Both of these are true, but I find that the second, at least, isn't as much of a problem as you'd expect. Most modules that configure services give you the abil

Both of these are true, but I find that the second, at least, isn't as much of a problem as you'd expect. Most modules that configure services give you the ability to specify complete config files, which you can build whatever higher level structure you like on top of. For example, the built-in firewall is fairly basic (at least for running on a router; it does nearly everything you'd need for most desktop and server applications). I run NixOS on my router, so I needed something more. So, I wrote https://github.com/thequux/nix-zone-firewall https://github.com/thequux/nix-zone-firewall (note: the readme is slightly out of date, but it does give you the gist of it). First, I built a way to declaratively put rules in different chains (core.nix), and then I built a zone-based firewall on top of that. I then have another layer of configuration options in my router's config (not that repo) to be able to spread configuration across multiple files. Even though this was the first significant bit of Nix that I wrote, I still was able to put the entire thing together in a single evening after work.