3 ms·

Do you have a more detailed example of this?

by xena 7y ago

elbear 7y ago
I assume they're talking about the same process you can use to pin nixpkgs. Have a nixpkgs.json with contents like these { "url": "https://github.com/nixos/nixpkgs-channels.git", "rev": "ea553d8c67c6a718448da50826ff5b6916dc9c59", "date": "2020-02-02T15:39:15+01:00", "sha256": "0g9smv36sk42rfyzi8wyq2wl11c5l0qaldij1zjdj60s57cl3wgj", "fetchSubmodules": false } Then, in nixpkgs.nix have let bootstrap = import <nixpkgs> { }; nixpkgs-pin = builtins.fromJSON (builtins.readFile ./nixpkgs.json); nixpkgs = bootstrap.fetchFromGitHub { owner = "NixOS"; repo = "nixpkgs"; inherit (nixpkgs-pin) rev sha256; }; in import nixpkgs
eeh 7y ago
As an example, I have a program for regularly backing up directories to cloud storage (with deduplication, encryption, key management, etc. it's just a wrapper around Restic), which it does regularly via cron. I manage this in NixOS: different machines backup different directories, with different keys. This program has a CLI mode for setting up keys and buckets, which I run locally, and it writes to backup-metadata.json . So my workflow for adding a new directory to my system is: 1. Run CLI tool to create a new bucket, new API key with access to the bucket (with just the permissions it needs), and new encryption key. This writes to my backup-metadata.json file locally. 2. write some NixOS along the lines of: let metadata = (builtins.fromJSON "../backup-metadata.json").git; in { backup = { git = { path = "/var/lib/git-repositories"; frequency = "hourly"; bucket = metadata.bucket; key = metadata.key; apiKey = metadata.apiKey; }; }; } 3. Hit deploy. This starts the backups, and some monitoring to check the cloud storage is being regularly written to. The implementation of "backup" is private, but reuses parts of upstream NixOS (systemd.timer, Prometheus, ...)

Do you have a more detailed example of this?

by xena 7y ago

Do you have a more detailed example of this?

I assume they're talking about the same process you can use to pin nixpkgs. Have a nixpkgs.json with contents like these { "url": "https://github.com/nixos/nixpkgs-channels.git", "rev": "ea553d8c67c6a718448da50826ff5b6916dc9c59", "date": "2020-02-02T15:39:15+01:00", "sha256": "0g9smv36sk42rfyzi8wyq2wl11c5l0qaldij1zjdj60s57cl3wgj", "fetchSubmodules": false } Then, in nixpkgs.nix have let bootstrap = import <nixpkgs> { }; nixpkgs-pin = builtins.fromJSON (builtins.readFile ./nixpkgs.json); nixpkgs = bootstrap.fetchFromGitHub { owner = "NixOS"; repo = "nixpkgs"; inherit (nixpkgs-pin) rev sha256; }; in import nixpkgs

eeh 7y ago

As an example, I have a program for regularly backing up directories to cloud storage (with deduplication, encryption, key management, etc. it's just a wrapper around Restic), which it does regularly via cron. I manage this in NixOS: different machines backup different directories, with different keys. This program has a CLI mode for setting up keys and buckets, which I run locally, and it writes to backup-metadata.json . So my workflow for adding a new directory to my system is: 1. Run CLI tool to create a new bucket, new API key with access to the bucket (with just the permissions it needs), and new encryption key. This writes to my backup-metadata.json file locally. 2. write some NixOS along the lines of: let metadata = (builtins.fromJSON "../backup-metadata.json").git; in { backup = { git = { path = "/var/lib/git-repositories"; frequency = "hourly"; bucket = metadata.bucket; key = metadata.key; apiKey = metadata.apiKey; }; }; } 3. Hit deploy. This starts the backups, and some monitoring to check the cloud storage is being regularly written to. The implementation of "backup" is private, but reuses parts of upstream NixOS (systemd.timer, Prometheus, ...)