Reinitialized Infrastructure

NixOS infrastructure flake for building Proxmox VMA images and managing the Reinitialized fleet. The repository defines host configurations, reusable NixOS modules, WireGuard mesh networking, Docker-based services, secret templates, and deployment tools installed on the devenv host.

For standard NixOS options, use the NixOS manual. This documentation covers repository-specific behavior.

Quick Start

Use Host onboarding when adding a host. Keep live secret files outside the checkout and provision runtime credentials separately.

Show current flake outputs without updating flake.lock:

nix flake show path:. --no-write-lock-file

Build one host with synthetic metadata, without activating it:

nix build .#checks.x86_64-linux.rp1 --no-write-lock-file --no-link

Build one Proxmox VMA image:

nix build path:.#packages.x86_64-linux.rp1

The VMA build writes result/vzdump-qemu-<vmId>.vma.zst. Password login is locked in the image; bootstrap with the configured rnetadmin SSH key.

Current Flake Outputs

The source of truth for exported hosts is flake.nix. VM hosts are exported as both nixosConfigurations.<host> and packages.x86_64-linux.<host>.

Host	VM ID	VLAN	Mesh IP	Purpose
devenv	202	200	10.255.0.1	Development VM and fleet management tools
rp1	203	12	10.255.0.2	Reverse proxy, public ingress, DNS/mail stream proxying
apps1	204	11	10.255.0.3	Hudu, Technitium DNS primary, Stalwart, Forgejo, Jaeger, Grafana, Authentik
apps2	205	11	10.255.0.4	Technitium DNS secondary, UniFi, pgAdmin, Redis Insight, Forgejo Runner, Cinny
apps3	207	11	10.255.0.5	Immich, Tuwunel Matrix, Paperless-ngx, Pelican Panel, OCIS, SearXNG
llm1	210	11	10.255.0.9	Qwen3.8-Flash-Next-Uncensored IQ4_XS on native Strata with the passed-through GTX 1070 (llm1)
db1	206	11	10.255.0.11	PostgreSQL, Valkey, OpenTelemetry Collector, Prometheus

gs1 exists in hosts/, modules/secrets.example/, and meshTopology.nix, but it is commented out in flake.nix; .#gs1 builds and deploys do not work until it is exported.

Common Commands

Build all exported NixOS configurations without generating VMA images:

nix build \
  path:.#nixosConfigurations.devenv.config.system.build.toplevel \
  path:.#nixosConfigurations.rp1.config.system.build.toplevel \
  path:.#nixosConfigurations.apps1.config.system.build.toplevel \
  path:.#nixosConfigurations.apps2.config.system.build.toplevel \
  path:.#nixosConfigurations.apps3.config.system.build.toplevel \
  path:.#nixosConfigurations.llm1.config.system.build.toplevel \
  path:.#nixosConfigurations.db1.config.system.build.toplevel

Build a Proxmox image for one host:

nix build path:.#packages.x86_64-linux.apps1

Import a built VMA on a Proxmox host:

scp result/vzdump-qemu-204.vma.zst root@proxmox:/var/lib/vz/dump/
qmrestore /var/lib/vz/dump/vzdump-qemu-204.vma.zst 204 --storage hotData
qm start 204

Format changed Nix files when the formatter is available:

nixfmt-rfc-style <file>.nix

checks.x86_64-linux.<host> builds each exported host with checked-in synthetic metadata under pure evaluation. These are build checks, not deployment outputs. The flake does not define formatter, apps, or devShells.

Fleet Management

The devenv host installs generated tools from hosts/devenv/tools/.

Deploy one host:

rebuildHost apps1
rebuildHost llm1
rebuildHost rp1 --boot
rebuildHost devenv

Deploy every exported host with an endpoint in meshTopology.nix:

updateInfra

Important behavior:

• rebuildHost <remote> and updateInfra use SSH as rnetadmin and pass --sudo to the remote rebuild.
• Do not run remote deploys with sudo; the scripts reject root because root breaks the SSH key flow.
• rebuildHost devenv is local and uses sudo nixos-rebuild internally.
• updateInfra uses exported topology hosts except those with fleetDeployment = false.

Generate OPNsense firewall rule recommendations from traffic logs:

updateNetworkFirewallRules --dry-run

Credentials come from secrets.opnsenseFirewall on devenv, or from environment variables documented in Secrets Management.

Repository Layout

Path	Purpose
flake.nix	Inputs, host definitions, nixosConfigurations, VMA packages
library/	Internal helpers for NixOS configs, dual exports, VMA generation, and user modules
library/generateVMAImage/	Proxmox VMA builder and generated QEMU config
hosts/	Host-specific NixOS modules
hosts/devenv/tools/	Generated deployment and firewall helper scripts
modules/profiles/	Standard, firewall, secrets, mesh, containers, and data-disk profiles
modules/packages/	Package overrides used by service hosts
modules/secrets.example/	Checked-in templates for live secrets
/var/lib/infratainer/secrets/	External live secret overlay on devenv; never place it inside the checkout
docs/	Architecture, module, example, and investigation notes
overrides/vma.nix	QEMU package override with VMA support

Documentation

• Documentation Index
• Architecture Overview
• Library Functions
• Module Documentation
• Profiles
• Examples
• Mesh Network Port Reference
• llm1 LLM service

Secrets

Do not put live secrets anywhere under the repository. Real host modules live in the protected external overlay /var/lib/infratainer/secrets; templates live in modules/secrets.example/<host>.nix.

Set INFRA_SECRETS_DIR=/var/lib/infratainer/secrets and use impure evaluation. When adding or renaming a secret key used by a host, update the matching example.