I'm a huge fan of Nix, declarative systems and Podman Quadlets, and i am having lots of fun combining those in my nix-podman-stacks project.

It includes configurations for various stacks that can be easily enabled and configured. For example setting up Traefik including the provider configuration, LetsEncrypt certificates, Geoblocking middleware etc. is as simple as:

traefik = { enable = true; domain = "example.com"; extraEnv.CF_DNS_API_TOKEN.fromFile = "/path/to/secret"; geoblock.allowedCountries = ["DE"]; }; 

Setting up Grafana, Loki, Alloy, Prometheus, Alertmanager etc. can be done using

monitoring.enable = true; 

I think Nix is a great way to manage your stacks because it allows for strong references and some deep integrations. Some examples:

• Enabling a service adds it to Homepage, Traefik and other central components
• Changing settings such as the Traefik subdomain of a service is automatically reflected in Homepage, Gatus endpoint monitors, Authelia redirect-uris etc.
• Enabling OIDC for a service will automatically setup necessary configurations, register the client in Authelia, create LLDAP groups for access control, ...
• It integrates great with projects like sops-nix, which allows you to also store secrets in a public Git repository. They are automatically decrypted before the Podman container starts.

Since most stacks can be configured declaratively, the opposites also applies. So disabling a stack will remove any trace of it in the Homepage, Traefik, Authelia, LLDAP, ... configs.

Here's some improvements i made recently that i wanted to share:

New Docs Website

I created a new docs website that also includes some examples for each stack. This is still work-in-progress and i'm working on adding more examples and explanations.

Glance Dashboard

Besides Homepage, Glance is another dashboard option now. All enabled services will also automatically be available on Glance.

Additional Stacks

Added support for a lot of projects that i discovered on this sub recently. Some examples include Jotty, Norish and Yopass

OIDC Options

Many stacks include OIDC settings now that are backed by Authelia+LLDAP. So it's very easy to have a nice SSO setup and use the same account for many applications. Example for Mealie:

mealie = { enable = true; oidc = { enable = true; clientSecretHash = "$pbkdf2-sha512$abcdef1234"; clientSecretFile = "/path/to/client/secret"; }; }; 

Socket Proxy

When the docker-socket-proxy stack is enabled, it will automatically be used for Homepage, Traefik, Alloy etc. for better security.

---

While many stacks can be simply enabled and work out of the box, the system is very flexible. So you can override/extend any preset without problems.

Feel free to test it out in a VM to give Nix+Podman a try, i think it's a great alternative to something like Ansible :)