I love self hosting, and have been hosting my own stuff for more than a decade. But after moving my localhost together with a tiny vps to nixos, the maintenance burden¹ reduced to the point where I have a new type of problem. Before, once per couple of years I'd be updating a major version of a distro. This is usually was a long, annoying process, but this process gave a nice opportunity to rethink the architecture and maybe move the proverbial furniture around. After I did switch to nixos, the distro upgrade process became much easier², and the big "let's reconsider" moment vanished. Which resulted in a bit of a legacy situation within my infra. So on one of the weekends I decided to make some conscious effort to refresh the lineup, so to speak.

So, first, what had to move out:

Matrix

I picked it up, thanked it, and put it to the trash.

Yeah, I understand that instant messaging is hard, but matrix never exited early alpha IMO. To put it mildly: it never sparked joy neither from user nor sysadmin perspective.³ While my matrix homeserver VM just kept spinning, I didn't had a single client installed on any of my devices for around half a year already. VM with the homeserver is just rm -r'd, the matrix endpoints now return HTTP 410. Goodbye, you will not be missed.

Radicale

This one got a proper viking burial.

While it's a wonderful piece of software in my opinion, it just became redundant around half a year ago. At the turn of the year my pixel was reaching EOL, as well as my thinkpad T14 gen3 was developing another weird gremlin⁴, I was looking at upgrading both anyway, and this time I decided to return to the sweet sweet embrace of Apple ecosystem. Icloud features e2e encryption, and IMHO fruty os'es are the only ones that ship with acceptable calendar application anyway. So separate contact and calendar sync service became unnecessary.

Authentik -> Kanidm

It was chosen at some point mostly because the instances can federate, and also it provides both LDAP and openID in one package. The problem it's really huge and enterprise-y. It is a bunch of python and npm, so it is packaged as external flake in NixOS. This pulls in a lot of dependencies. Fun fact: the only supported way to get authentik is docker compose, which should have warned me against it from the start. I decided to go with Kanidm in it's place. First of all, to get the memes out of the way, yes, it is a RIIR auth service. But most importantly, it feels like a lot of care was put into it. It might be a bit opioniated, but reasoning about this opninions is nicely laid out, and documentation is superb. It's blasing fast, and extremly pleasant to administer and use. The only thing that's a downgrade is that it doesn't support proxy auth, so navidrome now has to have a oauth2-proxy in front of it.

Bonus: cgit

During the transition, especially when I was ripping the SSO out, just in case all of the services were returning 503, and firewall was politely asking you to go fuck yourself. Since nixos relies on git repos as dependency management, it's way more annoying to do if there's no public place for your nix code. In case of my infra it is nix-config and the source of the website you are currently on right now. So as a small extra now there's a cgit instance spinning around. After I finished setting up new SSO I decided to let it kick around for now.

Extra stuff coming soon

If all goes smoothly, next weekend I do some networking and