steropes

Raspberry Pi 4B running Authelia.

{ pkgs, ... }:
{
  networking.hostName = "steropes";
  mjm.profiles.raspberry-pi.enable = true;
  system.stateVersion = "21.03";

  <<config>>

  _class = "nixos";
}

fileSystems."/persist" = {
  device = "/dev/disk/by-label/NIXOS_SD";
  fsType = "ext4";
  options = [ "noatime" ];
  neededForBoot = true;
};

mjm.state.persistDir = "/persist";

steropes is using a transient root filesystem, so persistent content from /var is bind-mounted into place from /persist/var.

fileSystems."/boot" = {
  device = "/dev/disk/by-uuid/E76D-5C6A";
  fsType = "vfat";
  options = [
    "fmask=0077"
    "dmask=0077"
  ];
};

My Raspberry Pi systems use firmware that supports UEFI, so I need an ESP to use with systemd-boot.

mjm.server.enable = true;

This machine is running as a server, so it needs the common server infrastructure for my lab.

mjm.authelia.enable = true;
services.postgresql.package = pkgs.postgresql_18;

The main service this machine runs is Authelia.

I use Authelia throughout the lab to provide SSO for the services I host. Ideally, that's with OpenID Connect, but for things that don't support that, I use it as a forward proxy in front of the services.

The forward proxy implies that there are services that are completely inaccessible if Authelia is down, since it must intercept all requests to those services to check if a user is logged in. Because of this, I've found it much less disruptive to host Authelia on a separate machine from other things, so that deploys and reboots are fast, minimizing downtime.

A better approach generally would be to run multiple Authelia machines, but that would require sharing its database and Redis instance between those machines. I briefly explored options for that, but set it aside due to complexity. So far, simply isolating it to this one Raspberry Pi has largely eliminated any meaningful disruption for me.

mjm.nut = {
  enable = true;
  connectedUPSName = "or500";
};

All physical hosts in my homelab run NUT to be able to be shutdown properly in the case of power loss. Since I have two UPSes in the rack, each machine is configured with the one it is connected to, so that will be the one that it monitors.

system.etc.overlay.mutable = false;

This machine has been confirmed to work with the immutable /etc overlay.