nix lernt man nicht, man gewöhnt sich nur dran
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
stuebinm 0127b30566 add deploy-rs gc roots to .gitignore 7 months ago
common shoehorn nix-hexchen-style config into flakes 7 months ago
hosts/parsons fix acme-fixperms 7 months ago
modules remove apparently unneeded disabledModules 7 months ago
pkgs shoehorn nix-hexchen-style config into flakes 7 months ago
services fix alps mail interface 7 months ago
websites solve some TODOs 7 months ago
.gitignore add deploy-rs gc roots to .gitignore 7 months ago
LICENSE add a LICENSE-file 8 months ago flake-enabled readme 🎉 7 months ago
default.nix sources: update nixpkgs to 21.05 2 years ago
flake.lock do unspeakable things to flake.lock 7 months ago
flake.nix deploy-rs: disable auto-rollback by default 7 months ago

hacc nixfiles

welcome to hacc nixfiles (haccfiles). this is the code describing our nix-based infrastructure.


  • flake.nix: Entrypoint & dependencies
  • common/: configuration common to all hosts
  • modules/: home-grown modules for hacc-specific services
  • pkgs/: packages we built and don't want to upstream
  • hosts/: configuration.nix per host (currently there's only one of those)
  • services/: all services we run; imported in appropriate host config
  • websites/: static websites we deploy somewhere

working with the haccfiles

You will need a flake-enabled nix installation, and have your ssh config set up so that ssh parsons will connect to

It's recommended to use deploy_rs:

deploy .#parsons -k [--dry-activate]

Alternatively, using just nixos-rebuild:

nixos-rebuild --flake .#parsons --target-host parsons \
  --use-remote-sudo --use-substitutes [test|switch|dry-activate]

If for some reason you have nix but not nixos-rebuild, you can still build the system closure using:

nix build

(but you might have trouble deploying it)

I don't want to build this long dependency / want a cached version!

If it's still available on parsons from a previous deploy, do:

nix copy --from ssh://parsons /nix/store/...

Note: don't just copy the .drv file (which Nix complains about if it can't build something), that's just the description of how to build it! If you don't know the actual outpath, look in the .drv file (should start with Derive([("out","[the path you want]"...)

committing to haccfiles

  • Things on main should always reflect the config that's actually deployed on parsons, except during testing / debugging sessions
  • split up commits, every commit is one atomic change
  • follow the commit format: "place: $change"
    • place: e.g. modules/$module, services/$service ...
    • change: describe your change. Please wrap your lines sensibly (or configure your editor to do this for you)
  • Exception: autogenerated messages (merge commits, reverts, etc)
  • don't overuse merge commits, try to rebase things if possible with reasonable effort