Archived
beatzaplentyandClaude Sonnet 4.6
f85c65870f
Consolidates nixos, docker, raspi, and debian-configuration into a single infrastructure-as-code repo. Includes: - ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi roles (converted from debian-configuration bash scripts) - terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub), Docker container catalog — migrated from docker/infrastructure/terraform/ - stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending git subtree population (see implementation plan) - docs/: internal MkDocs site with architecture, network topology, runbooks, and drift-detection guide; external sanitized site - scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh - CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change) - Pi-hole removed throughout — DNS is FreeIPA, DHCP is router See docs/internal/implementation-plan.md for the phased rollout after pushing to Gitea. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP
60 lines
2.3 KiB
Markdown
60 lines
2.3 KiB
Markdown
# infrastructure
|
|
|
|
Mono-repo for all homelab infrastructure as code. Manages configuration, provisioning,
|
|
service stacks, and documentation for the `sweet.home` LAN and edge nodes.
|
|
|
|
## Layout
|
|
|
|
```
|
|
infrastructure/
|
|
├── terraform/ Infrastructure state — Proxmox VMs, DNS, container catalog
|
|
├── ansible/ Configuration management for non-NixOS hosts
|
|
├── nixos/ NixOS flake (populated via git subtree — see implementation plan)
|
|
├── stacks/
|
|
│ ├── docker/ Main self-hosted app stack (Traefik, Nextcloud, Passbolt, Gitea…)
|
|
│ └── raspi/ Raspberry Pi edge monitoring stack
|
|
├── docs/ Unified internal + external documentation (MkDocs)
|
|
└── scripts/ Cross-cutting tooling (drift detection, docs build, hooks)
|
|
```
|
|
|
|
## Hosts managed
|
|
|
|
| Host | Role | OS | Managed by |
|
|
|------|------|----|-----------|
|
|
| `pve1.sweet.home` | Production hypervisor | Proxmox VE | Ansible (`proxmox-hardening` role) |
|
|
| `pve-test.sweet.home` | Sandbox hypervisor | Proxmox VE | Ansible (`proxmox-hardening` role) |
|
|
| `domain-controller.sweet.home` | FreeIPA / Kerberos / DNS | Rocky Linux 9 | Ansible (`freeipa` role) |
|
|
| `pihole.sweet.home` | DNS filtering / DHCP | Pi-hole v6 | Ansible (`pihole` role) |
|
|
| `raspberrypi.tail13f623.ts.net` | Edge monitoring | Debian 12 | Ansible (`raspberrypi` role) |
|
|
| NixOS VMs / LXCs on pve1 | Docker host, nix-cache, PXE, router… | NixOS | `nixos/` flake |
|
|
|
|
## CI/CD
|
|
|
|
| Workflow | Trigger | What it does |
|
|
|---------|---------|--------------|
|
|
| `secret-scan` | Push / PR | gitleaks across full git history |
|
|
| `drift-detect` | Daily 06:00 AEST | `terraform plan` + `ansible --check` on all managed hosts |
|
|
| `docs-build` | Push to `docs/` or `stacks/` | Rebuild and deploy internal + external MkDocs sites |
|
|
|
|
## Quick start
|
|
|
|
```bash
|
|
# Secrets pre-commit hook
|
|
./scripts/install-hooks.sh
|
|
|
|
# Validate everything (dry-run, no changes)
|
|
./scripts/drift-detect.sh --check-only
|
|
|
|
# Build docs locally
|
|
./scripts/docs-build.sh
|
|
```
|
|
|
|
## Related repos (migrating into this one)
|
|
|
|
The following repos are being absorbed. See `docs/internal/implementation-plan.md`.
|
|
|
|
- `nixos` → `nixos/`
|
|
- `docker` → `stacks/docker/`
|
|
- `raspi` → `stacks/raspi/`
|
|
- `debian-configuration` → `ansible/` (dissolved into roles)
|