I found it unprofessional of myself to have a two-day lead time to reproduce my development (work) environment. That’s the initial reason.
Nowadays I’m fascinated by how DYI and stable it is at the same time, and it’s become an amateur hobby of mine to put together Linux-based things out of existing blocks.
1 Like
Nix is in my opinion computing done correctly. There’s just too many benefits to count.
Its an entire DevSecOps toolchain with infra as code, automation, etc.
There’s like a hundred reasons I use nix but some of the less commonly described reasons:
- No longer need system backups. Just backup your mutable data.
- Fully custom recovery specialisation(s)
- I can deploy tools that I know will work everywhere without applying ad-hoc fixes
- Adding activation scripts in home manager means I can take my secrets with me anywhere and just logging out will destroy them.
- nix run is probably the most underrated feature of all time.
- configurationRevision is a godsend for tracking system state
4 Likes
I think I’m not alone in this, but I have tried many Operating Systems, Linux distros and many ways of configuring things. From Windows (yes i know, just entertain me here) to Ubuntu to Arch Linux to NixOS. From setting it up manually to using external program managers to putting just the config files into a git repo with a package list and some setup scripts to fully building my systems with a Nix flake.
Every time I failed to realize what I truly liked about and wanted out of my computer and It is something I only realized on my last journey through Arch Linux, or rather my (n+1)th reinstall thereof. Let me start… where I started using computers.
Like many I started on windows, an inflexible system with obscure configurations, inconsistent behaviors and no way of customizing it in a way that doesn’t impact the system’s performance, battery life or privacy. Reinstalling windows is also a task in itself because there is no real way to automate most things. This is frustrating, really tedious and extremely unergonomic.
At some point I switched to Ubuntu. Ubuntu ain’t perfect and it has its… problems. One thing I can say tho is that it is more predictable than windows. With a herculean effort it is also more customizable and configurable but this was still fighting my system. Customizing the DE or WM was possible, but don’t you dare try to remove things you don’t need or it might have weird side effects. (e.g. I removed gnome… and it uninstalled firefox)
Someone then recommended me Arch… and this was basically the holy grail to me at the time. Everything is exactly as I intend it to be. It is as close to “created by me” as I am willing to go (gentoo is… cool but too much for me lol). It was predictable, It was configurable, It worked exactly as I told it to. Reinstalling from a git repo of mostly bash scripts and disconnected files was a flaky nightmare tho. It worked most of the time… but it failed a lot too. I also had to learn 15 different configuration languages 100 different config locations (hyperbole, but you get the idea), I had no ability to manage more than one machine and I had to CONSTANTLY interfere and fix stuff. Obviously i forgot about my fixes between reinstalls… and it starts again.
Nix/NixOS solve all of the problems i have had along this entire journey. If you have the discipline to never write config files outside of your NixOS configuration, It will be one of the most powerful tools for system administration that you’ll ever use.
- It is well defined, even if not always well documented or easy to learn.
- It is reproducible (and by extension predictable). If it runs on one system, it runs everywhere. If it is configured here, it will be configured identically there.
- I can keep track of everything in a git repo without it being a bunch of disconnected files.
- All of the small fixes or adjustments I make along the way are kept inside the configuration. I don’t have to keep a list of config fixes, patches or whatever, only to forget I had to apply them or for them to be version incompatible.
- It is a single language and it can template any other language. While knowing the location of the files is useful, I no longer have to learn 10 languages to keep my system running.
With NixOS I finally found a distro that I do not have to fight against to get it to be the way I want. I don’t have to constantly be on top of everything. It makes easy the things I enjoy and automates the rest away or makes them afterthoughts. While I still think about security, I also know that NixOS configurations are configured as (reasonably) secure by default.
5 Likes
I’m a new nixos guy fan who initially avoided it like the plague but have to admit now. As a debian lover and sysadmin. This is simply a better everything done well. I’m now impressed and committed to learning it. My philosophy is “Nixos seems to be the future of what sysadmins/devops should be using - I wish I realised this sooner but ah well glad I’m finally here”
5 Likes
All my laptops/desktops are essentially in sync always, my servers don’t break anymore, and I can replace them with near no setup. I can use nix to deploy gigantic fleets of machines all around the world, delete all of them, and bring them back up and it just works. And even then, we have all the packages, and the quality of them is great, and nixos modules essentially means I can often say enable = true and set a few options and instantly spin up most services. And much much more…
But what got hooked was that the logo was cool and it kept my laptop and desktop in sync.
6 Likes
All solid points!! I love the simplicity of the notion of the main config file being the main point of the system. Trying to find literature on Nix has been the biggest challenge I have seen. At this point I haven’t even seen a simple Udemy lecture on Nixos.
I’m glad you found it as well! I am very pleased with Nix in so many different ways and it’s hard to just point at one specific thing that makes it shine depending on your focus.
1 Like
Yes, I always thought the logo was awesome given its uniqueness! I have quite a few computers as well and all of them have Nix on them except for two of them. I have a CF-33 Panasonic Toughbook that I have Red Hat on and I just primarily used it for experimenting purposes. I injected NixOS inside of RHEL 
and was running programs from it. I wanted to see the versatility of Nix as well as test what RHEL would let me get away with. I’m came really close to running Hyprland on it but no dice 
. But that’s pretty cool and I would be interested in hearing more about your setup some time
1 Like
Mine is ‘cuz I like immutable distros, but each time I tried stuff like Aurora or Bluefin, I wouldn’t be able to use ADB and Fastboot or Palera1n, which made me go back to imperative desktops.
I actually tried NixOS very early in my distro-hopping, before I tried Gentoo, around when I tried base Arch, but I didn’t stick with NixOS because I didn’t want to spend any time to learn the nix language.
Now that I have, however, I very much enjoy my experience, and have started using Home Manager and Flakes as well.
1 Like
I can definitely understand your path with that transition. Having tried NIX previously at least you had a decent idea of what you were coming back to the second time around.
I was in the middle of a building an OS platform concept using Arch. I knew about NIX but didn’t have any experience with. They idea hit to build the platform using Nix as the spine as it just made sense.
So there I was for a week jumping in feet first and nervous beyond belief in water unknown. But everything starting making more and more sense. And Home Manager, I have dabbled with it but have always just opened a terminal and jumped straight to the config.
Now I use Kate, and giving it’s capabilities I pushing more with Kate & Nix formulating a central command center basically. Still a work in progress there have been some good developments with so far.
Thank you for sharing!
Personally, I used to use Kate as well, but now I use Zed after trying VSCodium and realizing how slow it is because of Electron lol
1 Like
sounds interesting, would you mind speaking a bit more on this? I’m guessing this is somehow leveraging home.activation and making them available via a separate mechanism (env vars or other?)
1 Like
I wrote a home activation script that takes advantage of agenix and rbw (vaultwarden is my password manager)
I use rbw and home.activation to login/open my vaultwarden vault and place my agenix master key in an expected place for agenix to deploy my secrets.
I don’t need to bring my private key anywhere I don’t want it permanently.
I also setup a shell init to unlock the vault, link the master key and restart the agenix service if they’re not there. This requires I enter the vault password to unlock and deploy the secrets.
The benefits of this is I can always have my secrets when I’m active and if I’m not (logged out) systemd destroys them, master key included. You do need to turn of lingering though. That will break the security model.
Code
let
shellInit = ''
### Vaultwarden init ==================================================
AGEPATH="/run/user/$UID/age.key"
AGELINK="${config.home.homeDirectory}/.ssh/age.key"
if ! [ -f $AGEPATH ] || [ -z "$(head -n 1 $AGEPATH)" ]; then
echo $(rbw get "age key") > $AGEPATH
rbw stop-agent
fi
if ! [ -L $AGELINK ] && [ -f $AGEPATH ] && [ -n "$(head -n 1 $AGEPATH)" ]; then
ln -s $AGEPATH $AGELINK
elif [ -L $AGELINK ] && [ -f $AGEPATH ] && [ -n "$(head -n 1 $AGEPATH)" ]; then #BUG: duplicate check???
if [[ $(systemctl is-failed --user agenix) == "failed" ]] && [ -n "$(head -n 1 $AGEPATH)" ]; then
systemctl restart --user agenix
elif [[ $(systemctl is-failed --user agenix) == "failed" ]] && [ -z "$(head -n 1 $AGEPATH)" ]; then
echo "Placing AgeKey failed"
fi
else
echo "Something strange happened"
echo "check the age key"
fi
### systemd one-time triggers
systemctl restart --user agenix
'';
in {
age.identityPaths = [ "${config.home.homeDirectory}/.ssh/id_ed25519" "${config.home.homeDirectory}/.ssh/age.key" ];
home.packages = with pkgs; [ age rbw pinentry-all ];
programs.rbw = {
enable = true;
settings = {
email = "redacted";
base_url = vaultwardenUrl;
pinentry = pkgs.pinentry-all;
lock_timeout = 300;
};
};
home.activation.secretsInit = lib.hm.dag.entryBetween ["reloadSystemd"] ["writeBoundary"] ''
PATH="${config.home.path}/bin:$PATH:${pkgs.rbw}/bin"
AGEPATH="/run/user/$UID/age.key"
AGELINK="${config.home.homeDirectory}/.ssh/age.key"
[ -d ${config.home.homeDirectory}/.ssh ] || mkdir -p ${config.home.homeDirectory}/.ssh
if ! [ -f $AGEPATH ] || [ -z "$(head -n 1 $AGEPATH)" ]; then
echo $(rbw get "age key") > $AGEPATH
rbw stop-agent
fi
if ! [ -L $AGELINK ] && [ -f $AGEPATH ] && [ -n "$(head -n 1 $AGEPATH)" ]; then
ln -s $AGEPATH $AGELINK
elif [ -L $AGELINK ] && [ -f $AGEPATH ] && [ -n "$(head -n 1 $AGEPATH)" ]; then
echo "Secrets are fine. Doing nothing."
else
echo "Something strange happened"
echo "check the age key"
fi
'';
# Opening Shell =========================================================
programs.zsh.initContent = shellInit;
programs.bash.initExtra = shellInit;
3 Likes
Something to add about my nix philosophy that I don’t think is mentioned enough.
You see everywhere online that people praise nix for being a cool declarative distro. While this is good recognition, it really is the understatement of the century.
Nix is my OS, dotfiles, work environment, theme switcher, profile switcher, security tooling, deployment framework, automation tool, and it can be so much more.
This project alone has saved me probably years worth of work:
Using this with jenkins, and other tooling gives me a gods eye view of my supply chain threats and gives me the automated ability to give insurers and business partners SBOMs without having to compile everything for a month. They’re always surprised when they get it same day. I’ve been accused of not actually compiling everything.
Also the fact I can perform a static analysis of my entire network by reading offline build artifacts is crazy nice. I don’t need to waste network bandwidth on scanning servers.
I build a posix compliant ssh automation tool some time back I call ssher, and I’ve been working on building an integration to a nix-based deployment tool I built so I can use nix for salt-stack-like network property querying.
It won’t be long before I can run 1 script to automatically query my entire network for state information and update servers that have a nixpkgs version older than a month.
People think terraform is powerful, but they haven’t seen nix at scale.
4 Likes
I was previously on Tumbleweed, building niche packages that were not available from any repo or channel. I noticed that I had so many packages that were not really needed and felt like my system was just overrun with dependencies.
So I switched to NixOS, took me a month to get my system and home server to a place where I didn’t have to switch generations multiple times per day.
Nix is a great tool which sort of forces you to interact with the whole compilation of packages in your system, and you have a very good overview of exactly what you have installed. In that process you learn a lot about Linux, and if you build packages as a hobby you’ll naturally begin interacting and contributing to a community which feels meaningful to me.
The doxic philosophy around computer hardware and software is to create products that are «easy to use» and for everybody. This ease of use makes most people not curious about how our every day technology functions. Our current technology is objectively insane, and we should be grateful to all the genius engineers and workers who have made it all possible.
I find that a lot of people are unwilling to learn new tools, which is fine, people don’t have infinite time to learn new things. I am grateful that I am able to learn something new every day with Linux and Nix, and that’s a great hobby for me.
3 Likes
Here i thought generating a terraform config from nix was kinda neat.
tbf all that terraform config does is automate creating proxmox LXC containers.
the rest is still handled by a bunch of scripts.
I do agree that the amount of stuff that one can automate with nix and the ability to generate pretty much anything from a nix config is pretty sick. It’s also pretty fun to come up with the scheme to do so. There are so many ways in which one could do it.
3 Likes
Honestly this is something that has always frustrated me. I’ve always told people the same thing when they asked me for help. I’ll teach you how to do it, but I will not do it for you. People got offended by the sentiment and stopped asking. I find that funny but hey, it filters for people that are willing to learn (which is surprisingly small from my experience).
3 Likes
I have used Linux since mid-90s and used many distros on the way without being a distro-hopper (Slackware, Redhat, Fedora, Mandrake, Gentoo). Ubuntu was my long-time standard distro.
I moved to NixOS after my root SSD suddenly died wiping years of configurations on the way. I actually did have backup of my /etc, but that event got me thinking how to ensure recovery from a such a catastrophic event would be smoother. I got a tip from a colleague and I liked the idea right away. After a test installation, I started moving all my computers to NixOS.
I absolutely live it.
3 Likes
That’s a good reason as any for sure! I can imagine the frustration in the moment you had especially after having invested that much work and time with your previous configurations.
I remember in the mid 90’s Linux was just a whisper as Win 95 - 98 was in everyones face no matter where you went. I was still playing on my Commodore 64 in the mid 90’s that’s I had from the mid 80’s. Watching the computing world even all the through the early 2000’s was definitely a wild ride.
I’m definitely glad you found Nix to be your computing home as I have done as well. By the sounds of your experience I’m sure you have some cool projects you work on.
I switched from window to NixOS to crossbuild for a raspberry pi 02w. On the raspberrian os a pip install numpy took 18hr. I needed 4 more pip installs to get my concept to work. The 18 hr was a big no go. My son told me to use NixOS on my desktop to crossbuild a small nixos for the raspberry pi.
So my raspberry pi is now running nixos. My desktop takes maybe 25 min. to perform a cross build. My rpi02w is used for ‘cat’ trapping for Trap Neuter Release cat groups. It uses a camera to ID a cat, not a skunk, not a racoon. Then trip the trap. V1 is working. V1.2 (in work) to capture N number of cats in a drop trap (big). V2.0 (planned) is to trap only cat that are not on a already trapped list “not these cats”. This will detect variations of color or shapes. V2.1 will say trap only this cat (prepared model). V3 will allow the user to select types of animals. Coyote, wild pig, fox etc.. .
I am not a OS guy at all. So all the overlays, kernel, terminology is way over my head. But I learned enough to get my personal PC to work on tasks I need. And the cross building was extremely great function.
5 Likes