NixOSs

Declarative NixOS infrastructure with isolated workloads, explicit service identities, and controlled routes between services.

Architecture

Open either image for the full-size diagram.

All diagrams and sources · Transparent agent · Local transport · Outbound example · Immich routing

Public Caddy terminates normal HTTPS. Its Ghostunnel proxies carry its Realm identity to private backends. Observability Caddy and Internet Caddy handle their own mutual TLS (mTLS). SPIRE supplies certificates through local Agents. Agents join with HTTP FQDN node attestation: the Server fetches a short-lived proof from an address pinned in registry.toml, without DNS or a join token, and the stable alias spiffe://nyaw.xyz/agent/<host> points to the attested http_fqdn Agent ID. The host realm-agent captures ordinary TCP/DNS for eligible isolated workloads and forwards through their existing declared egress sockets; SPIFFE authentication stays in the proxies and gateways.

Implemented security controls

These controls describe the declared configuration. Host imports and explicit workload exceptions determine where each control applies.

SPIRE certificates default to a one-hour lifetime. Ghostunnel separately caps connection lifetime at one hour. Node identities come from HTTP FQDN attestation; workload identities come from the Agent's Workload API and are bound to unit and Unix user selectors. Applications use direct Unix sockets, loopback adapters, or the transparent worker to reach declared egress. The dedicated TLS gateways have direct SPIRE Agent access.

Defensive threat model

Assets: service data, runtime secrets, workload identities, and host integrity.

Attacker: an untrusted network client, a party that can influence DNS, or an attacker with code execution inside one unprivileged application.

Trusted base: host root and kernel, systemd, the realm-agent controller, SPIRE, registry and registration administrators, the trusted bootstrap transport, deployment keys, and the deployed Nix policy and inputs.

Gateway admission covers the listener. resolveHosts and NO_PROXY select routes and proxy behavior. They do not define per-domain or per-user authorization.

The model assumes the trusted base remains intact. Shared-kernel isolation does not establish a virtual-machine boundary. Certificate expiry does not terminate every existing TLS connection, and these controls do not guarantee availability.

Configuration and checks

Built with flake-parts, Vaultix, Lanzaboote, preservation, Disko, and nix-topology.

Realm reference · Deployment · HTTP attestation · Rollout · Observability · Hardening test record · VM tests · HTTP VM test · Identity metrics VM test

nix eval --json .#nixosConfigurations.eihort.config.realm.authorization.matrix
nix eval --json .#nixosConfigurations.eihort.config.realm.authorization.connections
bash layout/render.sh