harbormaster VS nixos-infect

I use an HP ProLiant Microserver with four drives in a ZFS RAIDZ array and an SSD for the OS. For software, I mostly run it in Docker using a very small container orchestration program I wrote:

https://gitlab.com/stavros/harbormaster

I needed something that would restart containers automatically when I pushed to a branch, so I wrote a few lines of code to do it:

https://gitlab.com/stavros/harbormaster

As far as PaaSes go, it's probably the simplest, and works really well.

I was in the same boat as you and built something simple that I really like:

https://gitlab.com/stavros/harbormaster

It'll just pull some repos, make sure the containers are up, and make your configuration simple and discoverable. It really works great at that.

I do this for our services, it works great and we can easily put SSO in front of them with CF Access. I publish a Docker container that you can use as a sidecar for your Compose deployments:

https://gitlab.com/stavros/docker-cloudflared

I use this with Harbormaster (https://gitlab.com/stavros/harbormaster) so I can expose containerized stuff without ever forwarding any ports outside of Docker.

I use Dokku for that (I can share my Bitwarden repo if you want, the entire thing is four lines or something). I also made https://gitlab.com/stavros/harbormaster for things that weren't so "web server -> app -> database" and love it.

I had the same problem and didn't want to manage things by hand, so I wrote Harbormaster:

https://gitlab.com/stavros/harbormaster

It basically pulls Compose apps from the git repositories you specify, builds the containers and makes sure they're running. Pretty simple and works really well for me.

(This post should read "Argo tunnel" instead of just "Argo")

I did the same to enable secure access to services via SSO at work. I used Harbormaster[1] to deploy Compose files, but it's otherwise the same setup.

One of the big advantages this has is that the services can't be accessed any other way (not even from the same host, as they only listen inside the Docker network). That makes it hard to forget some port exposed because you listened to 0.0.0.0 instead of localhost.

Cloudflare access is very easy to set up SSO with, as well. I'd recommend this setup if you need it, though for home usage I usually just set up Caddy as a reverse proxy with basic auth, as I'll be the only person using this and I don't want Cloudflare MITMing my personal stuff.

[1]: https://gitlab.com/stavros/harbormaster

Something like harbormaster? https://gitlab.com/stavros/harbormaster

There is one solution I've seen being used to solve this issue.

It is to overwrite the current Linux OS with the one you want. I came across this idea here [0]. I researched and got Alpine Linux running on Hetzner (even they don't support custom images) using a similar method [1].

This seems to be the guide to do the same with Arch Linux [2], I'm not sure though.

Once you do create a successful Arch image on OVH, take a snapshot of the machine before installing anything else, in case you want to start from a fresh Arch image in the future.

[0] https://github.com/elitak/nixos-infect

[1] https://wiki.alpinelinux.org/wiki/Replacing_non-Alpine_Linux...

[2] https://wiki.archlinux.org/title/Install_Arch_Linux_from_exi...

Related:

https://www.reddit.com/r/NixOS/comments/u5gi6e/whats_a_good_...

https://github.com/elitak/nixos-infect

In my experience, the initial learning curve is "way steep" due to incomplete learning resources, the community being split on flakes (I'm not jumping on them yet because I'm sticking with the stable branch), and this one documentation gap in particular.

FWIW, I recently found a VPS offering for $1.41/month (!) @ 1.5GB RAM & 30GB HDD via https://lowendbox.com/, at https://my.racknerd.com/index.php?rp=/store/black-friday-202... (please note I have no idea how reliable it is though!). I managed to deploy NixOS there through nixos-infect (https://github.com/elitak/nixos-infect), and then further configure it with NixOps. That said, using NixOps does currently require a Linux (or Mac, probably) box as the managing one, and some Nix-fu, which is definitely non-trivial. A draft (WIP) writeup on that, if you're interested: https://github.com/akavel/scribbles/blob/main/_drafts/202308...

Those Linode instructions are about installing an OS from an installation ISO from Linode's rescue mode. -- I'd consider that more a 'plus' to Linode that you get to be able to install whatever unsupported Linux on Linode's VMs. But, of course it's not as smooth as the officially supported images.

Sibling comment mentions that NixOS provides ways to build VM images (e.g. https://github.com/nix-community/nixos-generators has a generator specifically for Linode).

Another option is to use nixos-infect, which will replace a Linux distribution with a NixOS distribution. https://github.com/elitak/nixos-infect

> At that point, I feel like all of the repeatability gains are gone. If I want to spin up a fresh server, I have to read a guide and set stuff up by hand?

Just as with ansible, "git pull to deploy". You'd keep a copy of your NixOS configuration.nix somewhere else, and would be able to apply it later.

> it really does let me just get a new VPS and deploy to it very fast

Using a tool you're familiar with to get the job done is going to be faster than learning to use a tool you're unfamiliar with.

I believe much of the use of NixOS is for hobby stuff, and for personal machines. (c.f. "In what environments do you use Nix", Development (1242) vs Home Server (845) vs Production (386) https://discourse.nixos.org/t/2022-nix-survey-results/18983).

for NixOS

Now that you both mention it though, I probably could've skipped the "Boot into the installer" step. I know nixos-infect can install in-place. I havent checked how they do it, but a lighter version that just adds nixos should be pretty easy using ZFS. It probably would've been possible for me to do replace the installer steps with something along the lines of:

You can execute nixos-rebuild on other distros but the NixOS modules and activation scripts expect it to run on NixOS system so it probably will not work (e.g. NixOS would want to control systemd, which would conflict with the distro). And if it did, you would no longer have the other distro but NixOS (see also nixos-infect).