53 lines
1.9 KiB
Markdown
53 lines
1.9 KiB
Markdown
# Implementation Plan: VPS Migration
|
|
|
|
**Branch**: `004-vps-migration` | **Date**: 2026-02-04 | **Spec**: /home/jawz/Development/NixOS/specs/004-vps-migration/spec.md
|
|
**Input**: Feature specification from `/specs/004-vps-migration/spec.md`
|
|
|
|
## Summary
|
|
|
|
Migrate VPS responsibilities to the new NixOS host by making it the primary reverse-proxy host (nginx only), mirroring the existing iptables ruleset, enabling wireguard with secret-managed keys, and restoring SSH/service-user access, while keeping all services running on the host server. Provide validation steps, review historical configs for gaps, and document analytics data migration.
|
|
|
|
## Technical Context
|
|
|
|
**Language/Version**: Nix (flakes; nixpkgs 25.11)
|
|
**Primary Dependencies**: NixOS modules, sops-nix, nginx, wireguard, openssh, iptables
|
|
**Storage**: Files (configuration and secrets)
|
|
**Testing**: Manual validation steps (no automated test harness)
|
|
**Target Platform**: Linux server (NixOS)
|
|
**Project Type**: configuration repo
|
|
**Performance Goals**: N/A (configuration change)
|
|
**Constraints**: Services remain on host server; VPS only terminates proxy and exposes wireguard port; iptables parity required
|
|
**Scale/Scope**: Single VPS + host server, small set of VPN peers and admin SSH principals
|
|
|
|
## Constitution Check
|
|
|
|
No enforceable constitution rules are defined (placeholders only). Gate passes by default.
|
|
|
|
Post-design check: unchanged (no enforceable gates found).
|
|
|
|
## Project Structure
|
|
|
|
### Documentation (this feature)
|
|
|
|
```text
|
|
specs/004-vps-migration/
|
|
├── plan.md
|
|
├── research.md
|
|
├── data-model.md
|
|
├── quickstart.md
|
|
├── contracts/
|
|
└── tasks.md
|
|
```
|
|
|
|
### Source Code (repository root)
|
|
|
|
```text
|
|
hosts/
|
|
modules/
|
|
secrets/
|
|
iptables
|
|
scripts/
|
|
```
|
|
|
|
**Structure Decision**: Use the existing NixOS configuration layout (`hosts/`, `modules/`, `secrets/`) and the root `iptables` ruleset file.
|