🏗️ NixOS Infrastructure — ymrtech.com

_{Multi-host, flake-driven NixOS deployment · Meshed WireGuard network · Fully declarative self-hosting}

---

---

🏠 Infrastructure Overview

🖥️ giga Daily Driver	🎮 command Desktop / VMs	🔒 vpn Gateway / DNS	🌐 public Public Services	📧 mail Mailserver
Gigabyte Aero 15x RTX 3090 eGPU CUDA Workloads	VMs + Gaming NVMe LUKS Encrypted Virtiofs Shares	AmneziaWireGuard Unbound DNS AdGuard Home Firezone	Forgejo Gitea Vaultwarden Coturn / Matrix Uptime Kuma	Postfix + Dovecot Full-Text Search Syncthing Fail2ban

---

🏗️ Architecture

Network Topology

┌──────────┐  wireguard   ┌──────────┐
│  giga    │ <──────────> │   vpn    │
│ 11.0.0.5 │  meshed VPN  │ 11.0.0.1 │
└──────────┘  11.0.0.0/24 │ Gateway  │
┌──────────┐              │ + NAT    │
│ command  │ <──────────> │encrypted │
│ 11.0.0.3 │              │   DNS    │
└──────────┘              │& adblock │
┌──────────┐              │          │ 
│ public   │ <─────────── │          │ 
│ 11.0.0.7 │      │       └────||────┘ 
└──────────┘      │       ┌────\/────┐
┌──────────┐      │       │ internet │
│ mail.ymr │ <────┘       │  vpn.ymr │
│ tech.com │              │ tech.com │
└──────────┘              └──────────┘

Host Matrix

Host	Type
giga	Laptop (Gigabyte Aero 15x)
command	Desktop
vpn	VPN Gateway (VPS)
public	Public Server (VPS)
mail	Mail Server (VPS)

---

⚡ Key Features

🔐 Security & Secrets

Feature	Detail
SOPS + Age	Multi-key encrypted secrets, all hosts can decrypt all secrets
SSH	Key-only auth, no password, no root login, Ed25519 host keys
TLS 1.3	Strong cipher suites, ACME/Let's Encrypt on all public services
Fail2ban	Aggressive mode on Postfix/Dovecot, 7-day max ban

🌐 Networking

Feature	Detail
AmneziaWireGuard	Custom module with traffic obfuscation (Jc, Jmin, Jmax, S1–S2, H1–H4)
NAT/MASQUERADE	Internal mesh traffic routed through vpn host to internet
Unbound DNS	Aggressive NSEC, 1.5GB+ cache, DoT upstream (Quad9 + Cloudflare)
AdGuard Home	DNS-level adblocking with custom filter lists
Private DNS Zone	ymr. internal domain resolution across the mesh
Coturn STUN/TURN	Matrix/VoIP relay with 16 private-range IP deny rules

💾 Storage & Filesystems

Feature	Detail
Btrfs	automatic filesystem snapshots and weekly auto-scrub
Subvolumes	/nix, /home, /root, backup/data — clean separation
LUKS Encryption	Multi-disk LUKS on giga/command, external backup drives

🖥️ Hardware & GPU mods

Feature	Detail
Specialisations	nvidia / intel driver switching on giga laptop
Custom Fan Curve	Sine-wave NVIDIA fan control via systemd timer
Undervolt	-130mV core/uncore/analogio, -75mV GPU
Kernel	Latest kernel packages, custom aorus-laptop WMI module

📊 Observability

Component	Purpose
VictoriaMetrics	Time-series metrics storage
vmagent	Remote write agent (client mode), scrape + forward
Node Exporter	System/hardware metrics
Journald Upload	Centralized log shipping
Uptime Kuma	Service health monitoring + alerting
OpenObserve	Log aggregation + dashboards

🤖 AI / ML Pipeline

Component	Detail
llama.cpp	CUDA-accelerated, 250k context
Model	Qwen3.6-35B-A3B (Q4_K_M quantized, ~22GB on disk)
LLM Agents	Hermes agent, Hermes desktop, Hermes HUD
ComfyUI-nix	Local Stable Diffusion / image generation
MCP Tools	forgejo-mcp, mcp-nixos for AI-assisted development

📦 Services

Service	Host	Details
Forgejo	public	Git server, LFS, Actions (act runner), root URL clean config
Vaultwarden	public	Bitwarden-compatible password manager, SMTP auth, ACME certs
Syncthing	All hosts	Device-mapped folder sync, cross-host backups
nixos-mailserver	mail	Postfix + Dovecot, full-text search, DMARC, ACME certs
Matrix Synapse	public	Coturn TURN integration for media relay
Cockpit	vpn	Web-based admin dashboard, proxied through nginx
Sunshine	giga	Game stream server (Moonlight client)
PostgreSQL	public	Database for Forgejo

---

🧩 Nix Architecture

Project Structure

nix-config/
├── flake.nix                    # Flake root: inputs, outputs, mkNixos helper
├── flake.lock                   # Pinned dependency versions
├── nixpkgs.nix                  # Legacy nixpkgs tarball from lock file
├── shell.nix                    # Dev shell: nix, home-manager, git
├── .sops.yaml                   # SOPS encryption keys + creation rules
├── secrets/
│   └── secrets.yaml             # Encrypted secrets store
├── hosts/
│   ├── common/
│   │   ├── global/              # Shared: nix settings, fish, auto-upgrade
│   │   ├── optional/            # Toggleable: grafana, victoriaMetrics, pipewire
│   │   └── users/
│   │       └── truva/           # User config: groups, SSH keys, shell
│   ├── giga/                    # Laptop host
│   ├── command/                 # Desktop host
│   ├── vpn/                     # VPN gateway host
│   ├── public/                  # Public services host
│   └── mail/                    # Mailserver host
├── modules/
│   ├── monitoring/
│   │   ├── README.md                # Usage examples and architecture
│   │   ├── victoriametrics.nix      # Server: VM + VictoriaLogs
│   │   └── vmagent.nix              # Agent: vmagent + journald upload
│   ├── wireguard-amneziawg.nix      # Custom AmneziaWireGuard NixOS module
│   ├── monitoring-tenant.nix        # Multi-tenant VM backend (experimental)
│   └── firezone-fix.nix             # Firezone gateway service override
└── overlays/
    ├── default.nix              # Overlay merger (fold + merge)
    ├── bookmap.nix              # Custom stdenv.mkDerivation (Java app)

Flake Inputs

Input	Purpose
nixpkgs	nixos-unstable channel
sops-nix	Secret encryption/decryption
hardware	nixos-hardware for hardware profiles
nixos-mailserver	Self-hosted mail server module
comfyui-nix	ComfyUI (Stable Diffusion) packaging
llm-agents	Hermes AI agent tooling
llama-cpp	llama.cpp packaging

---

🚀 Quick Start

# Bootstrap dev environment
nix-shell

# Build and activate a host
sudo nixos-rebuild switch --flake .#<hostname>
#or remotely
sudo nixos-rebuild switch --flake git+https://git.ymrtech.com/ymrtech/nix-config#vpn --refresh
#the refresh is to pull the latest git file, otherwise it uses a locally cached version and won't reflect any changes made on remotely

# Rebuild with a specific configuration
sudo nixos-rebuild switch --flake .#giga --specialisation nvidia 

# Update flakes
nix flake update

# Manage secrets
sops -e -i secrets/new-secret.yaml

Hostnames: giga, command, vpn, public, mail

---

🔑 User

Field	Value
Username	truva
Shell	Fish
Desktop	KDE Plasma 6 (X11)
Window Manager	KWin (plasmax11)
Terminal	Kitty
IDE	Kate
Keymap	Colemak-DH Ergo
Locale	en_CA.UTF-8
Timezone	America/Mexico_City

---

Built with Nix · Declarative · Reproducible · Meshed

```