sov #

Sovereign infrastructure from one typed specification: one server, its websites, DNS, git hosting, statistics, backups and recovery, all derived from a single spec in an instance repository.

An instance repository contains only what is its own (spec, sites, secrets, machine) and imports sov:

{
  inputs.sov.url = "git+https://knot.nalenz.org/did:plc:acqa2p2ttbwqbwtnsxwaj5et";
  outputs = { self, sov }: sov.lib.instance { inherit self; };
}

From the instance repository:

nix flake check                    # type-check the spec, build everything, boot a test VM
nix run .#install -- <user>@<ip>   # wipe a VPS, install, restore the state from the source bucket
nix run .#sov -- <command>         # everything else done from outside the server

After the install, the server deploys itself: it follows the signed commits of its spec repository.

• docs/design.md: what sov builds and why
• docs/operations.md: the steps done from outside the server

spec/schema.nix     the signature: what a specification may contain (type-checked)
spec/derive.nix     every derived view: DNS zones, statistics logs, repo identities, backup target
lib/instance.nix    an instance repository -> its systems, checks and tools
modules/            the NixOS modules of a sov server
lib/                site builders (static sites with pnpm, self-hosted fonts)
tools/              the sov command and the installer