Secrets

• Encrypted secrets file. All repo-managed credentials live in secrets/secrets.yaml, encrypted with SOPS/age.
• Encrypted OpenTofu state. State and plans are encrypted client-side (PBKDF2 + AES-GCM) with a passphrase from TF_VAR_state_passphrase.

Network perimeter

• Default-drop firewall on the router. I use a hand-written nftables ruleset with policy drop on both input and forward. Only lo, lan0 and wg0 are trusted. WAN accepts only established traffic, WireGuard UDP and HTTP/HTTPS.
• No SSH from the WAN. sshd on the router is not exposed to the internet at all.
• WireGuard for remote access.
• Forced DNS. NAT redirects all LAN and VPN port-53 traffic to the router’s AdGuard. AdGuard uses Quad9 over DoT upstream, with blocklists and safe search.
• Second-level ACL in nginx. Private .home vhosts and Grafana carry allow LAN; allow VPN; deny all;.
• TLS everywhere. Every public vhost sets forceSSL with recommendedTlsSettings. Certificates come from ACME DNS-01, so issuance needs no inbound port 80. Cloudflare is DNS-only with no proxy, so no third party sees plaintext.

Host access

• SSH hardening. Password and keyboard-interactive auth are off, PermitRootLogin = “no”, and logins are key-only.
• Dedicated deployer system user. It uses a CI-only keypair, separate from the interactive keys. Everything it does through sudo is logged with LOG_INPUT/LOG_OUTPUT to /var/log/sudo-deployer.log.

Thanks for sharing. I’m trying it out as a Google Keep replacement.

Yeah so at worst you could get sued by some random reddit users that don’t want their post history hosted on your site.

Given how little traction artists and authors have had with suing AI companies for blatant copyright infringement, I kinda doubt it would go anywhere.

If your health check is broken, then you might not notice that a service is down and you’ll fail to deploy a replacement. Or the opposite, and you end up constantly replacing it, creating a “flapping” service.

An issue which I aim to resolve using a self-hosted VPN.

I use dufs. Copyparty seems good too.

Not all VPNs store enough user info for feds to be able to find anything useful on their servers.

Why not use zipapp?

https://docs.python.org/3.13/library/zipapp.html

I’m perfectly happy to build my own NAS with NixOS and ZFS on it. I think it’s mostly a matter of getting the right hardware.

My biggest shortcoming at the moment is my NAS is also my gaming PC. It’s pretty inefficient to have that on all the time. But I haven’t had the time to build a dedicated NAS.

ntopng has all of that. I’m currently hosting it on my home router.

If you go this route I recommend installing Kodi + Jellyfin Plugin + Kore Android App. You can control everything from your phone or laptop.

Boomers on Facebook are mostly a lost cause so we just have to assume they won’t be part of any kind of new social media movement.

• Has a simple backup and migration workflow. I recently had to backup and migrate a MediaWiki database. It was pretty smooth but not as simple as it could be. If your data model is spread across RDBMS and file, you need to provide a CLI tool that does the export/import.

• Easy to run as a systemd service. This is the main criteria for whether it will be easy to create a NixOS module.

• Has health endpoints for monitoring.

• Has an admin web UI that surfaces important configuration info.

• If there are external service dependencies like postgres or redis, then there needs to be a wealth of documentation on how those integrations work. Provide infrastructure as code examples! IME systemd and NixOS modules are very capable of deploying these kinds of distributed systems.

Silverbullet is nice

How long did you try it? It took me a good two months to get back to full speed.

I like AdGuard Home myself.

Wireguard is p2p.

EDIT: I guess the point is it’s doing peer discovery without static public IPs or DNS. Pretty cool!

Sounds a lot like the AT Protocol.

I’m not in the market, but I’ve actually had similar thoughts of building a project on top of NixOS that’s focused on self-hosting for homes and small businesses. I recently deployed my own router/server on a BeeLink mini PC and instead of using something like OpenWRT, I used NixOS, systemd-networkd, nftables, etc.

DM me if you want to discuss more. I think the idea has potential and I might be interested in helping if you can get the business model right (even if it just ends up being some FOSS thing).