6 ms·

So if I understand correctly, I could declaratively specify my workstation, say I want vim, podman, codium, kubectl, curl, tmux, firefox, zettlr. I could put th

So if I understand correctly, I could declaratively specify my workstation, say I want vim, podman, codium, kubectl, curl, tmux, firefox, zettlr. I could put this in a configuration and have my workstation anywhere I can grab that from? Is there some way I can boot-to-git-configuration? So I could do this in RAM on someone else's hardware, like a network boot?

mason55 5y ago
> So if I understand correctly, I could declaratively specify my workstation, say I want vim, podman, codium, kubectl, curl, tmux, firefox, zettlr. I could put this in a configuration and have my workstation anywhere I can grab that from? Yes, and you can specify your .vimrc, your vim plugins, the users you want setup, their SSH keys, your systemd config, etc. > Is there some way I can boot-to-git-configuration? Bootstrapping a system is the one place where you still need to do a bit of work, but it's not bad. I personally have a script in my Nix config repo which pulls my config down to disk, sets up symlinks, and then switches to the new config. From there everything then goes through standard Nix tooling.
- Filligree 5y ago
  What you can relatively easily do is extend the 'installer' config with whatever you want to add there, for instance applications and a desktop environment. It should be relatively straightforward to also mount /home from a separate USB stick partition, but I haven't tried.
  - mason55 5y ago
    Oh yeah, that's not a bad idea and definitely what I'd do if I was bootstrapping a bunch of hosts at once. As it is I set up maybe one new host a year, which means that it's at least as much work to rebuild an installer boot media + my config as it is to do a base install and then pipe a script through bash to finish setup.
- alias_neo 5y ago
  Amazing thanks. I'm going to start taking a look at getting a simple configuration started with my basic setup, keys, shell, tmux config etc.
e3bc54b2 5y ago
Alternative to what others have said, you can use your config to build a custom bootable ISO and use it to setup your new system. Comes very handy if you can't guarantee nice network for setup.
- alias_neo 5y ago
  This sounds like a great idea. Do you happen to know of any documentation to assist with this? I'd love to create a custom, bootable USB which I can upgrade periodically, keeping my SSH keys on a Yubikey.
  - zimbatm 5y ago
    One way is to use this project: https://github.com/nix-community/nixos-generators https://github.com/nix-community/nixos-generators It's just a small wrapper but it shows you most of the targets available.
    - alias_neo 5y ago
      Great, thanks!
- SkyMarshal 5y ago
  Last time I tried this, the NixOS Live USB still requires network connectivity to install. Is there some way to create an ISO or Live USB that installs completely offline?
  - takeda 5y ago
    Nix kind of expects to be always connected. It is possible though, if you have the same config and use channels at the same revision (or use flakes) nix will know all packages it needs. You could fetch them and then either provide that machine as a cache, or use nix copy to copy the packages.
Blikkentrekker 5y ago
Almost any system can do that. Package managers typically have a concept of a “selected set” or something o that nature which is often simply a file that contains all the packages the user wants to install on a new line at some places. Simply copy that file and do a world update with the package manager and it will install all those packages an their dependencies and typically uninstall what is not needed.
- Nullabillity 5y ago
  NixOS also covers package configuration, not just which packages are installed. And because it owns all of the configuration, it can semi-intelligently merge package configurations that are managed in multiple independent places. It can also be used to apply patches to packages (which are then automatically carried over when the upstream package is updated).
  - Blikkentrekker 5y ago
    > NixOS also covers package configuration, not just which packages are installed. And because it owns all of the configuration, it can semi-intelligently merge package configurations that are managed in multiple independent places. Do you mean system configuration in /etc, or also user configuration in /home? In the latter case I do not see how this can ever be implemented, even if an exhaustive list be provided with each package in it's description, quite a bit of software will arbitrarily add new files under new names as part of it's confguration. Usually one simply copies one's entire `~/.config` directory along. > It can also be used to apply patches to packages (which are then automatically carried over when the upstream package is updated). True, but this is also a feature of any source-based system. The real advantage to me seems to be that it is a source-based system but with a central repository for identically configured packages to avoid compilation in many cases.
    - Nullabillity 5y ago
      > Do you mean system configuration in /etc, or also user configuration in /home? NixOS covers /etc, and Home-Manager covers /home. But in practice many applications support configuration from /etc as well, and you will tend to prefer just managing it from there when using NixOS. > In the latter case I do not see how this can ever be implemented, even if an exhaustive list be provided with each package in it's description, quite a bit of software will arbitrarily add new files under new names as part of it's confguration. Hm? If you use Nix to manage the application's configuration then Nix is the only program allowed to change the configuration directly. > Usually one simply copies one's entire `~/.config` directory along. Not the same thing. Nix allows you to express relationships between different application configurations (why does program A try to connect to localhost:9267? oh, ripgrep says that program B is binding that port for RPC...), and lets you stack configurations (so that defaults can be updated automatically, or you can change a specific value for a specific machine without having to maintain two completely separate copies). It's like the difference between giving a new employee access to your source code, vs saying "here's an optimized stripped build, and here's a copy of Ghidra, have fun!". > True, but this is also a feature of any source-based system. In the same sense that you can copy your dotfiles around manually, sure. The difference is that Nix allows you to patch the package definition itself dynamically. AUR/PKGBUILD (the only other source-based system I'm familiar with to be fair, not sure if Gentoo handles this differently) allows you to patch the /application/, but you still need to copy the PKGBUILD and backport all upstream changes.
Nullabillity 5y ago
> So if I understand correctly, I could declaratively specify my workstation, say I want vim, podman, codium, kubectl, curl, tmux, firefox, zettlr. I could put this in a configuration and have my workstation anywhere I can grab that from? Kind of. It works very well if you own multiple computers that you want to be configured similarly (like a dotfiles repo on steroids). It doesn't work so well for I borrowed my coworker's computer for 5 minutes and want to use my own Vim configuration. However, Nix does also supply the "nix run" command, which allows you to use software without installing it permanently (but without NixOS' configuration support). > Is there some way I can boot-to-git-configuration? So I could do this in RAM on someone else's hardware, like a network boot? Yes. You could either build an image with a service that git clones your configuration and switches to it, or you could build an image containing a prebuilt snapshot of your configuration. Either approach should be possible for basically any medium (USB drive, DVD, netboot, whatever). That said, for the build-and-switch setup I'd recommend something that can give at least /nix/store a writable partition (to avoid having to rebuild/redownload the whole world on every reboot).
- Sleepytime 5y ago
  >It doesn't work so well for I borrowed my coworker's computer for 5 minutes and want to use my own Vim configuration You could use something like nixos-shell[1] to spin up a headless VM of your machine into your current shell. [1]https://github.com/Mic92/nixos-shell https://github.com/Mic92/nixos-shell
  - gmfawcett 5y ago
    Well that is pretty neat. Thanks for the mention of nixos-shell. I've been a NixOS daily-driver for the past 6 months or so, but I am still picking up new ideas on a daily basis. :)
    - Sleepytime 5y ago
      It's been my daily for not much longer than that, and almost every time I play with NixOS itself I get the sense of wonder and possibility in computers that I haven't had since I was a teenager. It's definitely a force multiplier.
Sleepytime 5y ago
>Is there some way I can boot-to-git-configuration? Yes, the NixOS installer is a live disk with all the features of NixOS. I have booted configurations directly from IPFS in the installer, and many nix commands and functions support git (or GitHub) natively. You can declaratively specify your whole infrastructure from software configuration to remote machines with their own VMs. For example here's my nix function for matrix: https://0x0.st/-2CA.nix https://0x0.st/-2CA.nix It does a whole bunch of stuff. First it reads in the hostname and domain from the system configuration and put that in a variable to be used when configuring the subdomains later. Then it opens up your firewall, starts a postgres service, creates the matrix db/user, configures nginx for matrix.hortname.domain, gets your SSL certificate (and sets up automatic renewal), sets up matrix, and lastly a hosted web client at element.host.domain. All services run under their own users on the host system. It's zero configuration, I just import that to any machine that I want and it's running a matrix server with all appropriate ancillary configuration done.
- flatiron 5y ago
  i hope you aren't still using that shared secret
  - GordonS 5y ago
    Or the password for that Postgres user...
  - pxc 5y ago
    Nix's IPFS support is for everything in the Nix store, which is world-readable and in which NixOS places no secrets. Options for managing secrets in/with Nix projects either encrypt them in the store or never have them touch the store (encrypted or otherwise). Mutable state like database contents, including their password databases, don't go in the Nix store either.
- alias_neo 5y ago
  Thanks I'll have a read through it, I can lots of uses for this already!
foolmeonce 5y ago
With nixops you also define define your configurations in nix (and can have interdependencies between them) then start machines or virtual machines as blank nixos installs and add their ssh key and address for nixops to reconfigure and manage. I ultimately find it easier to have one host that is keeping track of all configurations and pushing my changes to all hosts since I otherwise end up with a lot of machines with different changes I've been working on.

mason55 5y ago

> So if I understand correctly, I could declaratively specify my workstation, say I want vim, podman, codium, kubectl, curl, tmux, firefox, zettlr. I could put this in a configuration and have my workstation anywhere I can grab that from? Yes, and you can specify your .vimrc, your vim plugins, the users you want setup, their SSH keys, your systemd config, etc. > Is there some way I can boot-to-git-configuration? Bootstrapping a system is the one place where you still need to do a bit of work, but it's not bad. I personally have a script in my Nix config repo which pulls my config down to disk, sets up symlinks, and then switches to the new config. From there everything then goes through standard Nix tooling.

Filligree 5y ago
What you can relatively easily do is extend the 'installer' config with whatever you want to add there, for instance applications and a desktop environment. It should be relatively straightforward to also mount /home from a separate USB stick partition, but I haven't tried.
- mason55 5y ago
  Oh yeah, that's not a bad idea and definitely what I'd do if I was bootstrapping a bunch of hosts at once. As it is I set up maybe one new host a year, which means that it's at least as much work to rebuild an installer boot media + my config as it is to do a base install and then pipe a script through bash to finish setup.
alias_neo 5y ago
Amazing thanks. I'm going to start taking a look at getting a simple configuration started with my basic setup, keys, shell, tmux config etc.

e3bc54b2 5y ago

Alternative to what others have said, you can use your config to build a custom bootable ISO and use it to setup your new system. Comes very handy if you can't guarantee nice network for setup.

alias_neo 5y ago
This sounds like a great idea. Do you happen to know of any documentation to assist with this? I'd love to create a custom, bootable USB which I can upgrade periodically, keeping my SSH keys on a Yubikey.
- zimbatm 5y ago
  One way is to use this project: https://github.com/nix-community/nixos-generators https://github.com/nix-community/nixos-generators It's just a small wrapper but it shows you most of the targets available.
  - alias_neo 5y ago
    Great, thanks!
SkyMarshal 5y ago
Last time I tried this, the NixOS Live USB still requires network connectivity to install. Is there some way to create an ISO or Live USB that installs completely offline?
- takeda 5y ago
  Nix kind of expects to be always connected. It is possible though, if you have the same config and use channels at the same revision (or use flakes) nix will know all packages it needs. You could fetch them and then either provide that machine as a cache, or use nix copy to copy the packages.

Blikkentrekker 5y ago

Almost any system can do that. Package managers typically have a concept of a “selected set” or something o that nature which is often simply a file that contains all the packages the user wants to install on a new line at some places. Simply copy that file and do a world update with the package manager and it will install all those packages an their dependencies and typically uninstall what is not needed.

Nullabillity 5y ago
NixOS also covers package configuration, not just which packages are installed. And because it owns all of the configuration, it can semi-intelligently merge package configurations that are managed in multiple independent places. It can also be used to apply patches to packages (which are then automatically carried over when the upstream package is updated).
- Blikkentrekker 5y ago
  > NixOS also covers package configuration, not just which packages are installed. And because it owns all of the configuration, it can semi-intelligently merge package configurations that are managed in multiple independent places. Do you mean system configuration in /etc, or also user configuration in /home? In the latter case I do not see how this can ever be implemented, even if an exhaustive list be provided with each package in it's description, quite a bit of software will arbitrarily add new files under new names as part of it's confguration. Usually one simply copies one's entire `~/.config` directory along. > It can also be used to apply patches to packages (which are then automatically carried over when the upstream package is updated). True, but this is also a feature of any source-based system. The real advantage to me seems to be that it is a source-based system but with a central repository for identically configured packages to avoid compilation in many cases.
  - Nullabillity 5y ago
    > Do you mean system configuration in /etc, or also user configuration in /home? NixOS covers /etc, and Home-Manager covers /home. But in practice many applications support configuration from /etc as well, and you will tend to prefer just managing it from there when using NixOS. > In the latter case I do not see how this can ever be implemented, even if an exhaustive list be provided with each package in it's description, quite a bit of software will arbitrarily add new files under new names as part of it's confguration. Hm? If you use Nix to manage the application's configuration then Nix is the only program allowed to change the configuration directly. > Usually one simply copies one's entire `~/.config` directory along. Not the same thing. Nix allows you to express relationships between different application configurations (why does program A try to connect to localhost:9267? oh, ripgrep says that program B is binding that port for RPC...), and lets you stack configurations (so that defaults can be updated automatically, or you can change a specific value for a specific machine without having to maintain two completely separate copies). It's like the difference between giving a new employee access to your source code, vs saying "here's an optimized stripped build, and here's a copy of Ghidra, have fun!". > True, but this is also a feature of any source-based system. In the same sense that you can copy your dotfiles around manually, sure. The difference is that Nix allows you to patch the package definition itself dynamically. AUR/PKGBUILD (the only other source-based system I'm familiar with to be fair, not sure if Gentoo handles this differently) allows you to patch the /application/, but you still need to copy the PKGBUILD and backport all upstream changes.

Nullabillity 5y ago

> So if I understand correctly, I could declaratively specify my workstation, say I want vim, podman, codium, kubectl, curl, tmux, firefox, zettlr. I could put this in a configuration and have my workstation anywhere I can grab that from? Kind of. It works very well if you own multiple computers that you want to be configured similarly (like a dotfiles repo on steroids). It doesn't work so well for I borrowed my coworker's computer for 5 minutes and want to use my own Vim configuration. However, Nix does also supply the "nix run" command, which allows you to use software without installing it permanently (but without NixOS' configuration support). > Is there some way I can boot-to-git-configuration? So I could do this in RAM on someone else's hardware, like a network boot? Yes. You could either build an image with a service that git clones your configuration and switches to it, or you could build an image containing a prebuilt snapshot of your configuration. Either approach should be possible for basically any medium (USB drive, DVD, netboot, whatever). That said, for the build-and-switch setup I'd recommend something that can give at least /nix/store a writable partition (to avoid having to rebuild/redownload the whole world on every reboot).

Sleepytime 5y ago
>It doesn't work so well for I borrowed my coworker's computer for 5 minutes and want to use my own Vim configuration You could use something like nixos-shell[1] to spin up a headless VM of your machine into your current shell. [1]https://github.com/Mic92/nixos-shell https://github.com/Mic92/nixos-shell
- gmfawcett 5y ago
  Well that is pretty neat. Thanks for the mention of nixos-shell. I've been a NixOS daily-driver for the past 6 months or so, but I am still picking up new ideas on a daily basis. :)
  - Sleepytime 5y ago
    It's been my daily for not much longer than that, and almost every time I play with NixOS itself I get the sense of wonder and possibility in computers that I haven't had since I was a teenager. It's definitely a force multiplier.

Sleepytime 5y ago

>Is there some way I can boot-to-git-configuration? Yes, the NixOS installer is a live disk with all the features of NixOS. I have booted configurations directly from IPFS in the installer, and many nix commands and functions support git (or GitHub) natively. You can declaratively specify your whole infrastructure from software configuration to remote machines with their own VMs. For example here's my nix function for matrix: https://0x0.st/-2CA.nix https://0x0.st/-2CA.nix It does a whole bunch of stuff. First it reads in the hostname and domain from the system configuration and put that in a variable to be used when configuring the subdomains later. Then it opens up your firewall, starts a postgres service, creates the matrix db/user, configures nginx for matrix.hortname.domain, gets your SSL certificate (and sets up automatic renewal), sets up matrix, and lastly a hosted web client at element.host.domain. All services run under their own users on the host system. It's zero configuration, I just import that to any machine that I want and it's running a matrix server with all appropriate ancillary configuration done.

flatiron 5y ago
i hope you aren't still using that shared secret
- GordonS 5y ago
  Or the password for that Postgres user...
- pxc 5y ago
  Nix's IPFS support is for everything in the Nix store, which is world-readable and in which NixOS places no secrets. Options for managing secrets in/with Nix projects either encrypt them in the store or never have them touch the store (encrypted or otherwise). Mutable state like database contents, including their password databases, don't go in the Nix store either.
alias_neo 5y ago
Thanks I'll have a read through it, I can lots of uses for this already!

foolmeonce 5y ago

With nixops you also define define your configurations in nix (and can have interdependencies between them) then start machines or virtual machines as blank nixos installs and add their ssh key and address for nixops to reconfigure and manage. I ultimately find it easier to have one host that is keeping track of all configurations and pushing my changes to all hosts since I otherwise end up with a lot of machines with different changes I've been working on.