What I do to keep DNS consistent inside and out is use Tailscale on all my clients. I host a DNS server hosted on my tailnet that is set up as split DNS for my “kickassdomain.org”.

Fwiw I switched from k3s to Talos and find it much easier to manage. I run 3 mini 1L PCs with rook-ceph and it works flawlessly even on 1Gbe.

Invidious?

You will hate Ansible if you are coming from Nix. I went the other way and Nix is 1000x cleaner.

Being able to actually reverse changes is trivial in Nix, but can be a headache in Ansible. Not to mention the advantages of writing in an actual language and not yaml full of template hacks. I personally don’t see much future for tools like Ansible, there is considerable inertia working in its favor right now and it is absolutely true that it is widely used, but the future of configuration management is for sure more aligned with how Nix works.

Similar to my scheme:

laptop = “laptop”
nas = “nas”
router = “router”

Then if there are more than one in each category I use nas-0, nas-1, etc.

I have used all three! I started with Server then went to CoreOS running Kubernetes and settled on NixOS which I have been very happy with for about a year now. I run about 25-30 services all using built in modules.

Regarding security, if you are using well crafted modules on NixOS, there should be good systemd hardening in place. That being said there is no reason you can’t just use containers on NixOS.

I also find deploying NixOS far superior to butane/ignition used by CoreOS/Fedora. I use nixos-anywhere and can deploy my entire server in a few minutes without manual intervention.

I use it over Tailscale only and it works perfectly as an alternative.

Prometheus and Altertmanager

I’m using the recently merged Clevis module for NixOS. There was a recent talk at FOSDEM about it.

You might be interested in setting up network bound encryption via Clevis and Tang. I use a hidden pi zero in my house acting as a Tang server. It’s great being able to reboot any of my encrypted servers without having to manually unlock disks.

Every hour via Restic to a local Mino instance on my NAS. Once a day to backblaze B2. Once a week to an offline HDD in my fire safe.

Keep in mind the more often you backup the less total time each backup should take to run. If your backup software isn’t too heavy to run and stores backups incrementally, there is little penalty to frequent backups.

I like memos.

I’m a Miniflux user as well but prefer the Flux News app: https://github.com/KevinCFechtel/FluxNews

Also consider Nix/NixOS, I have used Docker, Kubernetes, LXC and prefer Nix the most. Especially for home use not requiring any scaling.