Archived
beatzaplentyandClaude Sonnet 4.6
f85c65870f
Consolidates nixos, docker, raspi, and debian-configuration into a single infrastructure-as-code repo. Includes: - ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi roles (converted from debian-configuration bash scripts) - terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub), Docker container catalog — migrated from docker/infrastructure/terraform/ - stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending git subtree population (see implementation plan) - docs/: internal MkDocs site with architecture, network topology, runbooks, and drift-detection guide; external sanitized site - scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh - CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change) - Pi-hole removed throughout — DNS is FreeIPA, DHCP is router See docs/internal/implementation-plan.md for the phased rollout after pushing to Gitea. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP
4.6 KiB
4.6 KiB
Architecture
Infrastructure layers
┌─────────────────────────────────────────────────────────┐
│ pve1.sweet.home (Proxmox VE — production hypervisor) │
│ │
│ ┌────────────┐ ┌──────────┐ ┌──────────────────────┐ │
│ │ server- │ │ docker │ │ nix-cache pxe-boot │ │
│ │ nixos VM │ │ LXC │ │ LXC LXC │ │
│ │ (baremetal │ │ 192.168 │ │ .224 .223 │ │
│ │ GUI host) │ │ .2.225 │ └──────────────────────┘ │
│ └────────────┘ └──────────┘ │
│ ┌────────────┐ ┌──────────┐ ┌──────────────────────┐ │
│ │ domain- │ │ pxe-boot │ │ ha-server-1 ha- │ │
│ │ controller │ │ LXC │ │ VM .2.228 server-2│ │
│ │ FreeIPA VM │ │ PXE DHCP │ │ VM .2.227│ │
│ │ .2.253 │ │ .2.223 │ └──────────────────────┘ │
│ └────────────┘ └──────────┘ │
└─────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────┐
│ pve-test.sweet.home (Proxmox VE — sandbox) │
│ WiFi-connected. Safe for scratch VMs/LXCs. │
└─────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────┐
│ raspberrypi.tail13f623.ts.net (Raspberry Pi 4) │
│ Edge monitoring via Tailscale. │
│ Traefik · Uptime Kuma · CrowdSec · Beszel agent │
└─────────────────────────────────────────────────────────┘
Configuration management matrix
| Host | Managed by | How |
|---|---|---|
| pve1, pve-test | Ansible (proxmox-hardening role) |
ansible/playbooks/proxmox.yml |
| domain-controller | Ansible (freeipa role) |
ansible/playbooks/freeipa.yml |
| pihole | Ansible (pihole role) |
ansible/playbooks/pihole.yml |
| raspberrypi | Ansible (raspberrypi role) |
ansible/playbooks/raspi.yml |
| docker LXC | NixOS flake | nixos/ — proxmox-docker target |
| nix-cache LXC | NixOS flake | nixos/ — proxmox-nix-cache target |
| pxe-boot LXC | NixOS flake | nixos/ — proxmox-pxe-boot target |
| ha-server-1/2 | NixOS flake | nixos/ — proxmox-ha-server-1/2 targets |
| baremetal workstation | NixOS flake | nixos/ — baremetal-gui target |
Authentication and DNS backbone
FreeIPA (SWEET.HOME realm) provides:
- Kerberos SSO for all IPA-enrolled hosts
- LDAP user/group directory (
admins,docker-accessgroups) - Authoritative DNS for the entire LAN (Pi-hole decommissioned; FreeIPA is the sole resolver)
- Certificate authority for internal TLS
All hosts (Proxmox nodes, Raspberry Pi, Docker host) are IPA-enrolled via SSSD.
The admins group has passwordless sudo on all enrolled hosts.
The docker-access group (GID 50010) grants Docker socket access on Docker hosts.
DHCP is handled by the router. PXE-specific DHCP options are served by the pxe-boot LXC.
Monitoring stack
Beszel agents (every host)
└─→ Beszel hub (stacks/docker — beszel.lan.ddnsgeek.com)
Uptime Kuma (stacks/docker — monitor-kuma.lan.ddnsgeek.com)
└─→ monitors all public endpoints
Gotify (stacks/docker)
└─→ receives: WUD alerts, Docker health checks, drift detection notifications
WUD (stacks/docker)
└─→ watches: local docker host + Raspberry Pi (via Tailscale)