> And it wouldn't upgrade to the latest version of NixOS because of some certificate issue This sounds like Lets Encrypt changing it's protocol. Nix itself doe

> And it wouldn't upgrade to the latest version of NixOS because of some certificate issue This sounds like Lets Encrypt changing it's protocol. Nix itself doesn't give a shit about such things, but maybe some sort of script was supposed to double-check the cert on boot (just speculating). While NixOS can be reproduciable, whatever software Let's Encrypt runs is obviously outside the host's control, so perhaps "leap-frogging" to the latest NixOS somehow helped. This is incidentally a good example at why I am pretty against microservices (not saying Let's Encrypt is a bad or a microservice, but it is the analogue of one in this parable).