infra
NixOS definitions for the m1ng.space machines, plus an inventory verified over SSH. A service is a module, and a host is the list of services it runs plus its hardware.
The problem
What is running drifts away from what is written down. The aim is definitions that can build a host from a blank disk, and an inventory that records what is really there, including where it differs.
How it works
- Each host is composed from service modules, and every host has a VM-based composition test plus an install rehearsal from a blank disk.
- Secrets are sops files encrypted for an admin age key and for each host’s SSH host key.
- DNS records are generated from the same site definition that describes the hosts.
- The inventory records what the live machines run and how they differ from the target definitions. Every entry says how and when it was verified, and unverified items say so.
- The live machines are not yet migrated to the NixOS definitions, and the repository says that openly.
Built with
- NixOS
- Nix flakes
- sops
- age
- Linux