nixfiles VS dotfiles

If you're familiar with Python, I have a script which does that (along with a few other metrics): https://github.com/barrucadu/nixfiles/blob/1c99414156a7081ade210a9f43a3941b44a4ef0b/hosts/nyarlathotep/jobs/hledger-export-to-promscale.py

I run a lot of services through docker containers, here's how I structure things: https://github.com/barrucadu/nixfiles/blob/master/services/concourse.nix

I do. I have a fairly small chunk of configuration to stick all persistent state I care about in a different ZFS dataset (mounted to /persist) and do the rollback.

It's what I do.

You can see the relevant bit of my config on github.

My solution - which is not great, mind you - is to have my NixOS config defined across two git repos: one is public, the other is private and has all the secrets.

All my nixos config is on github.

I daily-drive it with ZFS on the root partition, and roll back using snapshots. All state is persisted to /nix/state (again /nix is ZFS with atime=off for speed), and important files are all stored in /data. You can find the complete configuration for it here and the partition script here. This is done using the extremely handy impermanence Module

I use BTRFS, and have created a separate subvolume for /home, and take automatic snapshots using btrbk (my config) Also, I did not face any problems with the SSD till now (using TMPFS on /)

This is one of the best answers I've ever seen. Thanks a lot!! Also to OP, if you decide on using home-manager as a NixOS Module, then you can have a look at my config, it does exactly that, and it is simple to understand (I am a beginner as well)