5 ms·

I would love to see NixOS-style declarative management brought to one (or more) of the BSDs. I'm currently building out a NixOS-based router to replace an old

I would love to see NixOS-style declarative management brought to one (or more) of the BSDs. I'm currently building out a NixOS-based router to replace an old and dying Ubiquiti Edgerouter Lite. BSD would be perfect for the job but the ability of NixOS to have the entire system configured declaratively is enough of a killer feature to get me to use it over something BSD-based. if anyone is interested in pursuing something similar, I'm using [0] as my hardware base and [1, 2] as example configurations. 0: https://amazon.com/QOTOM-celeron-Processor-Fanless-pfSense/dp/B01CSCGJ7A https://amazon.com/QOTOM-celeron-Processor-Fanless-pfSense/d... 1: https://francis.begyn.be/blog/nixos-home-router https://francis.begyn.be/blog/nixos-home-router 2: https://github.com/stanipintjuk/nixos-router https://github.com/stanipintjuk/nixos-router

1MachineElf 5y ago
>I would love to see NixOS-style declarative management brought to one (or more) of the BSDs. In theory, an OpenBSD NSH configuration would have a large overlap of features and functionality with the Nix-based router configuration you've been working on. Btw, NSH allows one to configure OpenBSD in a similar CLI shell as that of a Cisco, ProCurve, or similar device. The shell commands make up a configuration file that can be exported / imported. NixOS & BSD is something I thought of but hadn't mentioned when someone recently submitted[0] a link to NSH. Coincidentally, another user brought up NixOS as a potential solution, only for the comment to trigger some friction[1]. I've been dreaming about more integration between Nix and BSD for a while now, but unfortunately, my skills and knowledge to actually implement something like this are nowhere close to where they need to be to actually create anything in this vein. That being said, there are others who have done more, and so Nix is available on FreeBSD[2]. Nix on FreeBSD has a long way to go before it's as useful as it is on Linux/macOS - the latest discussion on it is in the NixOS Discourse forum[3]. Appreciate you linking to the blog post and GitHub repo for nixos-router. FYI, one other option available for Linux is the Debian-based VyOS[4] which provides a familiar command-line interface like OpenBSD NSH. [0] https://news.ycombinator.com/item?id=30942489 https://news.ycombinator.com/item?id=30942489 [1] https://news.ycombinator.com/item?id=30966266 https://news.ycombinator.com/item?id=30966266 [2] https://www.freshports.org/sysutils/nix/ https://www.freshports.org/sysutils/nix/ [3] https://discourse.nixos.org/t/status-of-freebsd/17786 https://discourse.nixos.org/t/status-of-freebsd/17786 [4] https://vyos.net/ https://vyos.net/
- xarope 5y ago
  If I may ask, how is vyos in terms of functionality? I'm more than comfortable with cli (have worked with cisco/hp/arista routers and firewalls before).
  - xaerise 5y ago
    Ubiquiti is using VyOS or Vyetta on Edgemax series.
infogulch 5y ago
I'll be setting up this 2.5GbE fanless box [1] as a router soon and this looks cool, maybe I'll test it out. NixOS' killer feature for routers/firewalls is probably how easy it is to revert to the previous configuration if something breaks during an upgrade. Some people even run their firewall in a VM so they can try out different configurations without worrying about bricking their main one, but that whole concern is nixed (pun intended) with the way NixOS works. [1]: https://www.amazon.com/gp/product/B09PHHVWZ8/ref=ppx_yo_dt_b_asin_title_o00_s00?ie=UTF8&th=1 https://www.amazon.com/gp/product/B09PHHVWZ8/ref=ppx_yo_dt_b...
- gh02t 5y ago
  Do any of these mini PCs have rack mount options/kits available? It seems like all the affordable+low power opn/pfsense boxes don't have options for rack mount other than plopping them on a shelf. Even the official ones from Netgate, their rack mountable routers start at a much higher price and performance point than I need but I really want everything tidy in my existing rack.
  - deno 5y ago
    Search “firewall + 1U” on Aliexpress/Alibaba. Or, hear me out, get a NanoPI R4S and just mount it to the side of the enclosure, get rid of the shelf altogether. No shelf no problem. Next level aesthetics ;)
vngzs 5y ago
You can write Chef targeting OpenBSD and run it in local mode. Get to use plain Ruby instead of a hodgepodge functional programming language. NixOS modules tend to be more "batteries included" than your average Chef cookbook, but if you stick to using native Chef resources you get something (pseudo-)declarative and powerful. Disclaimer: I use NixOS every day and I love functional programming. But boy do I wish Nix had picked Haskell, OCaml, or Lisp instead of inventing a programming language.
- dr-neptune 5y ago
  Have you considered GNU Guix? It's modeled after nix but uses guile as a configuration language: https://guix.gnu.org/ https://guix.gnu.org/ I also used nix for a while and found the transition painless on my non-nvidia machine
  - grawp 5y ago
    Heavy Nix user here. Since month two I've been using flakes for everything: In projects to holds packages and devshells together with inputs locked via lock files, for holding system configuration, raspberry pi images, nixpkgs overlays etc.. Does GUIX have some similiar thing which can provide a standard formal structure and lock resouces? Thx.
    - LanternLight83 5y ago
      Not that I know of, but ideas continue to trickle down, so I look forward to a reimplemention for Guix in the future. Something like nix-index would be great too, but all in due time, as the project admittedly doesn't have quite as many resources. edit: to be clear, I'm taking about flakes, Guix does have plenty of mechanisms and utilities regarding direnv-esque project manifests, lockfiles, and even "inferiors" which let you install outdated packages that the distribution has otherwise moved on from by actually building and using the version of guix that the package would have been built with at the time
  - anthk 5y ago
    I guess it's an Intel iGPU. Radeon it's worse than Nouveau, the first one depends on semi free drivers... with non-free firmware.
senorsmile 5y ago
I also use a qotom box for my main router. It runs arch and is 100% automated via Ansible. I have recently taken the deep dive into Nix and installed nixos on my main laptop. I have much to learn but am considering things like replacing the router with Nixos now too. Thanks for the links!
breakds 5y ago
My router is also a pretty old Intel Nuc running NixOS (https://github.com/breakds/nixos-routers/blob/main/machines/welderhelper/router.nix https://github.com/breakds/nixos-routers/blob/main/machines/...). It has been very smooth and easy to maintain.
alberth 5y ago
> Nix-style declaration to BSD. This, a million times over please! FreeBSD has nix the package manager. I too would love if all of FreeBSD was declarative.
- drewg123 5y ago
  How big is the ecosystem of packages available via nix on FreeBSD?
zie 5y ago
Nix on FreeBSD: https://www.freshports.org/sysutils/nix/ https://www.freshports.org/sysutils/nix/
cwp 5y ago
Back in the day I had some dealings with Joyent, and I pitched them on Nix for SmartOS. I couldn't get them to take me seriously, because they were old-school Unix heads, but damn that would have been a great system. Define a zone with a Nix derivation, the Nix Daemon installs all its dependencies into a shared Nix store, which then gets mounted read-only into all the zones. It would have eliminated all the copying things around they were doing with pkgsrc, speculatively installing a bunch of stuff in case you need it, Manta etc. Alas!

1MachineElf 5y ago

>I would love to see NixOS-style declarative management brought to one (or more) of the BSDs. In theory, an OpenBSD NSH configuration would have a large overlap of features and functionality with the Nix-based router configuration you've been working on. Btw, NSH allows one to configure OpenBSD in a similar CLI shell as that of a Cisco, ProCurve, or similar device. The shell commands make up a configuration file that can be exported / imported. NixOS & BSD is something I thought of but hadn't mentioned when someone recently submitted[0] a link to NSH. Coincidentally, another user brought up NixOS as a potential solution, only for the comment to trigger some friction[1]. I've been dreaming about more integration between Nix and BSD for a while now, but unfortunately, my skills and knowledge to actually implement something like this are nowhere close to where they need to be to actually create anything in this vein. That being said, there are others who have done more, and so Nix is available on FreeBSD[2]. Nix on FreeBSD has a long way to go before it's as useful as it is on Linux/macOS - the latest discussion on it is in the NixOS Discourse forum[3]. Appreciate you linking to the blog post and GitHub repo for nixos-router. FYI, one other option available for Linux is the Debian-based VyOS[4] which provides a familiar command-line interface like OpenBSD NSH. [0] https://news.ycombinator.com/item?id=30942489 https://news.ycombinator.com/item?id=30942489 [1] https://news.ycombinator.com/item?id=30966266 https://news.ycombinator.com/item?id=30966266 [2] https://www.freshports.org/sysutils/nix/ https://www.freshports.org/sysutils/nix/ [3] https://discourse.nixos.org/t/status-of-freebsd/17786 https://discourse.nixos.org/t/status-of-freebsd/17786 [4] https://vyos.net/ https://vyos.net/

xarope 5y ago
If I may ask, how is vyos in terms of functionality? I'm more than comfortable with cli (have worked with cisco/hp/arista routers and firewalls before).
- xaerise 5y ago
  Ubiquiti is using VyOS or Vyetta on Edgemax series.

infogulch 5y ago

I'll be setting up this 2.5GbE fanless box [1] as a router soon and this looks cool, maybe I'll test it out. NixOS' killer feature for routers/firewalls is probably how easy it is to revert to the previous configuration if something breaks during an upgrade. Some people even run their firewall in a VM so they can try out different configurations without worrying about bricking their main one, but that whole concern is nixed (pun intended) with the way NixOS works. [1]: https://www.amazon.com/gp/product/B09PHHVWZ8/ref=ppx_yo_dt_b_asin_title_o00_s00?ie=UTF8&th=1 https://www.amazon.com/gp/product/B09PHHVWZ8/ref=ppx_yo_dt_b...

gh02t 5y ago
Do any of these mini PCs have rack mount options/kits available? It seems like all the affordable+low power opn/pfsense boxes don't have options for rack mount other than plopping them on a shelf. Even the official ones from Netgate, their rack mountable routers start at a much higher price and performance point than I need but I really want everything tidy in my existing rack.
- deno 5y ago
  Search “firewall + 1U” on Aliexpress/Alibaba. Or, hear me out, get a NanoPI R4S and just mount it to the side of the enclosure, get rid of the shelf altogether. No shelf no problem. Next level aesthetics ;)

vngzs 5y ago

You can write Chef targeting OpenBSD and run it in local mode. Get to use plain Ruby instead of a hodgepodge functional programming language. NixOS modules tend to be more "batteries included" than your average Chef cookbook, but if you stick to using native Chef resources you get something (pseudo-)declarative and powerful. Disclaimer: I use NixOS every day and I love functional programming. But boy do I wish Nix had picked Haskell, OCaml, or Lisp instead of inventing a programming language.

dr-neptune 5y ago
Have you considered GNU Guix? It's modeled after nix but uses guile as a configuration language: https://guix.gnu.org/ https://guix.gnu.org/ I also used nix for a while and found the transition painless on my non-nvidia machine
- grawp 5y ago
  Heavy Nix user here. Since month two I've been using flakes for everything: In projects to holds packages and devshells together with inputs locked via lock files, for holding system configuration, raspberry pi images, nixpkgs overlays etc.. Does GUIX have some similiar thing which can provide a standard formal structure and lock resouces? Thx.
  - LanternLight83 5y ago
    Not that I know of, but ideas continue to trickle down, so I look forward to a reimplemention for Guix in the future. Something like nix-index would be great too, but all in due time, as the project admittedly doesn't have quite as many resources. edit: to be clear, I'm taking about flakes, Guix does have plenty of mechanisms and utilities regarding direnv-esque project manifests, lockfiles, and even "inferiors" which let you install outdated packages that the distribution has otherwise moved on from by actually building and using the version of guix that the package would have been built with at the time
- anthk 5y ago
  I guess it's an Intel iGPU. Radeon it's worse than Nouveau, the first one depends on semi free drivers... with non-free firmware.

senorsmile 5y ago

I also use a qotom box for my main router. It runs arch and is 100% automated via Ansible. I have recently taken the deep dive into Nix and installed nixos on my main laptop. I have much to learn but am considering things like replacing the router with Nixos now too. Thanks for the links!

breakds 5y ago

My router is also a pretty old Intel Nuc running NixOS (https://github.com/breakds/nixos-routers/blob/main/machines/welderhelper/router.nix https://github.com/breakds/nixos-routers/blob/main/machines/...). It has been very smooth and easy to maintain.

alberth 5y ago

> Nix-style declaration to BSD. This, a million times over please! FreeBSD has nix the package manager. I too would love if all of FreeBSD was declarative.

drewg123 5y ago
How big is the ecosystem of packages available via nix on FreeBSD?

zie 5y ago

Nix on FreeBSD: https://www.freshports.org/sysutils/nix/ https://www.freshports.org/sysutils/nix/

cwp 5y ago

Back in the day I had some dealings with Joyent, and I pitched them on Nix for SmartOS. I couldn't get them to take me seriously, because they were old-school Unix heads, but damn that would have been a great system. Define a zone with a Nix derivation, the Nix Daemon installs all its dependencies into a shared Nix store, which then gets mounted read-only into all the zones. It would have eliminated all the copying things around they were doing with pkgsrc, speculatively installing a bunch of stuff in case you need it, Manta etc. Alas!