4 ms·

My advice? Go with OpenBSD. These are the folks that brought you the word 'hackathon', and OpenSSH. (Ever use ssh? Thank OpenBSD.) These are the folks that ac

My advice? Go with OpenBSD. These are the folks that brought you the word 'hackathon', and OpenSSH. (Ever use ssh? Thank OpenBSD.) These are the folks that actually bother to read not just a PR, but actual full codebases, just to make sure their pointers don't dangle. It's been years since the DevOps space was first told to prefer 'livestock' -- disposable, nearly-identical instances -- to pets -- long-lived customized instances and servers -- but as every farmer knows, if you have lots of sheep, the job is a lot easier if you have a sheepdog. Not quite a pet, but not cattle, either. OpenBSD is my sheepdog. It keeps my git repos, it runs my wireguard VPN, and it, above all the other systems I touch, is trusted. But trust is ultimately about people, not about systems. Systems get their trusthworthiness from their creators, the way the moon gets light from the sun. And in trustworthiness, the OpenBSD community has a breathtaking superpower: They can say no. They are good at saying no. Do you know how hard that is -- to have someone ask for a feature, and just tell them off? That's the hardest thing any manager ever has to do, and these guys are good at it. Rare, in FOSS space. These are the folks that are so good at saying 'no' that they ship with a literal actual bespoke copy of 'vi', that does exactly what it is supposed to, does not take packages, and also does not have a package manager pulling in raw github HEADs. (I love you, neovim, but you are so trusting!) OpenBSD has been around for most of my 20+ career in this industry and it's sort of always been this aggressively reliable paperweight of a distro. I'm never quite sure what to do with it (NixOS is my go-to for my workstations -- NixOS + Wayland + Sway + Alacritty + Neovim is as close to godliness as a user interface can come) but OpenBSD finds its uses, and in those uses, it is smooth and heavy and reliable, making it the perfect foil for the rest of my infra: For where NixOS is neurotic and brittle, OpenBSD is saturnine and malleable. I think of my infra as sort of being like a knife blade, with a glittering Nixos/Wayland/Neovim edge supported by a soft, heavy core of OpenBSD. If everything else breaks, so long as I have my OpenBSD instances, I can recover. One final word: At my end, I just finished upgrading my instance at openbsd.amsterdam; big shoutout to that amazing team for their incredible support. (Mischa, in particular, is a force of nature, and I am fan. ;D)

Datagenerator 5y ago
Thank you for writing this. Analogous to spinning wheels, the outside rotating very fast ( NixOS/Arch) and near the stable center we have several BSD's. FreeBSD for the excellent ZFS, OpenBSD for vital network functions, Wireguard etc. Cheers, happy donations to the BSD Foundation!
bpye 5y ago
OpenBSD is definitely the free OS than I enjoyed running the most. I now use NixOS for most of my server and VM uses because I really appreciate being able to trivially keep all the configuration state in version control. However when I ran OpenBSD on an old Chromebook I did really enjoy using it, I made a point of trying to use just the base system and aside from needing a web browser it was extremely usable. The documentation is universally good all the built in tools are well maintained. In the near future I’m gonna setup a separate firewall/router machine from my NixOS box and I think I’m going to use OpenBSD there too.
- undoware 5y ago
  I too have the nixos vs openbsd decision nibbling at me every time I spin something up. Here's what helps me decide: I simulate a disaster. Since I'm just me, I do it on paper (empirical ways are best but are also the most expensive, and in a pinch, a thought experiment can illuminate as well. Not always the same things, but light is light.) Try it -- open a scratch.txt and write about things that would happen, and then the things that would probably happen as a result of that. The one that often comes up for NixOS is "I lose network connectivity." While NixOS is phenomenal in its ability to roll changes back, the fact that I need a stable Internet connection in order to make any change whatsoever to the current config makes that little piece of CAT-8 a SPOF for any number of unexpected (and intuitively unrelated) matters, making the overall system hard to reason about. You can mitigate this by hosting your own NixOS channels, which is sort of the equivalent of hosting your own apt-get repo. But, as you might expect, that's actually a fair amount of extra work. So I don't, especially not on laptops, where space can (still) be limited. So, every time I do `home-manager switch` I need a viable network connection. This is especially galling if you (like me) manage most of your apps with Nix' `home-manager`. Think it through; Nix manages (say) your word processor; you want to change the font size in your word processor; you edit your home.nix and hit `home-manager switch`. But look at what this entails! My apartment building's fibre-optic cabling should never be a depenency on altering the font size in my word processor, but here I am. Ironically, for the sake of convenience. Now, none of this is to slag on NixOS. As I mentioned above, it's my favourite way to encounter reality. I'm typing this to you on NixOS right now. For me, the pros outweigh the cons. Provided, of course, I have something less brittle than NixOS to back me up, and for me, that means OpenBSD. I have an OpenBSD instance in the cloud and a break-glass procedure for getting into it. It backs up via another old-school friend, tarsnap. It hosts the git repos that contain my nixos and home-manager configs. If I can talk to it, I can simply zap my NixOS config onto some new edge device and be back up and running in no time. I also typically have a NUC running OpenBSD present as well, in case that apartment-building fibre gets troublesome (again,) but not at the moment, because my beloved PCEngines device has apparently become unstable under any OS. But when I get that OBSD NUC set (back) up, it will absolutely have a NixOS channel on it, and it will serve as a firewall, a SAN, serving NixOS channels to the edge devices. It will have an actual serial port and a password on a wax-sealed bit of paper in my fireproof safe. Because I think ahead, and that's what I need to get back up and running under the worst circumstances. I simply can't imagine a non-hardware-failure disaster that could take out an aggressively boring OpenBSD bastion instance. They are just relentless in their persistence. As I keep saying, NixOS and OpenBSD pair together like honey and mustard. Contrastive but unexpectedly delicious. Take-home: If you're building infra, try adding some OpenBSD to the mix. It can make the unrecoverable recoverable.

Datagenerator 5y ago

Thank you for writing this. Analogous to spinning wheels, the outside rotating very fast ( NixOS/Arch) and near the stable center we have several BSD's. FreeBSD for the excellent ZFS, OpenBSD for vital network functions, Wireguard etc. Cheers, happy donations to the BSD Foundation!

bpye 5y ago

OpenBSD is definitely the free OS than I enjoyed running the most. I now use NixOS for most of my server and VM uses because I really appreciate being able to trivially keep all the configuration state in version control. However when I ran OpenBSD on an old Chromebook I did really enjoy using it, I made a point of trying to use just the base system and aside from needing a web browser it was extremely usable. The documentation is universally good all the built in tools are well maintained. In the near future I’m gonna setup a separate firewall/router machine from my NixOS box and I think I’m going to use OpenBSD there too.

undoware 5y ago
I too have the nixos vs openbsd decision nibbling at me every time I spin something up. Here's what helps me decide: I simulate a disaster. Since I'm just me, I do it on paper (empirical ways are best but are also the most expensive, and in a pinch, a thought experiment can illuminate as well. Not always the same things, but light is light.) Try it -- open a scratch.txt and write about things that would happen, and then the things that would probably happen as a result of that. The one that often comes up for NixOS is "I lose network connectivity." While NixOS is phenomenal in its ability to roll changes back, the fact that I need a stable Internet connection in order to make any change whatsoever to the current config makes that little piece of CAT-8 a SPOF for any number of unexpected (and intuitively unrelated) matters, making the overall system hard to reason about. You can mitigate this by hosting your own NixOS channels, which is sort of the equivalent of hosting your own apt-get repo. But, as you might expect, that's actually a fair amount of extra work. So I don't, especially not on laptops, where space can (still) be limited. So, every time I do `home-manager switch` I need a viable network connection. This is especially galling if you (like me) manage most of your apps with Nix' `home-manager`. Think it through; Nix manages (say) your word processor; you want to change the font size in your word processor; you edit your home.nix and hit `home-manager switch`. But look at what this entails! My apartment building's fibre-optic cabling should never be a depenency on altering the font size in my word processor, but here I am. Ironically, for the sake of convenience. Now, none of this is to slag on NixOS. As I mentioned above, it's my favourite way to encounter reality. I'm typing this to you on NixOS right now. For me, the pros outweigh the cons. Provided, of course, I have something less brittle than NixOS to back me up, and for me, that means OpenBSD. I have an OpenBSD instance in the cloud and a break-glass procedure for getting into it. It backs up via another old-school friend, tarsnap. It hosts the git repos that contain my nixos and home-manager configs. If I can talk to it, I can simply zap my NixOS config onto some new edge device and be back up and running in no time. I also typically have a NUC running OpenBSD present as well, in case that apartment-building fibre gets troublesome (again,) but not at the moment, because my beloved PCEngines device has apparently become unstable under any OS. But when I get that OBSD NUC set (back) up, it will absolutely have a NixOS channel on it, and it will serve as a firewall, a SAN, serving NixOS channels to the edge devices. It will have an actual serial port and a password on a wax-sealed bit of paper in my fireproof safe. Because I think ahead, and that's what I need to get back up and running under the worst circumstances. I simply can't imagine a non-hardware-failure disaster that could take out an aggressively boring OpenBSD bastion instance. They are just relentless in their persistence. As I keep saying, NixOS and OpenBSD pair together like honey and mustard. Contrastive but unexpectedly delicious. Take-home: If you're building infra, try adding some OpenBSD to the mix. It can make the unrecoverable recoverable.