nixcfg VS nixfiles

Go to https://nixos.org/ and come to your own conclusion. I've argued with hundreds of people about this, and I don't want to start again. Just have fun! For one thing, every machine I have is defined as infrastructure as code here, and it's reproducible https://github.com/matthewcroughan/nixcfg. That's impressive. If you don't think so, then you probably don't need Nix, and may not appreciate what it does. You can read the Nix Thesis https://edolstra.github.io/pubs/phd-thesis.pdf if you want more of a technical understanding. I also recommend reading http://www.infrastructures.org/papers/turing/turing.html for a background on why reproducibility matters and congruency matters.

In this example, nixcfg is my Nix code (therefore my whole configuration) from https://github.com/matthewcroughan/nixcfg

If you're familiar with Python, I have a script which does that (along with a few other metrics): https://github.com/barrucadu/nixfiles/blob/1c99414156a7081ade210a9f43a3941b44a4ef0b/hosts/nyarlathotep/jobs/hledger-export-to-promscale.py

I run a lot of services through docker containers, here's how I structure things: https://github.com/barrucadu/nixfiles/blob/master/services/concourse.nix

I do. I have a fairly small chunk of configuration to stick all persistent state I care about in a different ZFS dataset (mounted to /persist) and do the rollback.

It's what I do.

You can see the relevant bit of my config on github.

My solution - which is not great, mind you - is to have my NixOS config defined across two git repos: one is public, the other is private and has all the secrets.

All my nixos config is on github.