Interesting, does this provision VMs and networking
Short answer: No. You’d still require some third party provider (like dmacvicar/terraform-provider-libvirt) to create the actual VM (CPU, RAM, virtual disks) and the host-level networking (virtual bridges, tap interfaces, VLANs).
does this require some other cloud setup
As far as I remember, NixOS anywhere doesn’t require a cloud setup, once the VM exists, has an IP, and is booted into a live environment, it takes over to wipe the virtual drive and installs NixOS in it (that’s the default module), but you can have a lot of control on which stage is run (like nix-build if you just want to run nix build inside some Terraform / Tofu workflow or install if you really just want to run nixos-install pointing to a particular VM), the config options for each of these modules tends to be very flexible.
Maybe what makes sense for you is leveraging what used to be the nixos-generators project (and is now part of the nixos-rebuild build-image command) to create your immutable nixos images first.
My big challenge right now is networking. Making sure everything is consistently setup across hypervisor/vm configs is proving to be a bit of a pain.
You could use the aforementioned libvirt provider in OpenTofu to provision the VMs and the networking bridges on your NixOS host. Once the provider creates the VM, you pass its IP address to the nixos-anywhere Terraform module to install the OS (or to just run nixos-rebuild with a particular flake you want to deploy).
As a disclaimer, I have never used that particular provider before, but I see no reason why something like this isn’t possible:
# I'm assuming all the networking is already defined elsewhere in Terraform / Tofu
# (...)
# Spin up VM from pre-built image
resource "libvirt_domain" "app_server" {
name = "app-01"
disk {
volume_id = libvirt_volume.nixos_base_image.id
}
}
# (...)
# Apply config updates over SSH using only the rebuild submodule
module "nixos_rebuild" {
source = "github.com/nix-community/nixos-anywhere//terraform/nixos-rebuild"
target_host = libvirt_domain.app_server.network_interface[0].addresses[0]
nixos_system_attr = ".#nixosConfigurations.app01.config.system.build.toplevel"
}
So, you get a “cloud-like” workflow, the annoying part is the chicken-egg problem of how small you want your initial infra to be (and then use it to bootstrap everything with NixOS). That would depend if your hypervisor is already running on NixOS as well, which I don’t remember being it mentioned yet.
Another headache is the usual place where you want to put the Terraform / Tofu state, a cool new solution nowadays is stategraph, it solves the annoying problem Terraform always had with that pesky json file and ships the state to PostgreSQL instead (where you can actually query it in a normal way). DISCLAIMER: I USED TO WORK AT TERRATEAM, WHICH LATER BECAME STATEGRAPH, I still vouch for their culture of being open and always making self-hosting an option.
