NixOS Part 1

Published 2022-02-22 on Cara's Blog - Permalink

Recently, I switched both of my primary laptops from Arch (cesium/vulcan) and Windows (carbon) to NixOS, mostly on a whim. Some friends of mine have been encouraging me to try it out for a while, and I did so over the winter break on Carbon, but I couldn’t get flakes to work properly, so I abandoned it and put Windows on it. What I needed from carbon was for it to work as a notetaking tablet, and Windows came with OneNote so it was easy to get set up.

Ever since, NixOS has been in the back of my mind. The idea of a system configuration tracked in Git that I can use on clients and servers intrigued me and I wanted to see how I could use that in my systems administration.

First Steps

The first thing I did was talk with my friends who were trying to get me to use NixOS in the first place. They recommended that I go with setting up my flake immediately, instead of trying to merge my existing configuration.nix into a flake later. This turned out to be the right move, and I’m now tracking my system configuration at muirrum/nix. This has led to me being able to share a baseline configuration across both carbon and cesium, including my user configuration and the packages I expect to have (including neovim, zsh, firefox, and my custom fork of dwm).

Encapsulate and Unifiy

Everything else I’m planning to split into modules, for both my user configuration and my system configuration. I’ve already started this with nixos/modules/*.nix and home/modules/mail.nix which set up system modules like Steam, Darktable, and virtualization, as well as my mail sync systemd service. That way, I can enable the things I need per-system, while still maintaining the ability to centrally manage it. Now I can add ./nixos/modules/steam.nix to my system configuration and I get my Steam setup on every system, every time. It’s the same with Darktable, libvirtd, or mbsync. Getting a unified system configuration is as simple as nixos-rebuild switch in my flake directory. I’m planning on rolling this out to my servers slowly, starting with my physical server during the next break.

Packaging

NixOS is based on the Nix package manager, which allows developers to describe exactly which versions of which packages should be built to make their app work every time. I’ve been using this to package my bots and configure their development environments so I don’t have those tools polluting my $PATH outside of the directories where I intend to work on them. I have one of my bots set up to automatically build a small Docker image for me, so that I can quickly push it up to my private registry.

Conclusion

I plan to keep using NixOS for all my devices. I’ve found it fun to tinker with, especially since it keeps a backup of previous versions of your system, so that if you mess something up you can just reboot and choose a different one. I haven’t needed that yet but I’m sure it’s coming soon, knowing how much I like to mess with things that shouldn’t be messed with.

I’ll probably write about my experience getting NixOS set up on my home server in another post.


Articles from my webring

gccrs: An alternative compiler for Rust

This is a guest post from the gccrs project, at the invitation of the Rust Project, to clarify the relationship with the Rust Project and the opportunities for collaboration. gccrs is a work-in-progress alternative compiler for Rust being developed as part…

via Rust Blog November 7, 2024

Status update, October 2024

Hi! This month XDC 2024 took place in Montreal. I wasn’t there in-person, but thanks to the organizers I could still ask questions and attend workshops remotely (thanks!). As usual, XDC has been a great reminder of many things I wanted to do but which got bur…

via emersion October 21, 2024

Post-OCSP certificate revocation in the Web PKI

Introduction Today, TLS certificates in the Web public key infrastructure (PKI) have long validity: almost all remain valid for at least three months! An attacker compromising a certificate early enough in its lifetime1 keeps it compromised for months. Cer…

via Posts on Seirdy’s Home September 25, 2024

Generated by openring