Archived
beatzaplentyandClaude Sonnet 4.6
f85c65870f
Consolidates nixos, docker, raspi, and debian-configuration into a single infrastructure-as-code repo. Includes: - ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi roles (converted from debian-configuration bash scripts) - terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub), Docker container catalog — migrated from docker/infrastructure/terraform/ - stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending git subtree population (see implementation plan) - docs/: internal MkDocs site with architecture, network topology, runbooks, and drift-detection guide; external sanitized site - scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh - CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change) - Pi-hole removed throughout — DNS is FreeIPA, DHCP is router See docs/internal/implementation-plan.md for the phased rollout after pushing to Gitea. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP
infrastructure
Mono-repo for all homelab infrastructure as code. Manages configuration, provisioning,
service stacks, and documentation for the sweet.home LAN and edge nodes.
Layout
infrastructure/
├── terraform/ Infrastructure state — Proxmox VMs, DNS, container catalog
├── ansible/ Configuration management for non-NixOS hosts
├── nixos/ NixOS flake (populated via git subtree — see implementation plan)
├── stacks/
│ ├── docker/ Main self-hosted app stack (Traefik, Nextcloud, Passbolt, Gitea…)
│ └── raspi/ Raspberry Pi edge monitoring stack
├── docs/ Unified internal + external documentation (MkDocs)
└── scripts/ Cross-cutting tooling (drift detection, docs build, hooks)
Hosts managed
| Host | Role | OS | Managed by |
|---|---|---|---|
pve1.sweet.home |
Production hypervisor | Proxmox VE | Ansible (proxmox-hardening role) |
pve-test.sweet.home |
Sandbox hypervisor | Proxmox VE | Ansible (proxmox-hardening role) |
domain-controller.sweet.home |
FreeIPA / Kerberos / DNS | Rocky Linux 9 | Ansible (freeipa role) |
pihole.sweet.home |
DNS filtering / DHCP | Pi-hole v6 | Ansible (pihole role) |
raspberrypi.tail13f623.ts.net |
Edge monitoring | Debian 12 | Ansible (raspberrypi role) |
| NixOS VMs / LXCs on pve1 | Docker host, nix-cache, PXE, router… | NixOS | nixos/ flake |
CI/CD
| Workflow | Trigger | What it does |
|---|---|---|
secret-scan |
Push / PR | gitleaks across full git history |
drift-detect |
Daily 06:00 AEST | terraform plan + ansible --check on all managed hosts |
docs-build |
Push to docs/ or stacks/ |
Rebuild and deploy internal + external MkDocs sites |
Quick start
# Secrets pre-commit hook
./scripts/install-hooks.sh
# Validate everything (dry-run, no changes)
./scripts/drift-detect.sh --check-only
# Build docs locally
./scripts/docs-build.sh
Related repos (migrating into this one)
The following repos are being absorbed. See docs/internal/implementation-plan.md.
nixos→nixos/docker→stacks/docker/raspi→stacks/raspi/debian-configuration→ansible/(dissolved into roles)