NixiNA fleet of machines and containers, described once

by the Distrilab

Machines assembled from names

A machine is a platform, a list of aspects and its home users. The same aspect works on a laptop and on a headless guest.

One file per machine

How it is built, what the fleet knows of it, and its own module, in one file in its own directory. Nothing else mentions it.

A flake you take as an input

NixiN holds the mechanism. Your repository holds the machines, the inventory and the secrets, and names nothing NixiN has to know about.

Several parcs, one repository

A parc is one infrastructure. A repository can hold more than one, each with its own inventory and secrets, sharing only what is true of all of them.

A fleet that reports itself

An agent on every machine streams its state every two seconds to one hub, pushes its own alarms to Uptime Kuma, and the TUI or the web page, with ssh in the browser, shows who runs what CI built.

Not only NixOS machines

Debian servers and hypervisor nodes are in the same inventory. Nix generates their borgmatic, apt and firewall files, a push script installs them, and their agent reports them beside the rest.

What a fleet looks like

The flake of an infrastructure names one input and one call:

nix

{
  inputs.nixin.url = "git+https://codeberg.org/mrflos/nixin.git?ref=main";

  outputs = inputs @ {nixin, ...}:
    nixin.lib.mkFleet {
      inherit inputs;
      root = ./.;
    };
}

No list of machines, because there is nothing to list. mkFleet reads the repository by convention, and a machine is a directory holding one file:

nix

# machines/webserver/configuration.nix
{
  platform = "proxmox-lxc";
  aspects = ["service/hedgedoc" "system/secrets" "bundle/server"];

  node = "node-1";
  ctid = 110;
  domain = "pads.example.org";
  address = "2001:db8::110";
  routes.public = {host = "203.0.113.10"; port = 22110; user = "operator";};

  module = {...}: {
    networking.hostName = "webserver";
    nixin.services.hedgedoc.domain = "pads.example.org";
    system.stateVersion = "26.05";
  };
}

platform and aspects say how it is built. module is what is true of this machine alone. Everything else is what the fleet knows about it, and goes straight into .#inventory. Each name in the aspect list is one file in NixiN, and bundle/server is how a machine asks for a whole role in one word.

Machines the repository cannot rebuild go in the same list. A Debian or YunoHost server, a hypervisor node: the repository still says what must be true of them, writes some of their configuration files and watches them from the same dashboard.

What NixiN is, and what it is for

Our team

We are French engineers contributing to open source projects, experimenting with modern web infrastructure at the Distrilab, and members of CHATONS, the French collective of alternative web hosts.

Fabrice Bellamy

System Administration

Florian Schmitt

Web Development