mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
Ryan Yin
6fa6e6626e
services.homepage-dashboard runs the nixpkgs package with DynamicUser, replacing the :latest container, its system user and the activation script that rsynced the YAML into place. The YAML stays as is and is linked into /etc/homepage-dashboard. Assisted-by: Claude Code (claude-opus-5-5)
51 lines
2.3 KiB
Markdown
51 lines
2.3 KiB
Markdown
# Youko - Homelab Services
|
|
|
|
Storage, operation and maintenance related services are running on this host (migrated here from the
|
|
retired `aquamarine` VM — the name now belongs to the inference server, not this host):
|
|
|
|
1. Storage such as a git server, file server, torrent downloader, etc.
|
|
1. Back up my personal data with restic; the data is encrypted on the client.
|
|
1. Collect and monitor the metrics of my homelab.
|
|
|
|
## Features
|
|
|
|
### Storage and data
|
|
|
|
1. gitea: Self-hosted git service (`gitea.nix`).
|
|
1. sftpgo: SFTP / WebDAV server (`sftpgo.nix`).
|
|
1. postgresql: Database for the homelab services (`postgresql.nix`).
|
|
1. valkey: Redis-compatible cache for Immich (`valkey.nix`).
|
|
|
|
### Backups and object storage
|
|
|
|
1. restic: Encrypted backups; hosts the REST server the desktops push to (`../default.nix`).
|
|
1. rustfs: S3-compatible object storage (Loki chunks and Terraform state) (`rustfs.nix`).
|
|
|
|
### Media
|
|
|
|
1. immich: Photo and video library with ML search (`immich/`).
|
|
1. jellyfin: Media server (`jellyfin.nix`).
|
|
1. transmission: BitTorrent client (`transmission.nix`).
|
|
|
|
### Network and observability
|
|
|
|
1. caddy: Reverse proxy / TLS front end and the `file.writefor.fun` file server (`caddy.nix`).
|
|
1. victoriametrics + vmalert + alertmanager + grafana: Monitor the metrics of my homelab
|
|
(`monitoring/`).
|
|
1. homepage (`homepage/`) + uptime-kuma (`oci-containers/`): Service dashboard and uptime checks.
|
|
|
|
All the services assume a reverse proxy in front: they listen on localhost, and a caddy service
|
|
listens on the local network interface and proxies requests to them. The exception is transmission,
|
|
which runs in its own network namespace and binds its RPC to `192.168.5.118`.
|
|
|
|
## transmission networking
|
|
|
|
transmission deliberately does not use the host's default gateway `suzi` (192.168.5.178): it is a
|
|
mihomo transparent proxy that hijacks DNS to fake IPs (only routable through the proxy) and has no
|
|
UPnP/NAT-PMP, so a proxied transmission can never accept inbound peers.
|
|
|
|
Instead the service runs in its own network namespace, with a veth on `br0`, the address
|
|
`192.168.5.118`, a default route at the main router (`192.168.5.1`), a real resolver, and a fixed
|
|
MAC for a stable IPv6 IID. It listens on `192.168.5.118:51413` (TCP/UDP and IPv6) and caddy reaches
|
|
its RPC at `192.168.5.118:9091`. See `transmission.nix` for the implementation.
|