Live data from Hacker News

NixOps – Declarative cloud provisioning and deployment with NixOS

nixos.org

21–30 of 67 posts

Re: NixOps – Declarative cloud provisioning and deployment with NixOS

#21
post #4

Earlier quoted context omitted.

I don't really see Nix as a limitation. It has a good claim to being a universal system configuration tool. Or how do you mean it's limited?

Can I use it to deploy either client or server applications on windows? All configuration and deployment tools I've looked at seem like they assume the only deployment target is linux servers running web applications. I don't care about the web. I need a deployment tool that works for local research on my clients' analysts' desktops, not just devops on remote somewhere.

Have you looked into the Windows features of Ansible or SaltStack? Would be interested to hear about experiences with them.

Re: NixOps – Declarative cloud provisioning and deployment with NixOS

#22
post #16

In view of some replies downthread: yes, application-level management is entirely possible with Nix(OS). Currently, this works best for Haskell, for which there is a sizeable amount (relatively speaking) of Nix tooling available. This is largely because a lot of Nix(OS) users also use Haskell, perhaps because lend themselves to very similar modes of "declarative" thinking. This is a thorough, excellent guide on how t…

Gabriel also has a great blog http://www.haskellforall.com/

Basically the kind of person I would love to buy a beer any time because he does so much great work.

on topic: The binary caches are great. For work I'm currently evaluating https://github.com/typeable/stackage2nix and https://github.com/input-output-hk/stack2nix to generate nix expressions from our haskell stack projects. And then push the build artifacts to a shared cache. Such that nobody has to ever compile a dependency twice. Because nothing sucks more than starting your day watching the compiler churn away at compiling after version bumps, to then also see a collegue go to the same pain all over again.

Re: NixOps – Declarative cloud provisioning and deployment with NixOS

#23
post #5

Is there good explanation anywhere of the syntax of those files? I tried getting into nix multiple times and was always put off by the lack of understandability of this.

https://learnxinyminutes.com/docs/nix/

Also includes links to the only other resources I found.

Re: NixOps – Declarative cloud provisioning and deployment with NixOS

#24
post #21

Earlier quoted context omitted.

Can I use it to deploy either client or server applications on windows? All configuration and deployment tools I've looked at seem like they assume the only deployment target is linux servers running web applications. I don't care about the web. I need a deployment tool that works for local research on my clients' analysts' desktops, not just devops on remote somewhere.

Have you looked into the Windows features of Ansible or SaltStack? Would be interested to hear about experiences with them.

I would like to adopt something for configuration of my personal machines. Desktop and tablet running Windows 10, laptop running macOS.

If possible I'd prefer to use one tool for both OSes.

Re: NixOps – Declarative cloud provisioning and deployment with NixOS

#25
post #5

Is there good explanation anywhere of the syntax of those files? I tried getting into nix multiple times and was always put off by the lack of understandability of this.

I read Nix Pills and they were very informative -- https://nixos.org/nixos/nix-pills/

Re: NixOps – Declarative cloud provisioning and deployment with NixOS

#26
post #14
post #5

Is there good explanation anywhere of the syntax of those files? I tried getting into nix multiple times and was always put off by the lack of understandability of this.

Nix is a bit like JSON + functions. An object (called attrset in nix): { a = 3; b = 4; } A list: [ 1 2 3 4 ]; A string: "hello" A multi-line string: '' multine string '' This defines a lambda with two arguments: a: b: a + b; It's possible to pattern-match arguments. This accepts an attrset with keys a and b, and maps them to local variables: { a, b }: a + b; There are some variations around that like `{ a ? 3 }:` `{…

Also, for convenience, nested objects/attrsets can be shortened. For instance:

    {
        a = {
            b = {
                c = 3;
            };
        };
    }
can be shortened to:

    {
        a.b.c = 3;
    }
This is used quite often in NixOS system configuration files. There you'll find lines like:

    services.openssh.enable = true;
For a list of all system configuration options that NixOS supports by default see (NixOS options)[https://nixos.org/nixos/options.html].

Re: NixOps – Declarative cloud provisioning and deployment with NixOS

#27
post #16

In view of some replies downthread: yes, application-level management is entirely possible with Nix(OS). Currently, this works best for Haskell, for which there is a sizeable amount (relatively speaking) of Nix tooling available. This is largely because a lot of Nix(OS) users also use Haskell, perhaps because lend themselves to very similar modes of "declarative" thinking. This is a thorough, excellent guide on how t…

We use NixOS in production in our product, for our cloud services, and for some development environments.

We build everything with nix from sbt projects, go projects, haskell projects, purescript projects, docker images, and npm projects.

It's an incredible tool.

NixOps is also a good tool but there are a lot of issues with it we haven't had time to contribute fixes for. We also wanted it to be lighter weight and to decouple system specification from system deployment. So I wrote a tool that handles performing the same system deployment operations that NixOps does for you and you can simply pipe the nix path result from nix-build to it. We use terraform to specify and manage the cloud resources.

Re: NixOps – Declarative cloud provisioning and deployment with NixOS

#28
post #5

Is there good explanation anywhere of the syntax of those files? I tried getting into nix multiple times and was always put off by the lack of understandability of this.

The nix language: https://nixos.org/nix/manual/#chap-writing-nix-expressions

Abstractions used in nixpkgs: https://nixos.org/nixpkgs/manual/

http://lethalman.blogspot.no/2014/07/nix-pill-1-why-you-shou...

https://medium.com/@MrJamesFisher/nix-by-example-a0063a1a4c5...

Re: NixOps – Declarative cloud provisioning and deployment with NixOS

#29

Other than integration with the rest of the Nix/NixOS ecosystem, how is NixOps different from Puppet? Reading briefly through the examples, it seems very oriented towards provisioning machine instances rather than provisioning behavior across networks or multi-machine services, which is something that Puppet really excels at. What features does this offer in addition to ones that Puppet provides? That said, I've been…

Linux wasn't designed to be an immutably-configured operating system. When systems like Puppet try to apply configuration to a target server, they're operating on top of a layer which is inherently stateful, which has a propensity to cause all sorts of problems. What if somebody manually entered this server and screwed with the configuration, outside of Puppet? What if poorly packaged applications don't cleanly uninstall or upgrade properly? Systems like Puppet tend to just throw an error at the sysadmin and walk away.

NixOS treats immutable configuration as a first-class citizen at the OS level. Dependenices are not installed into /usr or /etc, rather specific versions of packages (identified by their hashes) are installed into /nix/store and then symlinked back to /usr or /etc. Different applications that require different versions of the same dependency, when packaged according to standard, harmoniously co-exist on the same server because the Nix packaging system symlinks the dependencies between each other in /nix/store.

You don't realize the full power of this setup until you make a mistake, make your system unbootable, and calmly tell GRUB to just use the last valid configuration - a few minutes later and you're back at a desktop. Conventional configuration management tool like Puppet tend to be worthless in those kinds of failure modes, and most sysadmins would be implementing backup restoration procedures.

Re: NixOps – Declarative cloud provisioning and deployment with NixOS

#30
post #29

Other than integration with the rest of the Nix/NixOS ecosystem, how is NixOps different from Puppet? Reading briefly through the examples, it seems very oriented towards provisioning machine instances rather than provisioning behavior across networks or multi-machine services, which is something that Puppet really excels at. What features does this offer in addition to ones that Puppet provides? That said, I've been…

Linux wasn't designed to be an immutably-configured operating system. When systems like Puppet try to apply configuration to a target server, they're operating on top of a layer which is inherently stateful, which has a propensity to cause all sorts of problems. What if somebody manually entered this server and screwed with the configuration, outside of Puppet? What if poorly packaged applications don't cleanly unins…

Here's another example that is simple, but one I still appreciate: I wanted a slightly newer kernel. How do I get it, and ensure all the "downstream" dependencies are rebuilt (e.g. kernel modules)?[1]

I write this into my configuration.nix:

    boot.kernelPackages = pkgs.linuxPackages_latest;
I run `nixos-rebuild switch && reboot` and I'm done. I can switch back to the last one if I wanted, but this new one takes place immediately. I just did this on a server 20 minutes ago.

There are other small things I can do with this. What if I didn't want to boot this kernel to boot, just test it?

    $ nixos-rebuild build-vm
    $ ./result/bin/run-*-vm
This will instantly drop you into a QEMU-KVM instance that is using NixOS with your `configuration.nix`, but if you rebooted nothing would change. (You can also specify a different configuration.nix to test other machines![2]) Or I could boot it, but just once and switch back pretty easily if something was wrong.

---

Another: What if I wanted Tarsnap backups of something? (This may be out of date, but it's my old config, and I wrote the Tarsnap module)

      services.tarsnap.enable = true;
      services.tarsnap.archives =
        { nixos =
          { checkpointBytes = "5GB";
            directories =
            [ "/root" "/etc/nixos"
            ];
          };

          home =
          { excludes = [ "*.o" "*.hi" ];
            checkpointBytes = "5GB";
            directories =
            [ "/home/a"
            ];
          };
        };
Now I can do things like this:

    $ systemctl start tarsnap@home
    $ systemctl start tarsnap@nixos
To start on demand. Or I can configure timers/cron to do this manually.

Lots of other small things. Binary caches, your own Hydra, remote/multi-architecture builds, etc. One time I "configured" my NixOS laptop install before getting my laptop: on a remote testing server, over remote KVM. Pushed it to git. I cloned my configuration.nix during NixOS installation on my laptop a few days later, and I replicated my laptop in 10 minutes. :) Combine this with Hydra (CI) server: You can even write tests and have your laptop configuration continuously integrated all the time?!?!?!?

That said NixOS isn't always the easiest thing to use, but it does come with some big advantages!

[1] I'm aware of DKMS (and have even worked on modules using it where it was fine) but I've still had it break once or twice. Maybe that was VMWare's fault :)

[2] If you share code between all your configuration.nix files, this becomes a lot easier.

Post reply on HN