Introduction

The Blackwall is a multi-host modular NixOS network. It utilises multiple physical hosts to spread processing power, storage capabilities as well as logical segmentation¹.

The original idea was a single device running everything, however I've since discovered NixOS' multi-host systems. By managing multiple hosts on a single nix configuration, it becomes infinitely easier to treat all hosts as if they're part of a single system and brings the NixOS experience much closer to hypervisors like Proxmox, without virtualisation.

Logical segmentation, in this instance means that different hosts are designed for different purposes. This could be a small desktop running networking software while an enterprise device runs NAS software.

Hosts

This page outlines the hosts within the Blackwall network. Each host serves a different purpose which allows for the most value to be extracted from a device.

This logic stems from the original idea. A Beelink ME Pro with an N150 processor was intended to be a well-rounded home server. However, where it attempted to be a jack-of-all-trades, it became a master of none.

Hostname	Purpose	Hardware
cynosure	Control and monitoring node	Beelink ME Pro N150
izanagi	Data fortress	Enterprise server
mikoshi	Reserved name for future host	TBD
sapphire	Reserved name for future host	TBD
kabuki	Reserved name for future host	TBD

[!TIP] Each hostname comes from the world of Cyberpunk 2077. The 'Blackwall' is a firewall intended to keep rogue AIs trapped in the old Internet. Mikoshi is a data fortress owned by Arasaka and Cynosure was Miltech's competitor. Izanagi is an access point to Mikoshi while the Black Sapphire is skyscraper within Dogtown.

Cynosure

Cynosure is the first device to be added to the Network and serves as the overseeing node. This is the device that runs the monitoring, control and security software.

It is run on a Beelink N150 ME Pro with 2x 1TB HDD drives installed as well as a single NVMe drive for the OS.

Izanagi

Izanagi is a proposed enterprise server running the majority of hard drives for the server.

[!WARNING] Izanagi is hypothetical and does not yet exist.

Architecture

This page details the architecture rules for the Blackwall server and all hosts involved.

Rules

Every host will have a single NVMe drive reserved for the OS.
Every password, API key or secret is to be stored via sops-nix.
Endpoints are kept to the minimum and user access is only via a tailnet ¹.
All software is managed and configured decleratively via the NixOS Blackwall config.
Changing which host runs what should be decided by which modules it inherits.
Deny by default.
Every host will broadcast logs and metrics to the Cynosure host.

A tailnet is a type of mesh VPN created by Tailscale or Headscale (the self-hosted Tailscale alternative).