Nix Podman StacksDeclarative Self-Hosting with Nix & Podman

Deploy and manage self-hosted services using Home Manager, Podman Quadlets, and NixOS modules. Pre-configured integrations with Traefik, Homepage, Authelia, and dozens more.

Getting Started

Options

Examples

GitHub

⚙️

Simple Toggle

Enable entire stacks with a single flag. Sensible defaults work out of the box.

🔗

Pre-configured Integrations

Traefik, Homepage, Grafana, Authelia and more are wired together automatically.

🐧

Works Everywhere

Runs on Ubuntu, Arch, Fedora, Mint and more. Not limited to NixOS.

🔒

Secret Management

First-class support for sops-nix and agenix, with templating and file-based env injection.

📊

Monitoring Built-in

Prometheus metrics and Grafana dashboards for supported stacks, configured automatically.

🛡️

Auth & Access Control

Out of the box OIDC support for many applications and easy forward auth configuration options.

preview

Collection of opinionated Podman stacks managed by Home Manager.

The goal is to easily deploy various self-hosted projects, including a reverse proxy, dashboard and monitoring setup. Under the hood rootless Podman (Quadlets) will be used to run the containers. It works on most Linux distros including Ubuntu, Arch, Mint, Fedora & more and is not limited to NixOS.

The projects also contains integrations with Traefik, Homepage, Grafana and more. Some examples include:

Enabling a stack will add the respective containers to Traefik and Homepage
Enabling CrowdSec or Authelia will automatically configure necessary Traefik plugins and middlewares
When stacks support exporting metrics, scrape configs for Prometheus can be automatically set up
Similariy, Grafana dashboards for Traefik, Blocky & others can be automatically added
and more ...

While most stacks are activated with a simple toggle, some require additional configuration - especially for secrets. For managing secrets, projects such as sops-nix or agenix can be used, which allow you to store your secrets along with the configuration inside a single Git repository.

Example

Simple example of how to enable Traefik (including LetsEncrypt certificates & Geoblocking), Paperless & Homepage:

nix

{config, ...}:
{
  nps.stacks = {
    homepage.enable = true;
    paperless = {
      enable = true;
      secretKeyFile = config.sops.secrets."paperless/secret_key".path;
      db.passwordFile = config.sops.secrets."paperless/db_password".path;
    };
    traefik = {
      enable = true;
      domain = "example.com";
      geoblock.allowedCountries = ["DE"];
      extraEnv.CF_DNS_API_TOKEN.fromFile = config.sops.secrets."traefik/cf_api_token".path;
    };
  };
}

Services will be automatially added to Homepage and are available via the Traefik reverse proxy.