Homelab

Two years ago, a friend and I backed each other up through a TrueNAS VM on an iSCSI zvol. Now that I run NixOS, I replaced that machinery with zfs-tenant: OpenZFS delegation and a quota keep him inside one dataset, and a small SSH forced command plus zfs zone make sure he sees nothing else of my pool. His keys never leave his house, and a VM test checks each of those claims.

Friends keep asking how my homelab works, so I wrote it all down, starting from zero. Four NixOS machines run about 150 containers behind one Traefik front door, and with WireGuard and my own Headscale server I reach my self-hosted services from anywhere over encrypted HTTPS connections, while strangers on the internet get nothing. The part I think is the coolest is the balance: everything is declarative and lives in git, but with as little machinery as possible.

🤝 zfs-tenant: Give a friend a quota-capped corner of your ZFS pool for their raw encrypted backups, without giving them a shell. Their keys never leave their house, so you can’t read what they store. 💾

After replacing Proxmox and TrueNAS with NixOS, my GPU machine was the last one still on btrfs, picked years ago because forum threads had me convinced that ZFS and NixOS were a bad combination. What finally pushed me to fix it: I run AI agents in YOLO mode all day, the stories about frontier models wiping home directories kept coming, and my restic backups needed an hour and a half just to scan a hundred million files. The audit’s first finding: the backups had been silently dead for four months. This is the story of auditing my backups, verifying the restore path end-to-end, and wiping my daily driver so that nine machines share the exact same ZFS setup.

🔑 zfs-unlock: Unlock encrypted OpenZFS datasets automatically after every reboot, while the passphrases stay on a separate device (a Raspberry Pi, say) and travel over a restricted SSH channel. 🔒

TrueNAS was the last appliance OS in my homelab. The build-system change was the last straw, but the itch had been building for a while: too much UI state, unclear defaults, and virtualization churn around Incus. This is the story of how I gave an AI agent root-capable SSH access with strict instructions not to change anything, used it to inspect the live machine, recreated the config declaratively, and built a VM rehearsal to prove disko would only wipe the boot disk.

🚜 Compose Farm: Run Docker Compose stacks across multiple hosts over plain SSH, with no agents to install. Stacks stay plain folders you can keep in Git, and cf apply makes the hosts match your config. 🐳

After years of running a Proxmox cluster, I migrated my entire homelab to NixOS with Incus. I explain the philosophical friction of imperative ‘appliance’ OSs vs declarative hosts, share how I migrated my LXC/VM workloads, and why it is the perfect infrastructure to manage using AI agents.

Compiling heavy CUDA packages on NixOS unstable can take 18 hours or crash your system. I solved this by setting up a dedicated local cache server using Harmonia and a nightly auto-build service. This setup ensures my fleet is always updated to the absolute latest version—without ever compiling a single line of code on my workstations.

🗃️ github-backup-sync: Mirror every GitHub repository you have access to into local bare clones, with the gh CLI handling authentication. 💽

How to create a secure, decentralized backup system using TrueNAS and ZFS replication. This guide shows you how to partner with a friend for mutual backups, leveraging the power of ZFS while maintaining network isolation and data privacy.

An overview of my journey from using a Raspberry Pi for Home Assistant to creating a Proxmox cluster and dedicated NAS for running various services efficiently.

💻 rsync-time-machine.py: Your cross-platform, flexible, and incremental backup solution using rsync, offering Time Machine-style backups with added versatility. 💽🚀. 🔄

🏠 dotfiles: My NixOS, nix-darwin, Homebrew, and zsh setup that I use on every machine, with modern CLI tools installed through dotbins. 🐚