The configuration behind everything else on this site, including the machine serving this page. Nine hosts described by one flake: a router, an SSH bastion, a storage server, an inference host, four workstations and a living-room kiosk.
How it is organised
Three layers, and a host is the intersection of them.
modules/ holds
system-level configuration, home-manager/ holds user-level configuration, and
hosts/<name>/ enables what that machine actually is.
The connective tissue is a set of systemOptions flags.
A host declares its
owner, its device type and its graphics vendor, and the modules decide from
there which drivers, hardening and services follow.
Users get a work,
play, root or server profile, and package selection is gated on the
profile rather than repeated per machine.
$ colmena apply --on @server
# build on e-desktop, push closures to the four servers
$ nrs
# rebuild the workstation in front of me
9 hosts · 1 build host · 0 servers compiling
The hive reuses each host’s NixOS modules rather than redefining them, so the
deployment and nixosConfigurations cannot drift. One workstation is the build
host and pushes results, which is why the servers and laptops never compile
anything themselves.
Services worth naming
Reverse proxy and TLS. Caddy on the router terminates every public hostname. This site and the documentation are static, so Caddy serves their Nix store paths directly with no backend at all; the interactive services sit behind a proof-of-work challenge.
Binary cache. The workstation serves its own store over nix-serve-ng, and
every other host is configured against it. That is what makes a CUDA-overlaid
ROOT build practical: it is compiled once, on the machine with the GPU, and
fetched everywhere else.
Local inference. One inference host, dual-GPU, serving one mode at a time: DeepSeek-V4-Flash across both GPUs, or a tensor-parallel Qwen3.8-27B with a vision model beside it. The bastion hosts the AI front: a gateway that routes the models and aggregates the tool servers, llama.cpp, a metasearch instance and Open WebUI. This is what son-of-anton runs against.
The unglamorous half. AdGuard and DNS, dynamic DNS for the apex and its subdomains, Prometheus and Grafana, a ZFS pool with a Borg backup server, Nextcloud, media, secrets with agenix, and a key-only deploy user whose sudo rights stop at the activation commands.
Theming
Colours come from base16.nix with schemes from base16-schemes, applied per
profile. The scheme is Kanagawa, which is where this site’s palette and the one
in the generated API references both come from.