nimmo/nixos-config
nimmo/nixos-config
Watch
1
0
Fork
You've already forked nixos-config
 0
Code Issues 15 Pull requests Wiki Activity Actions
Page: 13 Service Catalogue
Pages
00 Documentation Map and Scope 00 Documentation Standards 00 Start Here and Governance 10 System Atlas 11 Fleet Overview 12 Host Inventory 13 Service Catalogue 14 Network and Access Topology 15 Storage and Data Map 16 Automation and Control Plane 20 Architecture Decisions 21 ADR 001 Electra Hardware Specialisations 22 ADR 002 Workload Placement 23 ADR 003 Network Exposure 23 Project Tracking 24 ADR 004 Engram Durable Agent Memory 24 Security Baseline 25 ADR 005 Auto Update Control Plane 26 ADR 006 Scoped Secret Files 30 Operations and Runbooks 31 Routine Fleet Operations 32 Safe Testing and Deployment 33 Host Provisioning 34 Monitoring and Service Investigation 35 Backup Verification and Partial Restore 36 Full Host Recovery 37 Electra Boot Trust Recovery 38 Secret Editing and Recipient Rotation 39 Auto Update Incident Response 39a Service Migration and Cutover 39b Wrapper Repository Packaging 40 Engineering Handbook 41 Repository Structure and Import Chain 42 Configuration Ownership Boundaries 43 Adding Packages and Flake Inputs 44 Adding a Module or Profile 45 Adding a Host 46 Adding or Migrating a Service 47 Testing and CI Contracts 48 Secrets Implementation Conventions 49 Documentation Maintenance 50 NixOS Learning Path 51 Guided Repository Tour 52 Nix Language Essentials 53 Declarative Configuration Store and Generations 54 Flakes and Inputs 55 NixOS Modules and Option Merging 56 SpecialArgs and Home Manager Argument Flow 57 Electra Specialisations Worked Example 58 Nix Troubleshooting Primer 90 Historical Material 91 Electra Secure Boot Hardening Record Home
6 13 Service Catalogue
Nimmo edited this page 2026-09-14 07:34:27 +01:00
Table of contents

Service Catalogue

  • Type: Reference
  • Status: Current
  • Scope: Fleet services declared by this repository
  • Canonical sources: hosts/*/default.nix, hosts/*/databases/, modules/services/, modules/databases/, modules/containers/, and evaluated NixOS options
  • Last verified: Source commit 937e7fd02aad450a006b49f592c156e75888db7a (2026-09-14); new Vega service checked against incremental source changes since 556df88494686003b1c4f20c8e0b99b5afc16a6e
  • Review triggers: Service enablement or placement changes, native/container migrations, listener or firewall changes, ingress changes, database moves, authentication changes, or backup-path changes

This catalogue answers five operational questions: which host owns a service, how clients reach it, where its durable state lives, what protects it, and how its state enters the backup system. It describes declared configuration, not momentary process health. Use live monitoring for the latter.

Use the Host Inventory for machine capabilities, the Network and Access Topology for route classes, and the Storage and Data Map for data authority and recovery coverage.

Reading the catalogue

  • Public via Newt means the application has a restricted local listener and Pangolin supplies the public HTTPS edge through that host's Newt client.
  • Public via SWAG means the retained Lyra Docker reverse-proxy estate reaches a host listener. The route itself is mutable state under /srv/stacks, not a Nix declaration in this repository.
  • Mesh means the Nebula listener and interface firewall are the intended trust boundary. A mesh listener is not automatically authenticated.
  • Backup intent means the path is contributed to nixosConfig.backup.dataPaths or is beneath a host backup root. It does not by itself prove that a recent off-host snapshot completed successfully.
  • Secret file names and authentication mechanisms are documented; secret values never belong in the wiki.

User-facing applications

Service Owner and form Reachability Durable state and database Authentication Backup intent Canonical source
BookStack Vega, native NixOS wiki.nimmog.uk via Newt to 127.0.0.1:80 /mnt/storage/bookstack; local MariaDB under the system MySQL data directory Pocket ID OIDC; SOPS-backed application and database credentials Application files only; no MariaDB dump or MySQL data path is currently declared modules/services/bookstack.nix
TriliumNext Vega, native NixOS Mesh 10.10.0.2:37840; its public URL is supplied in the secret-backed OAuth configuration /var/lib/trilium; application SQLite state Pocket ID OAuth plus Trilium's own application controls Entire data directory modules/services/trilium-web.nix
Karakeep Vega, native NixOS links.nimmog.uk via Newt; no host firewall opening is declared /var/lib/karakeep; SQLite and crawled assets; Meilisearch is rebuildable derived state Application session/auth configuration from a SOPS environment file /var/lib/karakeep modules/services/karakeep.nix
FreshRSS Vega, native NixOS news.nimmog.uk via Newt to the newt_default bridge gateway on port 8082; not exposed on LAN interfaces /var/lib/freshrss; PostgreSQL database freshrss on Vega Pocket ID at the local Apache edge; database/admin secrets from SOPS Application state enters Backrest; database has local logical dumps that are not currently in Vega's Backrest paths modules/services/freshrss.nix
Paperless-ngx Vega, native NixOS documents.nimmog.uk via Newt to 127.0.0.1:28981 /mnt/storage/paperless; PostgreSQL database paperless on Vega Pocket ID via django-allauth; SOPS-backed admin, database, and application secrets Entire state root enters Backrest; database has local logical dumps that are not currently in Vega's Backrest paths modules/services/paperless.nix
Navidrome Vega, native NixOS Host port 4533; reachable through Newt and over Nebula for Plexdrome /var/lib/navidrome; music library at /mnt/media/Music on the NAS Navidrome application accounts; separate SOPS credentials for integrations Navidrome state; NAS media is outside host-owned state modules/services/navidrome.nix
SillyTavern Vega, native NixOS Newt-dependent service on 127.0.0.1:8384 /var/lib/SillyTavern, including mutable source configuration and plugins Application whitelist/auth policy in mutable configuration Entire application state modules/services/sillytavern.nix
SABnzbd Vega, native NixOS Host port 8383, URL base /sabnzbd; reverse-proxy routing is external to its module Configuration under /srv/services/sabnzbd; incomplete downloads under /mnt/partial; completed media under /srv/media Declared web login is disabled; the route must rely on its ingress/network boundary. SOPS supplies API and upstream-service configuration Service configuration through /srv/services; media/storage follows its own storage policy modules/services/sabnzbd.nix
Jellyfin Lyra, native NixOS Host port 8096, reached by the retained SWAG proxy NixOS Jellyfin data directory; media at /mnt/media on the NAS Jellyfin application accounts Jellyfin data directory; NAS media is outside host-owned state modules/services/jellyfin.nix
Immich Lyra application with Vega database Host port 2283, reached by the retained SWAG proxy Media at /mnt/immich from the NAS; PostgreSQL database immich on Vega Immich application accounts; SOPS-backed database credential Database has local logical dumps on Vega that are not currently in Backrest; NAS media follows NAS policy modules/services/immich.nix, modules/databases/immich.nix
Tdarr Lyra native server and two local nodes; Vega native Intel node Lyra ports 8265 (web) and 8266 (server); nodes use Nebula for the server connection Per-host /srv/services/tdarr; shared cache and media on NAS mounts Tdarr authentication is currently disabled in evaluated configuration; restrict by network placement Per-host Tdarr state; NAS content follows NAS policy modules/services/tdarr.nix, both server host files
Redview Lyra, native NixOS with NVIDIA runtime Application port 3210; current ingress is part of Lyra's retained proxy/network estate rather than declared in this module /var/lib/redview; library content below an NFS mount from NAS appdata Application controls plus SOPS-backed Reddit/BDFR credentials /var/lib/redview; mounted NAS content follows NAS policy modules/services/redview.nix
SynthSeek Chaos, OCI container seek.nimmog.uk via Newt to 127.0.0.1:4400 /srv/stacks/synthseek; reads music and incoming downloads from the NAS-backed /srv/media SOPS-backed session secret; Plex access through Plexdrome Covered by Chaos /srv/stacks; NAS media follows NAS policy modules/containers/synthseek.nix
slskd Chaos, OCI container Web UI on 127.0.0.1:5030; Soulseek peer port 50300 is opened separately /srv/stacks/slskd; downloads and music are NAS-backed SOPS-backed Soulseek, web, and API credentials Covered by Chaos /srv/stacks; NAS media follows NAS policy modules/containers/slskd.nix

The secret files required by slskd, SynthSeek, and Plexdrome exist in the repository's encrypted secret set. Older comments saying these services remain dormant until those files exist no longer describe the declared composition. That does not substitute for checking their live container health.

Internal services and control plane

Service Owner and form Listener or relationship State / database Access control Backup intent Canonical source
Attic binary cache Vega and Lyra, native NixOS backends Each backend listens on 127.0.0.1:8081; Pangolin/Newt load-balances attic.nimmog.uk Cache objects on NAS at /srv/attic/storage; configured database URL supplied by SOPS Attic tokens and restricted allowed hosts Cache is reproducible/garbage-collected; database protection depends on the configured database target modules/services/atticd.nix
PostgreSQL application cluster Vega, native NixOS 10.10.0.2, loopback, and the dedicated Whisparr bridge on port 5432 /mnt/storage/postgresql; serves Immich, FreshRSS, Paperless and retained application databases SCRAM on permitted networks; role passwords from service-scoped SOPS files Daily local logical dumps at /mnt/storage/postgresql-backups; that path is not currently in Vega's Backrest plan hosts/vega/databases/postgresql.nix
PostgreSQL / Adminer cluster Cosmos, native NixOS Mesh-only 10.10.0.8:5432; Adminer at 10.10.0.8:8050 NixOS PostgreSQL data directory; restored/migrated application databases SCRAM and SOPS-managed role credential; Nebula boundary Daily logical dumps at /var/backups/postgresql, then Backrest hosts/cosmos/default.nix
Engram Cloud Vega, native NixOS 10.10.0.2:18080 is the client endpoint; the process is configured on 0.0.0.0:18080 with a host firewall opening /var/lib/engram-cloud; local PostgreSQL database engramcloud SOPS-rendered Engram Cloud environment; clients use the configured machine identity/token PostgreSQL enters Vega's local logical dumps, but neither those dumps nor /var/lib/engram-cloud is an explicit Backrest path modules/services/engram-cloud.nix
Forgejo MCP Vega, native service plus TCP proxy Mesh 10.10.0.2:8780, proxied to a loopback upstream Ephemeral MCP process state The backend authenticates to Forgejo as the scoped bot token; the listener itself relies on the Nebula boundary No unique durable application state modules/services/forgejo-mcp.nix
Navidrome MCP Vega, native systemd service Mesh 10.10.0.2:18808/mcp; calls local Navidrome Runtime state under /var/lib/navidrome-mcp Bearer token for MCP clients; SOPS-backed Navidrome service account No authoritative data beyond Navidrome modules/services/navidrome-mcp.nix
ytdl-sub Vega, native NixOS scheduled downloader Hourly timer; no inbound service listener Disk-backed working and subscription archive state under /var/lib/ytdl-sub; Critical Role episodes written to the NAS at /mnt/media/ytdl-sub/Critical Role/Season NN for Jellyfin No network listener; output directory requires the media mount /var/lib/ytdl-sub is contributed to Backrest; completed NAS media follows the external NAS policy hosts/vega/ytdl-sub.nix, modules/services/ytdl-sub.nix
Paseo daemons Vega and Lyra, native NixOS Evaluated listeners are 10.10.0.2:6767 and 10.10.0.3:6767; daemons register with the TLS relay at code.nimmog.uk:443; host firewall is not opened by the module /srv/services/paseo on each host SOPS-backed Paseo password plus relay TLS Covered by each host's /srv/services backup intent modules/services/paseo-daemon.nix
Paseo relay Chaos primary container; Vega fallback container retained during cutover investigation Public WebSocket path through Pangolin; Chaos publishes loopback 8411, while Vega's fallback shares its Newt Docker network No authoritative application state Relay protocol and public TLS boundary None required modules/containers/paseo-relay.nix, hosts/vega/default.nix
Paseo web UI Chaos, OCI container Public route through Pangolin/Newt to 127.0.0.1:8088; container port 80 Static web bundle; endpoint selected at runtime Authentication occurs against the selected daemon/relay None required modules/containers/paseo-webui.nix
Plexdrome Chaos, OCI compatibility service No host port; SynthSeek reaches alias plexdrome:32400 on the private slskd-net network /srv/stacks/plexdrome is prepared, but the container is intended as a stateless bridge SOPS-backed Plex and Navidrome credentials Covered by /srv/stacks if state appears modules/containers/plexdrome.nix
Rangarr and Killarr Chaos, OCI automation containers No host ports declared Shared mutable configuration /srv/stacks/rangarr/config.yaml Configuration-file policy; no separately declared network auth Covered by Chaos /srv/stacks modules/containers/rangarr.nix, modules/containers/killarr.nix
Ollama Lyra native NVIDIA service; Electra specialisations provide local instances Lyra serves 0.0.0.0:11434; Electra instances are local and manually started Lyra models at /srv/models; Electra models follow its profile configuration Ollama has no native authentication; firewall and host placement are the boundary Models are replaceable artefacts and are not described as primary backed-up state modules/profiles/ollama.nix, relevant host files
Wyoming speech Lyra, native faster-whisper and Piper 0.0.0.0:10300 and 0.0.0.0:10200 Downloaded models/voices and runtime cache Wyoming endpoints have no application authentication; network placement is the boundary No authoritative user data modules/services/whisper.nix
Newt clients Vega, Lyra, and Chaos, native NixOS Outbound connection to Pangolin; the Pangolin-side route definitions are not visible in this repository Secret-backed client environment Newt identity from host-scoped SOPS file; TLS to Pangolin No authoritative state modules/services/newt.nix

Configuration findings to carry forward

These are durable observations from the declared configuration, not claims of an active incident:

  • BookStack's application files enter Vega's backup plan, but its local MariaDB data does not currently have a declared logical dump or backup path.
  • Vega's PostgreSQL cluster produces daily logical dumps, but its dump directory is not currently included in Vega's composed Backrest paths. Cosmos does back up its own logical-dump directory.
  • Engram Cloud listens on all interfaces and opens port 18080 globally, even though configured clients use the Vega Nebula address.
  • Tdarr's evaluated server authentication is disabled. SABnzbd's declared web login is also disabled; both therefore depend on their network/ingress boundaries.
  • Paseo daemon listeners currently evaluate to the Vega and Lyra Nebula addresses. Older descriptions of loopback-only daemons are stale.

These findings should feed the Security Baseline and its review gates. Changing the configuration is outside the scope of this reference page.

Fleet-wide supporting services

The common and server profiles also install operational services that should not be confused with end-user applications:

Capability Placement Purpose and ownership
Backrest/restic Enabled when a host contributes home or data paths Off-host backup execution and retention for the paths listed above; credentials are delivered with systemd credentials
PostgreSQL logical backup Vega and Cosmos Produces self-contained daily SQL backup sets; Cosmos passes its dump path to Backrest, while Vega's is currently local-only
Beszel agent Every registered host Live health and inventory evidence; current availability belongs in Beszel, not in this page
Auto-update consumer Every registered host Pulls approved fleet generations from the update control plane; Nova's staged configuration proposes the future producer role
Service failure monitor Server hosts, with explicit unit lists Publishes selected systemd failures to host-specific notification topics
Docker report Lyra Periodic reporting for the retained mutable Docker estate

Transitional and external boundaries

Three boundaries require deliberate treatment in later pages and runbooks:

  1. Lyra's retained Docker/SWAG estate. Nix declares Docker, mounts, firewall ports, and some native replacements, but /srv/stacks remains the source for other container definitions and reverse-proxy routes. Those workloads cannot be claimed as fully declarative from this repository.
  2. Paseo relay cutover. Chaos declares the primary relay and web UI, while Vega intentionally retains a fallback relay. Removing either is an operational change, not documentation cleanup.
  3. External infrastructure. Pangolin, the NAS, Proxmox, public DNS, and the public Nebula lighthouse are dependencies and trust boundaries but are not configured by this repository.

The Network and Access Topology owns the cross-service route map. The Storage and Data Map owns retention, restore authority, and NAS boundaries. Procedures belong in Service Migration and Cutover and the Operations and Runbooks, while rationale belongs in Architecture Decisions. ADR-002 defines how native services, local integration modules, wrapper repositories, and OCI containers are chosen. Return to the System Atlas.