colmena VS impermanence

- rpi nas

I also wipe my entire rootfs every boot with a zfs snapshot rollback[2] using the impermanence module[3] to keep specific stateful data one one of two datasets with regular snapshots: one is backed up with zfs send, the other is just for cache between reboots.

It took a little puzzling to get started, because I didn’t know about the impermanence module, so I built my own hacky solution. But I really love this setup. And the way I don’t have cruft to clean.

Also my backups are so much smaller now :’-)

[1]: https://colmena.cli.rs/

Answering your broader question (secret management) colmena does that for me outside the Nix store. I also use git-crypt to store secrets in the repo. There are also more Nix-y alternatives like agenix.

There are 4 tools I'm taking into consideration right now, but every suggestion is welcome: 1. deploy-rs - I don't know anything about it, heard about it like a day or two ago 2. NixOps - the official one, I don't know what to think, but I have concerns about Flakes compatibility 3. morph - I understand this as "NixOps, but better", no more toughs. 4. colmena - seems to be pretty straightforward with quite nice docs

They shouldn't be, Colmena stringifies the keyFile values which is the same approach as NixOps uses to avoid this. Apparently I implemented that part myself, haha.

I myself use colmena's apply-local. Anyway, totally relate to the meme. Using the same tool to manage your servers and workstations, and reusing stuff between them is amazing.

You might want to set up NixOS with impermanence, with something like https://github.com/nix-community/impermanence. Install an easy to use desktop environment like ElementaryOS, and configure NixOS with or without Flatpak, if you want to give the user the ability to install new software or not. Then set up automatic updates, automatic garbage collection and you have a truly stable system.

I would not call these projects unbelievable, but they are neat.

- Opt-in state: https://github.com/nix-community/impermanence and https://grahamc.com/blog/erase-your-darlings/

That way will work - I use the impermanence module which works similarly but allows to hide mounts.

This is indeed a blind spot. Thanks for pointing that out! Silverblue -to my knowledge- doesn't do a lot to address this. Though, 3rd-party tools like Home Manager and the suite of applications developed by the folks over at uBlue might be able to limit this to a minimum. Though I'm not sure if it surpasses NixOS in this regard; for the uninitiated. Though, to my knowledge, this requires special attention and depends on the specifics of the NixOS system in question.

[3]: https://github.com/nix-community/impermanence

I have recently stumbled upon Impermanence - modules to help you handle persistent state on systems with ephemeral root storage, and the concept seems quite nice.

I haven't used it yet but nix-community/impermanence has a home-manager module that might be useful.

Some files in /etc (like saved networks) will still not be managed by NixOS, if you want to have full control over them use Impermanence

{ imports = [ (modulesPath + "/installer/scan/not-detected.nix") "${builtins.fetchGit { url = "https://github.com/NixOS/nixos-hardware.git"; }}/system76" "${builtins.fetchGit { url = "https://github.com/nix-community/impermanence.git"; }}/nixos.nix" ];