<p align="center" <a href="https://github.com/jpvelasco/nyx/actions/workflows/ci.yml"<img src="https://github.com/jpvelasco/nyx/actions/workflows/ci.yml/badge.svg" alt="CI"</a <a href="https://github.com/jpvelasco/nyx/releases/latest"<img src="https://img.shields.io/github/v/release/jpvelasco/nyx" alt="Release"</a <a href="https://github.com/jpvelasco/nyx/blob/main/LICENSE"<img src="https://img.shields.io/github/license/jpvelasco/nyx" alt="License"</a <a href="https://github.com/jpvelasco/nyx/blob/main/go.mod"<img src="https://img.shields.io/github/go-mod/go-version/jpvelasco/nyx" alt="Go"</a <a href="https://www.npmjs.com/package/nyx-audit-cli"<img src="https://img.shields.io/npm/v/nyx-audit-cli" alt="npm"</a </p
nyx
Your homelab should be doing what you think it's doing. nyx proves it.
Validate your network behavior against a declared YAML intent model — VLAN isolation, VPN routing, host counts, route correctness — all verified with live network checks. When something drifts, nyx tells you exactly what changed and how to fix it.
Every command produces structured JSON for automation and AI agent consumption.
Install from npm: nyx-audit-cli — npm install -g nyx-audit-cli
Quick Start
# Install prebuilt binary (recommended)
npm install -g nyx-audit-cli
# If npm blocked the postinstall script (Ubuntu 26+, hardened envs), just run nyx once —
# it detects the missing binary and downloads it automatically. Or manually:
# node $(npm root -g)/nyx-audit-cli/install.js
# Or build from source (requires the Go version in go.mod, currently 1.26.8)
git clone https://github.com/jpvelasco/nyx.git && cd nyx && make build
# Discover hosts on a subnet (sudo recommended for complete nmap ping sweeps)
sudo nyx discover --subnet 10.0.10.0/24Run a full audit from a spec file (sudo recommended when the spec includes subnetdiscovery)
sudo nyx audit --spec examples/homelab.yaml
Check environment health — never needs elevation
nyx doctor
Elevation is recommended for nmap subnet scans, not required to run nyx. See [Privileges](#privileges).
### Longer-Term Confidence
Once you've verified your network is behaving correctly, lock in that baseline. Future drift checks will show you exactly what changed — new failures, degradations, or fixes — so you can sleep at night knowing your segmentation and policies are still holding.
After a clean audit, lock in the latest saved snapshot as the baseline
sudo nyx audit --spec examples/homelab.yaml nyx snapshot baseline # uses the latest saved snapshot from that audit
optional: nyx snapshot list
Days or weeks later, re-audit and check drift
sudo nyx audit --spec examples/homelab.yaml && nyx drift status