE | Ansible (proxmox-hardening role) |
domain-controller.sweet.home |
FreeIPA / Kerberos / DNS | Rocky Linux 9 | Ansible (freeipa role) |
pihole.sweet.home |
DNS filtering / DHCP | Pi-hole v6 | Ansible (pihole role) |
raspberrypi.tail13f623.ts.net |
Edge monitoring | Debian 12 | Ansible (raspberrypi role) |
| NixOS VMs / LXCs on pve1 | Docker host, nix-cache, PXE, router… | NixOS | nixos/ flake |
CI/CD
| Workflow | Trigger | What it does |
|---|---|---|
secret-scan |
Push / PR | gitleaks across full git history |
drift-detect |
Daily 06:00 AEST | terraform plan + ansible --check on all managed hosts |
docs-build |
Push to docs/ or stacks/ |
Rebuild and deploy internal + external MkDocs sites |
Quick start
# Secrets pre-commit hook
./scripts/install-hooks.sh
# Validate everything (dry-run, no changes)
./scripts/drift-detect.sh --check-only
# Build docs locally
./scripts/docs-build.sh
Related repos (migrating into this one)
The following repos are being absorbed. See docs/internal/implementation-plan.md.
nixos→nixos/docker→stacks/docker/raspi→stacks/raspi/debian-configuration→ansible/(dissolved into roles)