devenv 2.4 introduces Machines, a way to define NixOS, nix-darwin, and home-manager configurations in devenv.nix.
You can inspect and build a machine locally, install a fresh NixOS host, or deploy updates to existing machines. NixOS deployments show closure and SSH access changes before activation.
You can also save a plan for later application, configure a health check, and inspect or roll back the last deployment.
The announcement covers SecretSpec bootstrapping and deployment across multiple machines:
It’s been rock-solid for me.
It’s also not tied to devenv, and supports deploying any Nix profile, so you can easily add support for more esoteric profiles like system-manager without hardcoding support into the deployment tool.
I don’t know of any other Nix deployment tool that supports that.
It’s tied to flakes, so you have to pick something
I’m happy it works for you!
I’ve mostly built machines because I’d like to use flexible ways to manage secrets via secretspec. You can pick from 35 providers, and decide if that’s done from where you deploy or on target host.
I’m just a UNIX philosophy fan (I’m actually not against software that does lots of things, so long as it’s not too hard to use it for only a few things).
Do consider adding support for generic Nix profile deployments similar to deploy-rs, though!
@domenkozar Thanks for your work on devenv, I’m very happy devenv exists, and it makes my life a lot easier. Thank you.
–
While I don’t plan on using devenv machines, I find this discussion disheartening, and find it unnecessarily snide.
As a nixos deployment-tool developer myself, I know people have different requirements, and that’s why so many different tools exists. I’m sure devenv machines exist because it’s useful for someone. Some just need to get a test machine up, some have a small homelab, while others run big production systems. Awesome that there’s options for everyone!
I wasn’t trying to come off that way! I’m sure this is useful to some devenv users, as well as the secretspec integration, and I’m happy that they have a good path to Nix deployments! I’m just not personally a fan of the seemingly very monolithic design of devenv.
As a long-time fan of your work @domenkozar , I have to say that @bitbloxhub ‘s critique here of the devenv ecosystem rings true. I’ve given your tools a go a few times, and I’m often quite happy with the results. But then I hit something that starts to feel like lock-in, and my spidey senses go off, and I feel like I don’t want to put all my eggs in one basket.
I gather there are good reasons for you to do things the way you have, and I wouldn’t tell you to do any different. I just wanted to give you a friendly perspective about it for your own business development dataset.
I don’t mind the critique at all, and I even agree with it - this is by design.
devenv is a lot like systemd (in Rust, Nix, and with sane interface).
systemd has been long critiqued as non-Unix, but if you think about these things long enough, you’ll understand it makes sense to build them bulky.
We do have plans to make a plugin system at some point (probably after devenv 3),
but monolithic design will never go way because it brings just too many benefits.
A lot of what’s at stake here is we are targeting pragmatic users who want to feel productive, but
aren’t that ideological about their tools.
Give it a try!
