The most promising thing in this area, IMO, is NixOS and surrounding tools like NixOps. They're strange and hard to learn, and you have to do almost everything

The most promising thing in this area, IMO, is NixOS and surrounding tools like NixOps. They're strange and hard to learn, and you have to do almost everything differently from what you learned, but it is really true declarative configuration of a machine from the ground up, not quasi-declarative where there's always state that gets left out and you can never really trust the diffing/idempotency mechanisms because they're layered on top of things that weren't meant to be used that way. (If you dig into the details, you will find some "atrocious hacks" as the sibling comment puts it, but because of how it works, the hacks are almost completely encapsulated at build time and those builds are reproducible, so there's much less to worry about when you're deploying/provisioning.)