u/SDG_Den

Hi all, i'm working on automating some stuff within my home lab, primarily through automated nix deployments.

one small roadblock i currently have towards my goal of being able to take a nix config fully from a configuration on my workstation to a running set of services on a VM on my proxmox cluster is that my homelab is actually closer to 6 homelabs, experimenting with various things (i actually use my homelab as a lab to learn new skills, not just to make storing my "linux iso's" or w/e easier).

sadly, im stuck with my main residential router, which doesn't support basic features like using a larger subnet, using multiple subnets or using VLANs.

so currently, i am running a double-NAT setup with an opnsense box behind my main router, my "home net" is on the main network, and the opnsense box effectively condenses my entire home lab down to one ip.

this *fully* works, i have it set up to work completely fine, though it took some doing. learnt a *lot* about NAT and firewalls trying to get everything working correctly especially since my proxy is on the main net with multiple newt vpns on various subnets to reach the different servers that need public internet publishing, which all has to work "locally" but through NAT.

i've already gotten my deployment pipeline to the point where the server is created with the desired configuration and subsequently moved on proxmox to the correct network/vlan (all servers are prepped by booting an ISO that has a predetermined IP on the local net, since deployment of the config happens over ssh).

problem is: once this happens, i no longer have access to the server over ssh because now it's on a different subnet behind NAT.

this is easily resolved by opening a port on the opnsense router, i already took this into accounts so all my configs have a port noted in case they need to go through the opnsense router.

the actual thing i cannot seem to figure out is: how do i set up a NAT destination rule and its accompanying firewall rule automatically as part of a deployment pipeline?

it's totally fine for this router to have a bunch of ssh ports open btw, since well... its behind *another* firewall that basically only has http, https, email and VPN ports available, all bound to specific servers. there's no way to reach any of these ports from the internet.

basically: what's the best approach to having an automated workflow of some kind make changes to the NAT configuration/firewall configuration? preferably something that doesn't need its own server to run on, but if i must, i will.

if this is not possible at all and someone knows of another way to automatically gain ssh access from my main workstation to all deployed servers on the various opnsense subnets (assuming those servers are already set up with proper keys, sshd configs etc), do also let me know about those.

currently, in my flake i'm using github:nixos/nixpkgs/nixos-unstable for my nixpkgs.url, this means that when github is down, I cannot update my system and generally cannot make certain changes to my config.

are there any good ways to set this up with some form of failover? I'd like to not be fully reliant on github considering their uptime is an absolute joke for a site of that scope (99.22% right now!)

Hi All, im an IT professional and hobbyist, and i've been looking into nixOS for a project.

To prep and learn nixOS, ive switched my desktop over and started by just making a well thought-out config. Currently, im using a flake-parts based config, which has 3 hosts on it atm (my laptop, my desktop and my partner's desktop, who's diving into nixOS alongside me). I've integrated home manager and most of my system is managed declaratively.

I also have a homelab consisting of 4 HPE servers (total 128c 660gb ram 30tb storage), theyre running proxmox.

My eventual goal is to design and build a central management system for nixOS endpoints, one thing that has bothered me to no end is that there is nothing like microsoft's intune/entra ID stack for linux, and i think the way nixOS works makes it a prime candidate for building a proof-of-concept around it.

My current goal is to expand my config and create a toolchain for deploying new servers to my proxmox hosts and keep their configs up to date. Every server will be a host in my current multi-host config, and my idea is to use nixos-anywhere and disko to deploy and the remote functionality to update configs.

To get servers to the point where i can access them with nixos-anywhere, my plan is to build a nixos live ISO. Im not *sure* if nixos-anywhere can function off of a liveboot, but considering it bootstraps nixOS and completely wipes any installed system, i'd guess a liveboot would work fine.

Then i can tie it together by using SSH and scripting to automatically create the VM, place the iso on the right server, start it and run nixos-anywhere to deploy the desired config.

I'd *like* to automate it further, to where when i run my gitupdate command (which has some extra logic to build the commit message automatically already) it'll rebuild the configuration of any servers that have changed.

One thing i've had some trouble with is finding resources. So i'd like to ask if anyone here has any resources i can read through for these specific questions:

- 1. Is there a built-in way using scripting to figure out if a specific system configuration in your flake has changed? If not, how could i best approach this?

- 2. The goal of the eventual centralized management project is to be able to fully manage remote enterprise machines and have a centralized user directory. What is currently considered the best way to handle centralized user directories on nixOS? Currently my biggest thought is to just... Use nix. If the config is central and the users are configured declaratively, then the users are centrally managed.

- 3. How would you approach deploying a config across many systems regardless of which network they may be on? Think laptops. The two main options im currently considering are a declaratively configured VPN server/tunnel and automation on the server to push configs to endpoints over the tunnel, and using a private git host with a private repository using ssh key authentication, which would require the endpoints to poll for changes to their config somehow. One is push-based, one is pull-based. The big thing is that the git option could be "serverless".

- 4. Are there any good resources on docker on nixOS? or should i switch to a different containerization approach? Im relatively familiar with docker.

- 5. For the tooling, i'll likely just write some bash scripts and wrap them as services where needed. Are there any good guides out there on how to make a derivation for groups of bash scripts? (Entrypoint + libraries + needed files). And how do i make custom services on nixOS?

- 6. What's the best way to handle SSH hardening for my home lab?

- 7. What are some best practices when it comes to keeping such a many-system config workable and maintainable? What about the deployment pipelines?

- 8. Is there any danger with importing a flake-parts module multiple times or setting the same package as installed in multiple files?

If you have any knowledge on these topics or any links you can throw my way, please share them!

as the title says: confess in the comments what your worst linux sin is, and you will be dealt a cruel, unusual and (hopefully) funny punishment. this is an all-judgement zone, feel free to judge.

Hi all, just wanted to drop by to report i just hijacked a semi-fresh install of cachyOS (reinstalled my thinkpad, re-deployed my dotfiles, then hijacked with bedrock), and it *just worked*.

I didn't expect to run into many issues considering arch seems pretty well supported, but i was expecting some more difficulty with the BTRFS+limine setup.

is there anything i have to watch out for when it comes to that + snapshots via snapper? how does that work exactly?

(this is not an advertisement, more-so a brainstorming post)

I recently built myself a simple bash-based framework to add dynamic UI elements on top of my window manager, currently it can trigger in 3 ways:

-#1: the mouse enters/leaves a specified zone

-#2: the layout on a specific monitor changes to/from a specific layout

-#3: a specific program gets focused/unfocused

it has per-mode delays built in, and the triggers just run commands so technically, i can wire it into anything.

so far, i've added a volume bar on the right of my screen that pops up when you move your mouse there, a brightness bar on the left and a screenshot utility at the top, all of these using zones.

i've also added a tab bar that only shows in monocle and deck modes (Where windows are effectively hiding behind eachother and it's normally impossible to tell how many windows you have open and in which order)

next to UI, this framework can start/stop basically anything or even just *launch an initialization script* when a condition is detected. So basically:

what can you think of that would be useful to have automatically start/stop or show/hide based on where on the screen the mouse is, what program is focused or what layout the window manager is on?

particularly interested in what the focus/unfocus trigger could be used for, i'm sure there's something but there's nothing obvious within my own workflow yet.

I've been working on some more guides since some people have asked for that, and i'd like to include sections on both linux pitfalls and common mistakes.

I'll be defining pitfalls as "problems a new user will frequently run into", problems can be something being broken or just something not working the way a new user (coming from mac or windows) would expect.

i'll be defining mistakes as things a new user may do on accident (for example, accidentally running some kind of `sudo rm -rf /` is a popular one)

I'd love to hear both about pitfalls/mistakes you've seen others run into, as well as pitfalls/mistakes you've personally seen or made!

(and yall, please don't get judgy in the comments, i'm pretty sure everyone will eventually make a stupid mistake. i personally managed to run `sudo rm -rf $DIR/*` with DIR being empty, effectively deleting my entire drive. that was thankfully 2 days in so it wasnt too bad.)

I've been working on some more guides since some people have asked for that, and i'd like to include sections on both linux pitfalls and common mistakes.

I'll be defining pitfalls as "problems a new user will frequently run into", problems can be something being broken or just something not working the way a new user (coming from mac or windows) would expect.

i'll be defining mistakes as things a new user may do on accident (for example, accidentally running some kind of `sudo rm -rf /` is a popular one)

I'd love to hear both about pitfalls/mistakes you've seen others run into, as well as pitfalls/mistakes you've personally seen or made!

(and yall, please don't get judgy in the comments, i'm pretty sure everyone will eventually make a stupid mistake. i personally managed to run `sudo rm -rf $DIR/*` with DIR being empty, effectively deleting my entire drive. that was thankfully 2 days in so it wasnt too bad.)

Hi Everyone!

as the title says, I do not personally use openSUSE, I've worked with it *a bit* before, but nothing major.

Recently I wrote a guide on r/linux4noobs about picking a distro, which went down pretty well, so I'm planning on writing up more educational guides for linux in general.

However, that guide did not include openSUSE *at all*. It primarily focuses on Fedora, Arch and Ubuntu (and all of the distributions based on them).

I'd *like* to learn a bit more about openSUSE, as I do think it should be included into guides like these.

Of course, I will be making a VM with openSUSE once more, this time primarily to explore the distro, but I also have some questions for the community!

Why are you (currently) on openSUSE and do you plan to stick around?

How do you feel openSUSE LEAP compares to other big "versioned release" distro's like Ubuntu and Fedora?

How do you feel openSUSE tumbleweed compares to other "rolling release" distro's like arch and void?

What do you think openSUSE does different/better than other popular distributions?

What kind of users do you feel openSUSE is for?

I primarily want to understand what the actual users think, rather than just *my* opinion, as distro choice is a personal matter and different options suit different users.

Would love to hear from you all and have a nice day!

hold onto your hats, this one may require a little explaining.

So, i am not a KDE user. My partner is, but i'm not.

We both use arch (by the way), and i personally do a lot of tinkering around with window managers as a hobby, building different isolated dotfiles around different window managers that i can access all at the same time, that do not interact with eachother (meaning that for each set, i use a different wallpaper manager, a different shell, a different terminal, the only things that stay the same are applications that are not part of the dotfiles, like discord and such). sometimes i publish these.

I found out that with the x11 version of KDE, it is possible to replace KWin with a different window manager, the arch wiki has a guide on this for i3.

thing is, i don't want to use an x11 window manager, I'd like to see if i can get the plasma shell working fully with both Wayfire (floating/stacking, like kwin) and MangoWM (scrolling, autotiling, master/stack, monocle etc etc, basically every auto-tiling layout under the sun) using a separate desktop file for each (so they can exist alongside a normal KDE plasma install without messing it up)

So far, with a little experimentation, i've made a desktop session that uses a custom init script which loads both wayfire and the plasma shell directly, however, it seems running JUST plasma-shell is mildly broken.

the way you set a different WM on plasma x11 sadly doesn't work on wayland, unless i'm misunderstanding how to get it to run.

so now, i need to basically know either A: how to run start-plasma-wayland with a custom WM instead of KWin or B: what other components need to be launched for the plasma shell to work properly so i can manually launch them all using the custom init script.

I'm *specifically* looking to tinker around with plasma with different wayland window managers, i'm not looking to try out Karousel or Khronkite or make other modifications to KWin. I get that as a practical solution, those are likely a lot easier and safer than what i'm doing, but this won't be my daily driver and it's honestly mostly to try stuff and have fun doing it. we're not going for practical, we're going for "can it be done", followed by "can i make it reliable/stable" if the answer is "yes".

i'm not afraid of tinkering around and writing custom scripting/configs, my whole system has proper backups and snapshots so if i do bung something up, i can recover without any problems and i'm pretty familiar with these kinds of things, just not KDE specifically.

Hi everyone, i'm Den, i'm an IT professional and general linux nerd. I've also spent the last 5 years guiding people through their first destiny raids.

I've been spending the last while answering questions here and in r/linuxquestions, and eventually, i got tired of repeating the same advice about picking a distro over and over again so i made this guide.

I was thinking, what other topics would be helpful to have a guide on for new users? i'd imagine proton and proton troubleshooting would be a good one, maybe the basics of docker so people can use containers, a dual-booting guide, what else?

whether you're a newbie struggling to find info on a topic or a 10+ year linux veteran that happens to know about a great topic that newbies should know, sound off in the replies!