Archived
infrastructure
Mono-repo for all homelab infrastructure as code. Manages configuration, provisioning,
service stacks, and documentation for the sweet.home LAN and edge nodes.
Layout
infrastructure/
├── terraform/ Infrastructure state — Proxmox VMs, DNS, container catalog
├── ansible/ Configuration management for non-NixOS hosts
├── nixos/ NixOS flake (populated via git subtree — see implementation plan)
├── stacks/
│ ├── docker/ Main self-hosted app stack (Traefik, Nextcloud, Passbolt, Gitea…)
│ └── raspi/ Raspberry Pi edge monitoring stack
├── docs/ Unified internal + external documentation (MkDocs)
└── scripts/ Cross-cutting tooling (drift detection, docs build, hooks)
Hosts managed
| Host | Role | OS | Managed by |
|---|---|---|---|
pve1.sweet.home |
Production hypervisor | Proxmox VE | Ansible (proxmox-hardening role) |
pve-test.sweet.home |
Sandbox hypervisor | Proxmox VE | Ansible (proxmox-hardening role) |
domain-controller.sweet.home |
FreeIPA / Kerberos / DNS | Rocky Linux 9 | Ansible (freeipa role) |
pihole.sweet.home |
DNS filtering / DHCP | Pi-hole v6 | Ansible (pihole role) |
raspberrypi.tail13f623.ts.net |
Edge monitoring | Debian 12 | Ansible (raspberrypi role) |
| NixOS VMs / LXCs on pve1 | Docker host, nix-cache, PXE, router… | NixOS | nixos/ flake |
CI/CD
| Workflow | Trigger | What it does |
|---|---|---|
secret-scan |
Push / PR | gitleaks across full git history |
drift-detect |
Daily 06:00 AEST | terraform plan + ansible --check on all managed hosts |
docs-build |
Push to docs/ or stacks/ |
Rebuild and deploy internal + external MkDocs sites |
Quick start
# Secrets pre-commit hook
./scripts/install-hooks.sh
# Validate everything (dry-run, no changes)
./scripts/drift-detect.sh --check-only
# Build docs locally
./scripts/docs-build.sh
Related repos (migrating into this one)
The following repos are being absorbed. See docs/internal/implementation-plan.md.
nixos→nixos/docker→stacks/docker/raspi→stacks/raspi/debian-configuration→ansible/(dissolved into roles)