morph VS colmena

There are 4 tools I'm taking into consideration right now, but every suggestion is welcome: 1. deploy-rs - I don't know anything about it, heard about it like a day or two ago 2. NixOps - the official one, I don't know what to think, but I have concerns about Flakes compatibility 3. morph - I understand this as "NixOps, but better", no more toughs. 4. colmena - seems to be pretty straightforward with quite nice docs

All the configuration for the server is in the repo, and the NixOS machine is automatically built and deployed on every commit through GitHub Actions using Morph.

My scanner is a Brother ADS-1700w. The server is the smallest Hetzner Cloud instance (CX11) and costs me 3 Euro's a month. I use the OCRmyPDF to run optical character recognition. The server is running NixOS and is deployed using morph. Finally, I'm using healthchecks.io to let me know when the setup breaks.

Colmena is a tool to manage multiple NixOS systems. It is similar to NixOps but fancier in spirit. I am not sure about the size of its userbase, but I do not see many other alternatives to my liking except NixOps4 and deploy-rs. So far, I am happy with it, so is my team.

Therefore, using a multi-host NixOS deployment tool like colmena, we can manage multiple secrets files for different hosts and different environments in a familiar way. This makes auditing easier, and rotating secrets becomes a breeze.

- rpi nas

I also wipe my entire rootfs every boot with a zfs snapshot rollback[2] using the impermanence module[3] to keep specific stateful data one one of two datasets with regular snapshots: one is backed up with zfs send, the other is just for cache between reboots.

It took a little puzzling to get started, because I didn’t know about the impermanence module, so I built my own hacky solution. But I really love this setup. And the way I don’t have cruft to clean.

Also my backups are so much smaller now :’-)

[1]: https://colmena.cli.rs/

Answering your broader question (secret management) colmena does that for me outside the Nix store. I also use git-crypt to store secrets in the repo. There are also more Nix-y alternatives like agenix.

There are 4 tools I'm taking into consideration right now, but every suggestion is welcome: 1. deploy-rs - I don't know anything about it, heard about it like a day or two ago 2. NixOps - the official one, I don't know what to think, but I have concerns about Flakes compatibility 3. morph - I understand this as "NixOps, but better", no more toughs. 4. colmena - seems to be pretty straightforward with quite nice docs

They shouldn't be, Colmena stringifies the keyFile values which is the same approach as NixOps uses to avoid this. Apparently I implemented that part myself, haha.

I myself use colmena's apply-local. Anyway, totally relate to the meme. Using the same tool to manage your servers and workstations, and reusing stuff between them is amazing.