Archived

This repository has been archived on 2026-07-30. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

beatzaplentyandClaude Sonnet 4.6 f85c65870f Initial infrastructure mono-repo scaffold

Consolidates nixos, docker, raspi, and debian-configuration into a single
infrastructure-as-code repo. Includes:

- ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
  roles (converted from debian-configuration bash scripts)
- terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
  Docker container catalog — migrated from docker/infrastructure/terraform/
- stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
  git subtree population (see implementation plan)
- docs/: internal MkDocs site with architecture, network topology, runbooks,
  and drift-detection guide; external sanitized site
- scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
- CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
- Pi-hole removed throughout — DNS is FreeIPA, DHCP is router

See docs/internal/implementation-plan.md for the phased rollout after
pushing to Gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

2026-07-30 07:07:47 +10:00

2.3 KiB

Raw Blame History

infrastructure

Mono-repo for all homelab infrastructure as code. Manages configuration, provisioning, service stacks, and documentation for the sweet.home LAN and edge nodes.

Layout

infrastructure/
├── terraform/        Infrastructure state — Proxmox VMs, DNS, container catalog
├── ansible/          Configuration management for non-NixOS hosts
├── nixos/            NixOS flake (populated via git subtree — see implementation plan)
├── stacks/
│   ├── docker/       Main self-hosted app stack (Traefik, Nextcloud, Passbolt, Gitea…)
│   └── raspi/        Raspberry Pi edge monitoring stack
├── docs/             Unified internal + external documentation (MkDocs)
└── scripts/          Cross-cutting tooling (drift detection, docs build, hooks)

Hosts managed

Host	Role	OS	Managed by
`pve1.sweet.home`	Production hypervisor	Proxmox VE	Ansible (`proxmox-hardening` role)
`pve-test.sweet.home`	Sandbox hypervisor	Proxmox VE	Ansible (`proxmox-hardening` role)
`domain-controller.sweet.home`	FreeIPA / Kerberos / DNS	Rocky Linux 9	Ansible (`freeipa` role)
`pihole.sweet.home`	DNS filtering / DHCP	Pi-hole v6	Ansible (`pihole` role)
`raspberrypi.tail13f623.ts.net`	Edge monitoring	Debian 12	Ansible (`raspberrypi` role)
NixOS VMs / LXCs on pve1	Docker host, nix-cache, PXE, router…	NixOS	`nixos/` flake

CI/CD

Workflow	Trigger	What it does
`secret-scan`	Push / PR	gitleaks across full git history
`drift-detect`	Daily 06:00 AEST	`terraform plan` + `ansible --check` on all managed hosts
`docs-build`	Push to `docs/` or `stacks/`	Rebuild and deploy internal + external MkDocs sites

Quick start

# Secrets pre-commit hook
./scripts/install-hooks.sh

# Validate everything (dry-run, no changes)
./scripts/drift-detect.sh --check-only

# Build docs locally
./scripts/docs-build.sh

The following repos are being absorbed. See docs/internal/implementation-plan.md.

nixos → nixos/
docker → stacks/docker/
raspi → stacks/raspi/
debian-configuration → ansible/ (dissolved into roles)

2.3 KiB Raw Blame History