Hacker News Reader

Comment by euroclydon | Hacker News Reader

I built my router and NAS from NixOS. It was a mostly pleasant experience. Being able to sit in an IDE on my laptop, and build up a server, incrementally pushing changes to it, with rollback if necessary, was great, and I wouldn't want to go back to anything else.

I wrote about the router here. It's pretty heavy on router stuff, and my own thoughts though...

https://www.jjpdev.com/posts/home-router-nixos/

View on HN

Wow that is cool. I have been wanting to build both a router and a NAS and run nixos on them since I run nixos for everything else I do. Thanks for writing and sharing about your experience!

Excellent read, thank you! Just in time, I have been eyeing one of those tinyminimicro pcs to replace OpenWRT with Nix.

Could you share more details on push_to_router.sh? Is it a wrapper around calling nixos-rebuild through ssh?

Yes, although later I learned I could do it in a one-liner. Here nixconfig is a folder with all my nix files:

  tar -czf - nixconfig | ssh 192.168.1.1 \
    'tar -zxf - && sudo cp -r ./nixconfig/* /etc/nixos/ && sudo nixos-rebuild --show-trace '"${rebuild_flag} ${name_flag}"

If you're ok with building locally and not on the target host, this is simpler:

nixos-rebuild --flake .#foo --target-host root@foo --build-host localhost switch

Deploy-rs is a great alternative. It works as wrapper on top of flakes, local (optionally, cross-) building and copying closures to target machine with activation:

https://github.com/serokell/deploy-rs

These days, that's all included in nixos-rebuild itself, not much need for wrappers anymore. I migrated from Colmena to just nixos-rebuild.

Huh, I guess I was woefully behind on changes to nixos-rebuild. Thanks for the pointer, I will check it out

One thing nixos-rebuild doesn't get you is a secrets transmission mechanism. I've been dabbling to build something independent of NixOS/Nix that would still do that neatly...

May I suggest agenix? It dovetails into my deploy-rs flake setup very nicely and I can track the encrypted secrets in the flake repo.

I keep the "master" key encrypted in pass passing it in a zsh's "=" subshell to agenix.

This is fantastic reading and never really through to use nix for a router.

Reply on news.ycombinator.com