mxm/homelab
1
0
Fork 0
Code Issues 3 Pull requests Projects Releases Packages Wiki Activity Actions

refactor(clan): migrate homelab services to Clan #7

Merged
mxm merged 92 commits from feat/clan-mxmlabs-service into main 2026-07-09 12:18:40 +00:00
Conversation 0 Commits 92 Files changed 316 +11438 -5808
mxm commented 2026-07-09 10:54:28 +00:00
Owner
Copy link

Summary

  • Migrates the homelab NixOS service layout from the retired Python homelab CLI and pre-Clan modules/ tree to Clan machines, Clan services, and Clan vars.
  • Adds the mxmlabs web service pilot and rewires edge routing, monitoring, gateway, and service modules through the Clan inventory/service model.
  • Cleans up merge leftovers: active docs, Justfile recipes, and repository agent skills now describe the Clan workflow instead of removed CLI/module paths.

Changes

  • clan.nix, clan/machines/*, clan/services/*, clan-services/homelab/* — Clan machine and service definitions.
  • vars/per-machine/*, sops/* — Clan vars and machine/user sops metadata.
  • checks.nix — topology/machine/DNS consistency checks replacing retired validation.
  • Justfile, AGENTS.md, USAGE.md, .agents/skills/*, docs/** — current operator and agent guidance for Clan workflows.
  • clan/services/mxmlabs-web.nix, clan-services/homelab/mxmlabs-web/default.nix — mxmlabs.de static site service wiring.

Related Issue

None.

Test Plan

  • nix flake check passes
  • git diff --check passes
  • just --list validates Justfile recipes
  • Pre-merge code review findings resolved
## Summary - Migrates the homelab NixOS service layout from the retired Python `homelab` CLI and pre-Clan `modules/` tree to Clan machines, Clan services, and Clan vars. - Adds the mxmlabs web service pilot and rewires edge routing, monitoring, gateway, and service modules through the Clan inventory/service model. - Cleans up merge leftovers: active docs, Justfile recipes, and repository agent skills now describe the Clan workflow instead of removed CLI/module paths. ## Changes - `clan.nix`, `clan/machines/*`, `clan/services/*`, `clan-services/homelab/*` — Clan machine and service definitions. - `vars/per-machine/*`, `sops/*` — Clan vars and machine/user sops metadata. - `checks.nix` — topology/machine/DNS consistency checks replacing retired validation. - `Justfile`, `AGENTS.md`, `USAGE.md`, `.agents/skills/*`, `docs/**` — current operator and agent guidance for Clan workflows. - `clan/services/mxmlabs-web.nix`, `clan-services/homelab/mxmlabs-web/default.nix` — mxmlabs.de static site service wiring. ## Related Issue None. ## Test Plan - [x] `nix flake check` passes - [x] `git diff --check` passes - [x] `just --list` validates Justfile recipes - [x] Pre-merge code review findings resolved
mxm added 88 commits 2026-07-09 10:54:28 +00:00 
Move forgejo, matrix, n8n, lyrion, monitoring, qbittorrent, NAS (villa+wow),
and hermes-agent onto Clan service modules and inventory-backed machines.
Delete the superseded legacy modules/hosts entries that collided with clan's
nixosConfigurations definitions (masked as "attribute 'cycle' missing").

Migrate machine secrets from per-host sops YAMLs to clan vars prompt
generators (persist), importing existing values unchanged via clan vars set:
forgejo tokens, n8n/matrix-relay-bot env, grafana secret key, pve-exporter
credentials, NAS samba passwords, hermes env. Drop the unused
forgejo_db_password (peer auth over unix socket).

Fixes found during e2e rollout:
- monitoring: homelab-state.nix import escaped the flake root (4x ..)
- nas service: raw settings.users leaked empty smbPasswordSecret,
  creating a sops secret named ""
- wow-app-06: grow /data to 8G (prometheus TSDB filled the 4G volume)

Deployed and verified live: n8n, lyrion, monitoring, qbittorrent, forgejo
(HTTP + edge SSH), villa/wow NAS (SMB/NFS), both edges. Matrix blocked on
villa-pve-03 being down; hermes VMs deferred.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Rewire the monitoring clan service from nix/homelab-state.nix (homelab.json)
to clan/inventory/homelab.nix, making the inventory the single source for
both exporter enablement and scrape targets. Reconcile prometheusNode flags
that had drifted (villa-app-02, both edges, wow-app-01/04/05/08, routers,
villa-run-01) and mark the four PVE hosts with pve = true for the Proxmox
exporter job. villa-app-06 stays unscraped until the VM is deployed.

Move the machine profile modules out of modules/features:
  base.nix -> modules/profiles/container.nix
  base-vm.nix -> modules/profiles/vm.nix
  base-shared.nix -> modules/profiles/shared.nix
  homelab-options.nix -> modules/profiles/options.nix
  users.nix -> modules/profiles/users.nix
nixosModules attribute names are unchanged.

Deployed wow-app-06 + villa-app-02, villa-edge-01, wow-edge-01, wow-app-08,
wow-app-01, wow-app-04, wow-app-05. The four drift-broken node targets are
up again; remaining down targets are the offline pve-03 node and the
routers pending host-key cleanup.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Rename profile nixosModules attrs to match modules/profiles/: base ->
container-profile, base-vm -> vm-profile, base-shared -> shared-profile
(homelab-options and users keep their names). Updated all 21 machine files,
router-machine.nix, mk-* templates, and test-stub.

Remove the last pre-clan secret plumbing: router defaultSopsFile in
clan/lib/router-machine.nix (routers declare no sops secrets), all empty
per-machine modules/secrets YAMLs, and the orphan wow-build-01.yaml. Only
the two test fixtures remain.

Retire the motti@villa-app-06 ops key from homelab.json site sshPubKeys;
clan machines already authorize only the site key.

Delete nix/edge-routes.nix and edge-routes-types.nix: live routes come from
clan/services/edge-*.nix, so the homelab-edge-routes-cover-edges check and
the stale skip list in homelab-features-have-enable-option go with them.

All 21 machines evaluate; all 7 flake checks pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The homelab Python CLI is no longer used; clan machines update is the
deploy path. Delete the CLI-era scaffolding it was the last consumer of:
nix/mk-container.nix, nix/mk-vm.nix, nix/homelab-state.nix (no consumers
left after the monitoring rewire), modules/lib.nix (unused flake.lib),
modules/hosts/test-stub.nix and the modules/secrets test fixtures. The
nix/ directory is gone.

Validation shrinks to five checks; the homelab-state-* checks now read
homelab.json directly and cross-check it against clan/machines. The JSON
stays only as the Proxmox topology record (ctId/vmId, hv, mounts,
resources) until that data moves into the clan inventory.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Fold the last 8 feature modules into their clan services so each service
has exactly one home, matching the already-self-contained services:

  forgejo, matrix, n8n, nas, qbittorrent, hermes-agent -> their service's
  perInstance.nixosModule; grafana + prometheus -> monitoring

Settings now flow only through the service interface; the homelab.<x>
option layer and the machine-level feature imports are gone. Supporting
moves: postgres becomes a plain shared module at
clan-services/homelab/lib/postgres.nix (imported by forgejo and n8n),
n8n-nodes tarballs and the Grafana dashboards move into their service
directories, and hermes-agent gets flake inputs via pre-application in
clan.nix (clan service modules do not receive inputs as a module arg).

modules/features/ now contains only gateway.nix (router phase).

Verified: toplevel drvPaths of all 9 affected machines are byte-identical
to the pre-refactor baseline; all 21 machines evaluate; all checks pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Move the last feature module into clan-services as homelab/gateway with
per-site instances (gateway-villa, gateway-wow) targeting the router
machines. The service derives VLANs, zone, upstream gateway, and DNS
records from clan/inventory/homelab.nix given only settings.site;
router-machine.nix keeps just the VM shape (vlan10 management interface,
dnsmasq peer-site forwarders). The unused reservations/zonePolicy options
are dropped, and the homelab.gateway option layer is gone.

Repoint the DNS uniqueness check at router-dns.nix directly and retire
the features-have-enable-option check with the now-empty modules/features
directory.

Verified: both router toplevel drvPaths are byte-identical to the
pre-change baseline; all machines evaluate; all remaining checks pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Relocate the last three residents of modules/:
  modules/profiles/     -> clan/profiles/ (machine profiles next to the
                           clan tree, auto-imported via import-tree)
  modules/dev-shell.nix -> dev-shell.nix (repo root)
  modules/validation.nix -> checks.nix (repo root, relative paths fixed)

flake.nix now imports the three homes explicitly instead of
import-tree ./modules. Drop the retired homelab CLI remnants: the
homelab-cli flake input (pruned from flake.lock), the homelabDev shell
wrapper, and the HOMELAB_CLI_ROOT/HOMELAB_STATE_FILE exports.

Verified: toplevel drvPaths unchanged (spot: villa-app-03,
villa-router-01, wow-app-06, wow-nas-01); all checks pass; dev shell
provides clan-cli.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
chore: clean up clan merge leftovers
Some checks failed
CI / lint (pull_request) Failing after 2s
Details
CI / test (pull_request) Failing after 3s
Details
CI / inventory-parse (pull_request) Failing after 2s
Details
ee03823dc8
ci: replace retired Python checks with Nix flake check
Some checks failed
CI / flake-check (pull_request) Failing after 40s
Details
6fad85dc73
ci: run current Nix checks
Some checks failed
CI / flake-check (pull_request) Failing after 29s
Details
d16a0dd523
ci: prepare nix store in ubuntu action container
Some checks failed
CI / flake-check (pull_request) Failing after 24s
Details
77da992ec0
ci: use Nix flake container image
Some checks failed
CI / flake-check (pull_request) Failing after 22s
Details
74a858b1da
ci: use host nix store for action container
Some checks failed
CI / flake-check (pull_request) Failing after 4s
Details
3f95d0c3de
mxm force-pushed feat/clan-mxmlabs-service from 3f95d0c3de
Some checks failed
CI / flake-check (pull_request) Failing after 4s
Details
to 1064813776
Some checks failed
CI / flake-check (pull_request) Failing after 3s
Details
2026-07-09 11:33:16 +00:00 Compare
mxm force-pushed feat/clan-mxmlabs-service from 1064813776
Some checks failed
CI / flake-check (pull_request) Failing after 3s
Details
to b49724522a
Some checks failed
CI / flake-check (pull_request) Failing after 3s
Details
2026-07-09 11:34:33 +00:00 Compare
mxm force-pushed feat/clan-mxmlabs-service from b49724522a
Some checks failed
CI / flake-check (pull_request) Failing after 3s
Details
to 90ab6c6844
Some checks failed
CI / flake-check (pull_request) Failing after 9m50s
Details
2026-07-09 11:50:14 +00:00 Compare
mxm force-pushed feat/clan-mxmlabs-service from 90ab6c6844
Some checks failed
CI / flake-check (pull_request) Failing after 9m50s
Details
to 74a858b1da
Some checks failed
CI / flake-check (pull_request) Failing after 22s
Details
2026-07-09 11:58:58 +00:00 Compare
mxm force-pushed feat/clan-mxmlabs-service from 74a858b1da
Some checks failed
CI / flake-check (pull_request) Failing after 22s
Details
to 85edb58b26
All checks were successful
CI / flake-check (pull_request) Successful in 4m26s
Details
2026-07-09 12:13:19 +00:00 Compare
mxm merged commit 9a66193075 into main 2026-07-09 12:18:40 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
mxm/homelab!7
No description provided.