# Journey into the world of NixOS deployment tools

- author: - Solène Rapenne - Tweag.io
- date:
- September 08, 2022

---

# Why does it matter?

- sysadmins enjoying NixOS on their workstation
       - it can be intimidating to deploy on a server
- you can't use traditional tools like ansible, salt, puppet ...
- some sysadmin won't use NixOS because of this
       - this hurts Nix adoption in general

---

# Comparison

https://github.com/nix-community/awesome-nix#deployment-tools

| Tool            | Active?    | Target           | Method                       | Notes                                                        |
|-----------------|------------|------------------|------------------------------|--------------------------------------------------------------|
| pushnix         | no         | NixOS            | git push config + ssh + hook | run nixos-rebuild through a git hook upon receiving          |
| KubeNix         | no         | Kubernetes       | -                            | generate k8s resources, no documentation                     |
| KuberNix        | no         | Kubernetes       | -                            | broken with nixpkgs-unstable (2022-09-07)                    |
| Nixery          | yes        | Docker           | -                            | on the fly Docker images generator                           |
| nixos-shell     | not much   | Qemu VMs         | -                            | use NixOS on any platform with Nix,  run a VM + mounts $HOME |
| terranix        | yes        | Terraform        | -                            | Use nix syntax and power of modules, translates as terraform |
| nixos-rebuild   | -          | NixOS            | local / remote               | base tool                                                    |
| autoUpgrade     | -          | NixOS            | local                        | module, auto reboot, reboot time window                      |
| terraform-nixos | not really | Cloud            | terraform + nixos            | declare cloud NixOS servers with terraform                   |
| krops           | yes        | NixOS            | ssh push config              | nix style wrapper around nixos-rebuild                       |
| Cachix deploy   | yes        | NixOS            | pull through an agent        | remote build, rollback, support per-profile, proprietary     |
| colmena         | yes        | NixOS            | ssh push / ssh push closure  | good documentation, can trigger a build remotely             |
| NixOps          | yes        | Cloud/ VM /NixOS | API / SSH push closure       | automatically provision resources to match config / mgmt     |
| Morph           | yes        | NixOS            | SSH push closure             | batch deploy, health check                                   |
| NixUS           | yes        | NixOS            | SSH push closure             | rollback, automatic ssh key exchange between hosts           |
| deploy-rs       | yes        | NixOS            | ssh push closure             | can push profiles, rollback                                  |
| Bento           | yes        | NixOS            | pull over SFTP               | fleet tracking, async pull, rollback                         |

---

# Secret management

https://nixos.wiki/wiki/Comparison_of_secret_managing_schemes

- the nix store is world readable, don't ever store secrets in it
- 4 schemes available
- with pros and cons
- may be specific to the tool (NixOps)

---

# Which one should you use?

"it depends"

---

# Recommandations per use case

## your workstation / autonomous management

- autoUpgrade
- nixos-rebuild

Require a manual update every 6 months if using releases

## full cloud - full Nix

- NixOps: it can provisionates and help remote management

## Remote servers (available 24/7)

- deploy-rs
- Morph
- Colmena

## Anything that isn't time sensitive

- Cachix deploy?
- Bento

---

# Why did I write Bento?

- I can't push gigabytes of data with a DSL line
- my computers are not always connected, so push method doesn't work
- asynchronous is fun and challenging
- Convinced NixOS is a good corporate OS
       - fits a central management and many remote asynchronous systems
       - easily bypass firewalls
       - can locally trigger an update using the web browser!

---

# Questions ?

You are viewing proxied material from dataswamp.org. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.