5 ms·

Crazy thing about NixOS is that it's so good, all the bad parts can be excused. I like to go on forums and complain about how the Nix configuration language is

by tinco 5y ago

Crazy thing about NixOS is that it's so good, all the bad parts can be excused. I like to go on forums and complain about how the Nix configuration language is horrible, and there's not much documentation on how to get general things done. But that said, I'm still running NixOS on my servers. And no way that I'd ever go back to old fashioned provisioning scripts like Ansible. Just yesterday I had a problem upgrading a machine that's been running for 3 years without updates, and it wouldn't upgrade to the latest version of NixOS because of some certificate issue I couldn't figure out. Tried a couple things, nothing worked, gave up and destroyed the box. Installed the latest version of NixOS on it, pulled my configuration from git and it's back online exactly how I want it. It runs 5 websites in docker containers with a reverse proxy that automatically gets its SSL certificates from Let's Encrypt, some other services, and a tmux session with irssi. Everything neatly managed by systemd through unit files, everything set up from one simple nixos configuration. If I'm complaining about NixOS, it's because the best server operating system in existence right now has flaws. Not because I'd ever go back to a traditional linux distribution.

m45t3r 5y ago
> Crazy thing about NixOS is that it's so good, all the bad parts can be excused. I like to go on forums and complain about how the Nix configuration language is horrible, and there's not much documentation on how to get general things done. I don't think it is fair to say that Nix as a programming language is horrible, IMO, as a DSL it is pretty good and fits the domain well. It is a strange language at first and it takes some time to learn all its quirks. Also, it lacks better tooling, things like LSP for example (there is one but it is slow and limited last time I tried). But just claiming the language is "horrible" is really unfair.
- easygenes 5y ago
  rnix-lsp is decent these days: https://github.com/nix-community/rnix-lsp https://github.com/nix-community/rnix-lsp
  - m45t3r 5y ago
    This is exactly what I meant with "there is one but it is slow and limited last time I tried", but it does seem that they made good progress (the last time I tried it was some months ago). Time to try it again.
    - m45t3r 5y ago
      BTW, thanks @easygenes. It is really much better nowadays (that goes to show how fast Nix/NixOS is improving).
      - pxc 5y ago
        Thanks for following up, which makes your earlier comments more useful for folks wondering about the present state of things
- mindslight 5y ago
  The semantics are great and necessary for Nix, but the syntax sucks. But syntax is the Afghanistan of programming languages, and all that.
- eximius 5y ago
  I think it's fair. It is, by far, the biggest hurdle to adoption and contributions. I'm a SWE and I don't grok it yet. Granted, I haven't spent a ton of time on it. But if you have to spend a ton of time on it, it has in some sense failed. It's harder to learn than literally any other language I can think of that isn't designed specifically to be esoteric. Most languages, after you have picked up a few, you can just glance at and you've got the basics. Nix is its own beast entirely. Edit: I do acknowledge that there is some difficult to manage inherent complexity. And, like many others, I love what Nix is trying to be. But I do think improving the language would be a big step.
  - jml7c5 5y ago
    In my experience, the biggest problems for learning Nix (the language) are the lack of type annotations and the tendency to separate function calls from function arguments. The first time you look in `my-package.nix` you find... a dict of function arguments? I think? What the heck? What function takes these arguments? What function arguments are valid? So you end up grepping the whole source tree for `"./my-package.nix"` just to see what functions are using it, and you find this construct: someFunction ./my-package.nix Which in other languages would be the slightly bizarre some_function( eval_file( "./my-package.foolang" ) ) So you're pretty sure these are arguments to someFunction, but it's weird that the call to `someFunction` wasn't in the same file, because it makes it hard to know what's going on. All of this this wouldn't be so unclear if the syntax wasn't visually similar yet semantically different from most languages. The map syntax in particular looks exactly like a block in curly brace imperative languages: { foo = "blah"; bar = foo + "blahblah"; } ---- Fortunately, there's work to separate Nix (the tool) from Nix (the language), so that any configuration language can be used to produce derivations. Nickel has been one of the drivers of this push: https://discourse.nixos.org/t/nickel-the-nix-language-spin-off/9592 https://discourse.nixos.org/t/nickel-the-nix-language-spin-o... https://github.com/tweag/nickel/issues/93 https://github.com/tweag/nickel/issues/93
  - ris 5y ago
    > I'm a SWE and I don't grok it yet. I think the biggest difficulty most people have is that it's a pure functional language, and that is quite foreign to a lot of people, even many SWEs. It's something that's not going to change though because it's a fundamental part of why Nix works so well.
- whateveracct 5y ago
  The Nix language is excellent imo Better than so many I use professionally
easygenes 5y ago
Yeah, I'm just waiting for Jeff Geerling to get onboard with Nix. Then things will get interesting (he's a big Ansible buff and probably the biggest RasPi Youtuber).
vlunkr 5y ago
The fact that instead of upgrading, you had to wipe and restart doesn't seem like a very compelling argument for NixOS.
- exitheone 5y ago
  I think the important thing that did not come across very well is that "wipe and reinstall" with nix is so incredibly painless that doing it is even an option. The same would be very very painful with other distributions. A clean reinstall of your whole system with nixos takes maybe 30 minutes. Compare with the average "my Ubuntu upgrade failed" debugging session...
  - easygenes 5y ago
    Yes, and speaking of… the fact that “generations” are a central feature which allows seamless rollbacks to previous system states means that if your upgrade fails you’re hardly ever more than a few minutes away from a functional system again.
- bogwog 5y ago
  I disagree. I don't use Nix, but I've been in situations before where an upgrade either couldn't complete, or catastrophically broke something. Those situations are horrible and can take hours or days to resolve. Having the option to say "fuck it" and just reinstall everything, without worrying about manually installing exact software versions and reconfiguring everything sounds amazing.
kvark 5y ago
Wait, isn't a point of NixOS is that your updates are guaranteed to be smooth? I haven't used it, but your story now worries me. I don't want to be back at "just reinstall the OS" days, even if configuration is portable.
- Ericson2314 5y ago
  > And it wouldn't upgrade to the latest version of NixOS because of some certificate issue This sounds like Lets Encrypt changing it's protocol. Nix itself doesn't give a shit about such things, but maybe some sort of script was supposed to double-check the cert on boot (just speculating). While NixOS can be reproduciable, whatever software Let's Encrypt runs is obviously outside the host's control, so perhaps "leap-frogging" to the latest NixOS somehow helped. This is incidentally a good example at why I am pretty against microservices (not saying Let's Encrypt is a bad or a microservice, but it is the analogue of one in this parable).
  - tinco 5y ago
    I couldn't figure out what it was, but it was definitely a problem with NixOS itself, possibly with expired root certificates or something like that. The upgrade command couldn't connect to the nixos servers. I know there was at least one root certificate that expired in the past 3 years, so maybe I just caught a bad interval for not upgrading.
- 0xCMP 5y ago
  With a cloud server it's obviously less of an issue, but even with a desktop for Nix its less of an issue than any other distro. Each time you update your configuration it's essentially reinstalling. When you boot you have the option to boot the previous version (which includes previous app versions and etc). Reinstalling NixOS and updating it are extremely similar actions except for full reinstalls having data loss (formatting) and taking longer (cache is empty).
- tinco 5y ago
  On NixOS installing any package is the same as reinstalling the operating system. Reinstalling the operating system just took a minute longer because it had to do more downloading. (edit: in theory, I actually bet that the certificates sneakily leak mutable state into the system with the expiry process, i.e. I bet that if I reinstalled the same version of NixOS with the same configuration, I'd get an install that would actually be able to talk to the nixos package servers) But you're right to be worried a little bit, and this is exactly why many people criticize NixOS. In theory it's the most perfect operating system, but in practice it's so complicated that when something's bugged it's really hard to figure out how to recover, and the documentation is not up to the task of educating you on what to do when things are wrong. Also this situation was a bit special because it couldn't talk to the NixOS servers for upgrading (I presume due to an expired root certificate, but I couldn't figure it out), if it was any other problem, I could simply roll back the upgrade process (which would be instantaneous because it doesn't actually remove the old packages when you upgrade).
hda111 5y ago
When you use Docker you probably don’t configure your websites using Nix so there is no deterministic build happening here? In Ansible it’s just a few lines of code to start a Docker container. I’m not sure how Nix really helps here.
- tinco 5y ago
  In Nix it's also just a few lines to start a Docker container. I might be considered a heretic by the Nix community, but I don't believe in the advantages of Nix for software development / application configuration. Docker is the end all solution to that problem in my opinion.

by tinco 5y ago

m45t3r 5y ago

> Crazy thing about NixOS is that it's so good, all the bad parts can be excused. I like to go on forums and complain about how the Nix configuration language is horrible, and there's not much documentation on how to get general things done. I don't think it is fair to say that Nix as a programming language is horrible, IMO, as a DSL it is pretty good and fits the domain well. It is a strange language at first and it takes some time to learn all its quirks. Also, it lacks better tooling, things like LSP for example (there is one but it is slow and limited last time I tried). But just claiming the language is "horrible" is really unfair.

easygenes 5y ago
rnix-lsp is decent these days: https://github.com/nix-community/rnix-lsp https://github.com/nix-community/rnix-lsp
- m45t3r 5y ago
  This is exactly what I meant with "there is one but it is slow and limited last time I tried", but it does seem that they made good progress (the last time I tried it was some months ago). Time to try it again.
  - m45t3r 5y ago
    BTW, thanks @easygenes. It is really much better nowadays (that goes to show how fast Nix/NixOS is improving).
    - pxc 5y ago
      Thanks for following up, which makes your earlier comments more useful for folks wondering about the present state of things
mindslight 5y ago
The semantics are great and necessary for Nix, but the syntax sucks. But syntax is the Afghanistan of programming languages, and all that.
eximius 5y ago
I think it's fair. It is, by far, the biggest hurdle to adoption and contributions. I'm a SWE and I don't grok it yet. Granted, I haven't spent a ton of time on it. But if you have to spend a ton of time on it, it has in some sense failed. It's harder to learn than literally any other language I can think of that isn't designed specifically to be esoteric. Most languages, after you have picked up a few, you can just glance at and you've got the basics. Nix is its own beast entirely. Edit: I do acknowledge that there is some difficult to manage inherent complexity. And, like many others, I love what Nix is trying to be. But I do think improving the language would be a big step.
- jml7c5 5y ago
  In my experience, the biggest problems for learning Nix (the language) are the lack of type annotations and the tendency to separate function calls from function arguments. The first time you look in `my-package.nix` you find... a dict of function arguments? I think? What the heck? What function takes these arguments? What function arguments are valid? So you end up grepping the whole source tree for `"./my-package.nix"` just to see what functions are using it, and you find this construct: someFunction ./my-package.nix Which in other languages would be the slightly bizarre some_function( eval_file( "./my-package.foolang" ) ) So you're pretty sure these are arguments to someFunction, but it's weird that the call to `someFunction` wasn't in the same file, because it makes it hard to know what's going on. All of this this wouldn't be so unclear if the syntax wasn't visually similar yet semantically different from most languages. The map syntax in particular looks exactly like a block in curly brace imperative languages: { foo = "blah"; bar = foo + "blahblah"; } ---- Fortunately, there's work to separate Nix (the tool) from Nix (the language), so that any configuration language can be used to produce derivations. Nickel has been one of the drivers of this push: https://discourse.nixos.org/t/nickel-the-nix-language-spin-off/9592 https://discourse.nixos.org/t/nickel-the-nix-language-spin-o... https://github.com/tweag/nickel/issues/93 https://github.com/tweag/nickel/issues/93
- ris 5y ago
  > I'm a SWE and I don't grok it yet. I think the biggest difficulty most people have is that it's a pure functional language, and that is quite foreign to a lot of people, even many SWEs. It's something that's not going to change though because it's a fundamental part of why Nix works so well.
whateveracct 5y ago
The Nix language is excellent imo Better than so many I use professionally

easygenes 5y ago

Yeah, I'm just waiting for Jeff Geerling to get onboard with Nix. Then things will get interesting (he's a big Ansible buff and probably the biggest RasPi Youtuber).

vlunkr 5y ago

The fact that instead of upgrading, you had to wipe and restart doesn't seem like a very compelling argument for NixOS.

exitheone 5y ago
I think the important thing that did not come across very well is that "wipe and reinstall" with nix is so incredibly painless that doing it is even an option. The same would be very very painful with other distributions. A clean reinstall of your whole system with nixos takes maybe 30 minutes. Compare with the average "my Ubuntu upgrade failed" debugging session...
- easygenes 5y ago
  Yes, and speaking of… the fact that “generations” are a central feature which allows seamless rollbacks to previous system states means that if your upgrade fails you’re hardly ever more than a few minutes away from a functional system again.
bogwog 5y ago
I disagree. I don't use Nix, but I've been in situations before where an upgrade either couldn't complete, or catastrophically broke something. Those situations are horrible and can take hours or days to resolve. Having the option to say "fuck it" and just reinstall everything, without worrying about manually installing exact software versions and reconfiguring everything sounds amazing.

kvark 5y ago

Wait, isn't a point of NixOS is that your updates are guaranteed to be smooth? I haven't used it, but your story now worries me. I don't want to be back at "just reinstall the OS" days, even if configuration is portable.

Ericson2314 5y ago
> And it wouldn't upgrade to the latest version of NixOS because of some certificate issue This sounds like Lets Encrypt changing it's protocol. Nix itself doesn't give a shit about such things, but maybe some sort of script was supposed to double-check the cert on boot (just speculating). While NixOS can be reproduciable, whatever software Let's Encrypt runs is obviously outside the host's control, so perhaps "leap-frogging" to the latest NixOS somehow helped. This is incidentally a good example at why I am pretty against microservices (not saying Let's Encrypt is a bad or a microservice, but it is the analogue of one in this parable).
- tinco 5y ago
  I couldn't figure out what it was, but it was definitely a problem with NixOS itself, possibly with expired root certificates or something like that. The upgrade command couldn't connect to the nixos servers. I know there was at least one root certificate that expired in the past 3 years, so maybe I just caught a bad interval for not upgrading.
0xCMP 5y ago
With a cloud server it's obviously less of an issue, but even with a desktop for Nix its less of an issue than any other distro. Each time you update your configuration it's essentially reinstalling. When you boot you have the option to boot the previous version (which includes previous app versions and etc). Reinstalling NixOS and updating it are extremely similar actions except for full reinstalls having data loss (formatting) and taking longer (cache is empty).
tinco 5y ago
On NixOS installing any package is the same as reinstalling the operating system. Reinstalling the operating system just took a minute longer because it had to do more downloading. (edit: in theory, I actually bet that the certificates sneakily leak mutable state into the system with the expiry process, i.e. I bet that if I reinstalled the same version of NixOS with the same configuration, I'd get an install that would actually be able to talk to the nixos package servers) But you're right to be worried a little bit, and this is exactly why many people criticize NixOS. In theory it's the most perfect operating system, but in practice it's so complicated that when something's bugged it's really hard to figure out how to recover, and the documentation is not up to the task of educating you on what to do when things are wrong. Also this situation was a bit special because it couldn't talk to the NixOS servers for upgrading (I presume due to an expired root certificate, but I couldn't figure it out), if it was any other problem, I could simply roll back the upgrade process (which would be instantaneous because it doesn't actually remove the old packages when you upgrade).

hda111 5y ago

When you use Docker you probably don’t configure your websites using Nix so there is no deterministic build happening here? In Ansible it’s just a few lines of code to start a Docker container. I’m not sure how Nix really helps here.

tinco 5y ago
In Nix it's also just a few lines to start a Docker container. I might be considered a heretic by the Nix community, but I don't believe in the advantages of Nix for software development / application configuration. Docker is the end all solution to that problem in my opinion.