Authenticate your NixOS deployments

Sat, 29 Mar 2025 00:00:00 +0000

comin is a pull mode NixOS deployment tool: it polls Git repositories and deploys new commits. It can now verify these commits are signed, to exclude attacks on the remote Git repository.

To automate the deployment of your NixOS machines with comin, you only need to add 3 lines in your configuration. It is really easy to use because you don’t need to configure a CICD nor store secrets. However, it requires you to trust the remote Git repository. When the Git repository is compromised, the attacker controls what is deployed on your machines.

NixOS deployment: from push to pull

Sat, 24 Feb 2024 00:00:00 +0000

I’m maintaining several laptops and private servers. All of these machines runs NixOS.

An advantage of NixOS is that the configuration of all of these machines is described in a Git repository. To apply a change to one of these machines, I need to:

modify a file in the repository
deploy this change on impacted machines

For the last 7 years, I’ve been using several tools to deploy these configurations and they were mainly based on a push model (the change is pushed to machines). The NixOS ecosystem provides a lot a tools to efficiently achieve this. However, it often ended with divergences between the configuration committed in the repository and the configuration actually deployed on machines (because I forgot to commit or deploy on all machines).

A faster dockerTools.buildImage prototype

Sun, 26 Dec 2021 00:00:00 +0000

dockerTools.buildImage is the nixpkgs function to create OCI images. From a Nix expression, it creates a OCI image archive (which is basically a tar of layers, where each layer is a tar’ed file tree). Once this OCI image archive has been written to the Nix store, it can then be loaded it in the Docker deamon or pushed it to a Docker registry. Writing container images with the dockerTools.buildImage function is pretty convenient, but it has still several performance issues:

Long-term reproducibility with Nix and Software Heritage

Thu, 18 Jun 2020 00:00:00 +0000

Some parts of a Kubernetes CI with the Cue language

Thu, 26 Dec 2019 00:00:00 +0000

tl;dr Some notes on an experiment I did to implement a webhook web service for a Kubernetes based CI with a few lines of Cue.

A lot of workflows are moving to Kubernetes, and this also includes CI systems. In the previous months, several projects have been created to use Kubernetes as a CI engine. Kubernetes is used to run CI jobs, but it is also used to implement the CI itself: CI pipelines are implemented with Custom Resources (CRs) and controllers. CRs allow the user to manipulate CI resources through the Kubernetes API. Controllers are in charge of translating these resources into concrete actions, such as running jobs in a correct order.

How to install NixOS on kimsufi

Sun, 01 Dec 2019 00:00:00 +0000

Here are some notes on how to install NixOS 19.09 on a Kimsufi dedicated server.

From the kimsufi webmail interface Link to heading

Go to the Kimsufi webui
Choose netboot and select the resuce64pro
Reboot the server
Use the root credentials sent by mail from OVH
SSH to the server with above credentials

From the server rescue mode Link to heading

The following links can be useful:

Tekton Pipelines - the Nix way

Mon, 30 Sep 2019 00:00:00 +0000

In this post, we discuss about a CI/CD pipeline to build and deploy a Docker image in Kubernetes with Nix and Tekton Pipelines. I’m actually interested in providing a simple CI/CD to deploy Nix expressions (because of Nix composability and reproducibility) in an existing Kubernetes cluster.

Tekton Pipelines is a CI/CD project providing k8s-style resources for declaring CI/CD-style pipelines: the CI/CD is entirely executed in the cluster and its configuration data are custom Kubernetes resources (no need for external databases or volumes).

Openstack on NixOS

Tue, 13 Sep 2016 00:00:00 +0000

Openstack Liberty with linuxbridge driver Link to heading

We deploy with Nixops the following Openstack services: nova, glance, keystone and neutron with the linuxbridge driver. Once they are deployed, we will boot a VM and ssh to it.

Deploy Openstack services with Nixops Link to heading

We consider this nixpkgs branch.

My openstack.nix nixops file:

{
  openstack =
    { config, pkgs, nixpkgs, ... }:
  let
    credentials = { keystoneAdminUsername="admin"; keystoneAdminTenant="admin"; keystoneAdminPassword="admin"; };
    osConfig = {
      endpointPublic = config.networking.privateIPv4;
    } // credentials;
    keystoneConfig = {
      enable = true;
    } // osConfig;
    otherConfig = {
      enableSingleNode = true;
    } // osConfig;
  in 
    { 
      deployment.targetEnv = "libvirtd";
      deployment.libvirtd.memorySize = 4096;
      deployment.libvirtd.headless = true;
      nixpkgs.config.allowBroken = true; 
      networking.firewall.enable = false;
      environment.systemPackages = [ pkgs.pythonPackages.neutronclient
                                     pkgs.pythonPackages.keystoneclient
				     pkgs.pythonPackages.glanceclient
				     pkgs.pythonPackages.novaclient
				   ];
      
      virtualisation.keystone = keystoneConfig;
      virtualisation.glance = otherConfig;
      virtualisation.neutron = otherConfig;
      virtualisation.nova = otherConfig;
    };
}

Then, we deploy it

About

Mon, 01 Jan 0001 00:00:00 +0000

about

Archives

Mon, 01 Jan 0001 00:00:00 +0000