Cumsek

Nix flake managing 5 VM-based services on my homelab hypervisor (cumsek, 192.168.1.200).

Hosts

Host	IP	vCPU	RAM	Role
cum-services	.201	2	4G	Reverse proxy (Angie/nginx), PostgreSQL, SearXNG, Vaultwarden, n8n
cum-media	.202	6	8G	Nextcloud+Collabora, Immich, Audiobookshelf, Paperless, Miniflux, Mealie, Microbin, Radicale, *arr stack
cum-games	.203	4	8G	Minecraft servers: voocraft, voolovesbuilding, mine
cum-sites	.204	2	4G	Custom web apps (nails, wysi727)
cum-tools	.205	8	54G	Forgejo+Gitea Actions, llama-swap (9 models), Open WebUI, LiteLLM, social-extract

All VMs share NFS from the hypervisor, run on NixOS 25.05, use systemd-boot + btrfs + disko for partitioning, and expose services through the central reverse proxy on cum-services.

URLs

• git.cumsek.com — Forgejo (Git hosting + CI)
• chat.cumsek.com — Open WebUI (LLM chat)
• ai.cumsek.com — LiteLLM (API proxy/router)
• search.cumsek.com — SearXNG (private search)
• passwd.cumsek.com — Vaultwarden (passwords)
• n8n.cumsek.com — n8n (automation)
• drive.cumsek.com — Nextcloud (file sync)
• photos.cumsek.com — Immich (photos)
• listen.cumsek.com — Audiobookshelf
• cook.cumsek.com — Mealie (recipes)
• papers.cumsek.com — Paperless-ngx (documents)
• rss.cumsek.com — Miniflux (RSS)
• dav.cumsek.com — Radicale (CalDAV/CardDAV)
• bin.cumsek.com — Microbin (pastebin)
• nails.m4rti.dev, wysi727.com — Custom sites
• collabora.cumsek.com — Collabora Online (Nextcloud integration)

Usage

cum CLI

Installed system-wide on all VMs.

cum switch [machine]          Rebuild and switch (default: current host)
cum deploy <machine> [host]   Deploy locally, or remotely via nixos-anywhere
cum test <machine>             Build toplevel derivation
cum mksecret <keypath>        Convert SSH key to age key
cum secrets                    Edit .secrets.yaml with sops
cum llama-hash                Prefetch llama.cpp hash

Machine short names: services, media, games, sites, tools.

deploy.sh

Legacy script for local deployment:

./deploy.sh <machine>

Secrets

Managed with sops-nix and age encryption. Key at /etc/age/cumsek.key. Edit with cum secrets.

Flake Inputs

Input	Source
nixpkgs	nixos-25.11
nixpkgs-unstable	nixos-unstable
home-manager	release-25.11 (follows nixpkgs)
disko	nix-community/disko (follows nixpkgs)
sops-nix	Mic92/sops-nix (follows nixpkgs)
nix-minecraft	Infinidoge/nix-minecraft (follows nixpkgs)
llama.cpp	ggml-org/llama.cpp

Users

User	Shell	Home-manager
m4rti	zsh	Yes (neovim, tmux, git, etc.)
tumse	zsh	Yes
cumsek	zsh	No
root	zsh	No

SSH-key auth only (m4rti has key; password auth disabled globally).

Structure

├── cum                  # CLI tool (installed system-wide)
├── cum.nix              # Central config (hosts, ports, helpers)
├── deploy.sh            # Legacy deployment script
├── flake.nix            # Entry point; defines 5 NixOS configurations
├── hosts/
│   ├── cum-services/    # Reverse proxy, DB, password manager, automation
│   ├── cum-media/       # Media, documents, recipes, calendar
│   ├── cum-games/       # Minecraft servers
│   ├── cum-sites/       # Custom web apps
│   └── cum-tools/       # AI inference, Git hosting, CI
├── nixos/               # Shared modules (boot, network, hardware, services)
├── users/               # User definitions (m4rti, tumse, cumsek, root)
├── custom/              # Optional modules (sdcpp.nix for stable-diffusion)
└── .secrets.yaml        # Encrypted secrets (age/sops)