| .. | ||
| agent-codex | ||
| board-agent | ||
| branding | ||
| orga-agent | ||
| prosody | ||
| traefik | ||
| wordpress-hdm-assets | ||
| adguard.nix | ||
| agent-codex.nix | ||
| board-agent.nix | ||
| default.nix | ||
| dex.nix | ||
| drawio.nix | ||
| emptyCerts.nix | ||
| fail2ban.nix | ||
| fileserver-external.nix | ||
| forgejo.nix | ||
| graphify-refresh.nix | ||
| headscale.nix | ||
| launcher.nix | ||
| lldap.nix | ||
| nixbuild.nix | ||
| oauth2-proxy.nix | ||
| orga-agent.nix | ||
| packages-stable.nix | ||
| packages.nix | ||
| README.md | ||
| restic.nix | ||
| secrets.nix | ||
| sshd.nix | ||
| tailscale.nix | ||
| tasks.nix | ||
| webhook.nix | ||
| website.nix | ||
| wordpress.nix | ||
| xmpp-web.nix | ||
blunix services
Imported from default.nix. blunix is the Connector: reverse proxy,
identity, mesh control, and the two statically-hosted sites that need to
stay reachable independent of pinix.
| File/dir | Service |
|---|---|
traefik/ |
Reverse proxy — router config, split into routes-external.nix/routes-internal.nix plus per-service dynamic config (dex.nix, forgejo.nix, cal.nix, prosody.nix); see default.nix for the base setup |
dex.nix, service-dex.nix |
OIDC provider (Dex), authenticates against LLDAP |
lldap.nix |
LDAP user/group directory with the shared 0ff.space background |
oauth2-proxy.nix |
OIDC gate in front of the launcher site |
adguard.nix |
DNS, including the internal-route rewrites (see docs/networking.md on the wiki) |
headscale.nix |
Tailscale mesh control plane |
tailscale.nix |
This host's own tailnet client |
website.nix, launcher.nix |
Static sites hosted directly on blunix (lukasrosier.com, 0ff.space) so they stay up independent of pinix |
fileserver-external.nix |
Public file mirror (data.${domain}); its generated directory listings use the shared 0ff.space background |
wordpress.nix |
WordPress instance |
webhook.nix |
Auto-pull receiver for website/launcher on push |
agent-codex/ |
XMPP-reachable Codex agent (Agent + Builder roles), see its own README |
orga-agent.nix, orga-agent/ |
Secret-isolated, read-only CalDAV/IMAP helpers and strictly non-executable write previews for the visible Orga agent |
prosody/setup-prosody.nix, xmpp-web.nix |
XMPP server (c2s/s2s/MUC/HTTP upload) and its two web frontends (chat, plaza), moved here from pinix; see prosody/README.md |
nixbuild.nix |
nixbuild.net remote-builder registration (opt-in, not automatic) |
restic.nix |
Backups |
fail2ban.nix |
Brute-force protection |
packages.nix, packages-stable.nix, secrets.nix |
Host plumbing, not user-facing services |
Not currently wired into default.nix at all: emptyCerts.nix (commented
out), sshd.nix (a tailnet-bound sshd listener that isn't imported
anywhere — the global sshd.nix from hosts/globalServices/ is what's
actually active). Dead config, not deployed. forgejo.nix is wired in
and active as of 2026-09-06 — Forgejo itself moved here from pinix; the
line above describing it as "an earlier attempt ... superseded by pinix"
was stale and has been corrected.