colmena VS deploy-rs

- rpi nas

I also wipe my entire rootfs every boot with a zfs snapshot rollback[2] using the impermanence module[3] to keep specific stateful data one one of two datasets with regular snapshots: one is backed up with zfs send, the other is just for cache between reboots.

It took a little puzzling to get started, because I didn’t know about the impermanence module, so I built my own hacky solution. But I really love this setup. And the way I don’t have cruft to clean.

Also my backups are so much smaller now :’-)

[1]: https://colmena.cli.rs/

Answering your broader question (secret management) colmena does that for me outside the Nix store. I also use git-crypt to store secrets in the repo. There are also more Nix-y alternatives like agenix.

There are 4 tools I'm taking into consideration right now, but every suggestion is welcome: 1. deploy-rs - I don't know anything about it, heard about it like a day or two ago 2. NixOps - the official one, I don't know what to think, but I have concerns about Flakes compatibility 3. morph - I understand this as "NixOps, but better", no more toughs. 4. colmena - seems to be pretty straightforward with quite nice docs

They shouldn't be, Colmena stringifies the keyFile values which is the same approach as NixOps uses to avoid this. Apparently I implemented that part myself, haha.

I myself use colmena's apply-local. Anyway, totally relate to the meme. Using the same tool to manage your servers and workstations, and reusing stuff between them is amazing.

deploy-rs

Deploy-rs is a great alternative. It works as wrapper on top of flakes, local (optionally, cross-) building and copying closures to target machine with activation:

https://github.com/serokell/deploy-rs

The SSH key I made for this uses yubikey authentication, and every time this opens a SSH connection it will ask for the key. There's some options you can add so multiple SSH sessions can use a single connection, but the current version isn't really working well with them (see e.g. https://github.com/serokell/deploy-rs/issues/106)

I haven't really been in the market for something like this in a long while, but NixOS solved a lot of my headaches when it comes to maintaining a VPS and I'd like to try giving this a shot again. I'm not really interested in cloud/microservice/docker/cluser/whatever, I just want to use something like deploy-rs with a single host and maybe a VPN service like tailscale. What sorts of providers would y'all recommend?

I've messed around with deploy.rs. Simple enough to know what's going on.

https://github.com/serokell/deploy-rs -- see: https://serokell.io/blog/deploy-rs

There are 4 tools I'm taking into consideration right now, but every suggestion is welcome: 1. deploy-rs - I don't know anything about it, heard about it like a day or two ago 2. NixOps - the official one, I don't know what to think, but I have concerns about Flakes compatibility 3. morph - I understand this as "NixOps, but better", no more toughs. 4. colmena - seems to be pretty straightforward with quite nice docs

deploy-rs is great for this as well