nix-selfhost — selfhosting on NixOS, made a one-liner

A selfhosting starter for anyone running NixOS on a VM, LXC or VPS. Declarative, hardened, reproducible: clone the repo on the machine, run one interactive script, pick your services — done.

Quick start (standalone mode — this machine only)

# on a fresh NixOS machine
git clone <this-repo> nix-selfhost && cd nix-selfhost
sudo ./scripts/bootstrap.sh

The script asks you:

Prompt	Meaning
hostname / admin user / timezone	identität of the box
ssh keys	login keys for the admin user (reuse local keys or paste)
services	numbered multi-select from modules/services/ — grows as new modules land
reverse proxy (Caddy)?	optional wildcard cert via ACME DNS-01; prints a DNS checklist (wildcard A record + provider API token)
Dashy dashboard?	auto-lists every enabled service at https://<service>.<domain>
ntfy alerts?	failed-units push notifications, declarative users
uptime-kuma?	web monitoring; monitors are synced automatically from the same service list
restic backups?	NAS (sftp) and/or S3 targets

Then it:

• generates hosts/<hostname>/default.nix + facts,
• creates sops-encrypted secrets on this machine (age key in /var/lib/sops/age/keys.txt; nothing leaves the host),
• validates (nix flake check, preflight build),
• activates locally with nixos-rebuild switch --flake .#<host>,
• verifies units and URLs.

Every service lands in Caddy (only 22/80/443 firewalled) and in the dashboard automatically; all modules stay host-agnostic so the same code powers 1 or 50 machines.

Fleet mode (laptop-managed, multi-host)

If you manage several machines from a laptop:

nix develop -c $SHELL
./scripts/fleet-add-host.sh     # interactive, per host
nix develop -c deploy .#<host>  # deploy-rs push w/ magic rollback

Same modules, same registry; deploy-rs is keeping rollback safety here.

Repo layout

modules/base/       baseline for every host: packages, users, ssh, hardening
modules/homelab/    service registry -> Caddy vhosts + ACME wildcard certs
modules/services/   one .nix per service; enable via homelab.services.<x>.enable
hosts/<name>/       per-host config (bootstrap.sh / fleet-add-host.sh generate it)
hosts/facts.json    registry of hosts -> deploy targets
secrets/            sops-encrypted age files; plaintext never committed
scripts/            bootstrap.sh (on-machine), fleet-add-host.sh (laptop)

Documentation

• architecture.md — how the pieces fit
• add-new-host.md — full recipes: VM / LXC / VPS
• services.md — adding your own service module
• monitoring.md — Kuma + ntfy + declarative monitor sync
• backups-restore.md — restic NAS/S3 + restore runbook

Principles

• least exposure: services bind 127.0.0.1, Caddy is the only public entry
• secrets via sops; the nix store is immutable and credentials never leak
• every service module is a small self-contained .nix file — add yours by copying an existing one
• no flakes-in-the-dark: every decision visible in plain config files