anotherhadi/nixy
1
Fork 0
mirror of https://github.com/anotherhadi/nixy.git synced 2026-04-02 11:12:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

v4.0.0

Browse Source 
Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>
This commit is contained in:
Hadi
2026-01-01 17:15:04 +01:00
parent 1b0eb2f7bf
commit 8e6270ca34
72 changed files with 1245 additions and 2252 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
docs/SERVER.md
View File

@@ -1,62 +1,53 @@
# SERVER
## Overview
> Update in comming. Early 2026
## Overview
This document describes the architecture and setup of the self-hosted **NixOS server**, which is securely accessible via **Tailscale**. The server is designed for private, secure, and easily manageable self-hosting of various services.
![server dashboard](../.github/assets/server_dashboard.png)
## **Why This Setup?**
## **Why This Setup?**
- **Private & Secure**: Services are only accessible through Tailscale, preventing exposure to the public internet.
- **Domain-based Access**: A custom domain (`example.org`) maps to the server's Tailscale IP, making service access simple and consistent.
- **Automatic SSL Certificates**: Using DNS-01 challenges, valid SSL certificates are generated even though the services are not publicly exposed.
- **Modular & Declarative**: Everything is managed through NixOS modules, ensuring reproducibility and easy configuration.
- **Private & Secure**: Services are only accessible through Tailscale, preventing exposure to the public internet.
- **Domain-based Access**: A custom domain (`example.org`) maps to the server's Tailscale IP, making service access simple and consistent.
- **Automatic SSL Certificates**: Using DNS-01 challenges, valid SSL certificates are generated even though the services are not publicly exposed.
- **Modular & Declarative**: Everything is managed through NixOS modules, ensuring reproducibility and easy configuration.
## **Self-Hosted Services**
## **Self-Hosted Services**
The server hosts several key applications:
The server hosts several key applications:
### **Core Infrastructure**
### **Core Infrastructure**
- **NGINX**: Reverse proxy for routing traffic to services via `example.org`.
- **Bitwarden**: A self-hosted password manager for secure credential storage.
- **Nextcloud**: A private cloud solution for file synchronization and collaboration.
- **NGINX**: Reverse proxy for routing traffic to services via `example.org`.
### **Networking & Security**
### **Networking & Security**
- **AdGuard Home**: A self-hosted DNS ad blocker for network-wide ad and tracker filtering.
- **AdGuard Home**: A self-hosted DNS ad blocker for network-wide ad and tracker filtering.
### **Monitoring & Storage**
### **Monitoring & Storage**
- **Glance**: An awesome dashboard! (See the screenshot above)
- **Hoarder**: A self-hostable bookmark-everything app (links, notes and images)
### **Media & Content Management**
### **Media & Content Management**
- **Arr Stack (Radarr, Sonarr, etc.)**: Automated media management tools for handling movies and TV shows. (legaly ofc)
## **How It Works**
## **How It Works**
1. **Domain Configuration**
1. **Domain Configuration**
- `example.org` is pointed to the Tailscale IP of the server. (cloudflare A record, not proxied)
- This allows for easy access without exposing services to the internet.
- This allows for easy access without exposing services to the internet.
2. **SSL Certificate Generation**
2. **SSL Certificate Generation**
- Certificates are obtained using a **DNS-01 challenge**, verifying domain ownership without requiring public access.
3. **NGINX Reverse Proxy**
- Routes incoming requests from `*.example.org` to the correct internal service.
- Ensures SSL termination and secure connections.
3. **NGINX Reverse Proxy**
- Routes incoming requests from `*.example.org` to the correct internal service.
- Ensures SSL termination and secure connections.
4. **Access Control**
- Only devices within the Tailscale network can reach the services.
4. **Access Control**
- Only devices within the Tailscale network can reach the services.
- Firewall rules restrict access further based on necessity.
## What's Next?
I want to self-host:
- **A great todolist app**: One that is compatible with markdown & IOS
- **Cyberchef**
- **Maybe**: An app to manage finances