Could you give a quick example of using NixOS configuration to launch a machine or deploying something remotely? I’m just starting to move beyond a single machine at home. I’d really like to get transition to infra as code.
Comment on Kubernetes? docker-compose? How should I organize my container services in 2024?
nico@r.dcotta.eu 8 months ago
I see no one else commented my stack, so I suggest:
Nomad for managing containers if you want something high availability. Essentially the same as k8s but much much much simpler to deploy, learn, and maintain. Perfect for homelabs imo. Most of the concepts of Nomad translate well to k8s if you do want to learn it later. It integrates really well with Terraform too if you are also hoping to learn that, but it’s not a requirement.
NixOS for managing the bare metal. It’s a lot more work to learn than say, Debian, but it is just as stable, and all configuration will be defined as code, down to the bootloader config (no bash scripts!). This makes it super robust. You can also deploy it remotely. Once you grow beyond a handful of nodes it’s important to use a confirmation management tool, and Nix has been by far my favourite so far.
If you really want everything to be infra-as-code, you can manage cloud providers via Terraform too.
For networking I use wireguard, and configure it with NixOS. Specifically, I have a mesh network where every node can reach every node without extra hops. This is a requirement if you don’t want a single point of failure (hub and spoke) to disconnect your entire cluster.
Everything in my setup is defined ‘as-code’, immutable, and multi-node (I have 7 machines) which seems to be what you want, from what you say in your post. I’ll leave my repo here, and I’m happy to answer questions!
–
My opinions on the alternatives:
Docker compose is great but doesn’t scale if you want high availability (ie, have a container be rescheduled on node failure). If you don’t want higher availability, anything more than docker might be overkill.
Ansible and Puppet are alright but are super stateful, and require scripting. If you want immutability you will love Nix/NixOS
jkrtn@lemmy.ml 8 months ago
nico@r.dcotta.eu 8 months ago
I recommend starting with ZeroToNix’s docs and then moving on to nixos.wiki, but here is a minimal, working example that I could deploy to a hetzner VPS that only has nix and ssh installed:
{ config, pkgs, ... }: { # generated, this will set up partitions and bootloader in a separate file imports = [ ./hardware-configuration.nix ]; zramSwap.enable = true; networking.hostName = "miki"; # configures SSH daemon with a public key so we can ssh in again services.openssh.enable = true; users.users.root.openssh.authorizedKeys.keys = [ ''ssh-ed25519 AAAAC3NzaC1lNDI1NTE5AAAAIPJ7FM3wEuWoVuxRkWnh9PNEtG+HOcwcZIt6Qg/Y1jka'' ]; # creates a timmy user with sudo access and wget installed users.users.timmy = { isNormalUser = true; extraGroups = [ "networkmanager" "wheel" "sudo" ]; packages = with pkgs; [ wget ]; }; # open up SSH port networking.firewall.allowedTCPPorts = [ 22 ]; # start nginx, assumes HTML is present at `/var/www` services.nginx = { enable = true; virtualHosts."default" = { forceSSL = true; # Redirect HTTP clients to an HTTPs connection default = true; # Always use this host, no matter the host name root = /var/www; # Set the web root to ser }; }; system.stateVersion = "22.11"; }
This sets up a machine, configures the usual stuff like the ssh daemon, creates a user, and sets up an nginx server. To deploy it you would run
nixos-rebuild --target-host root@10.0.0.1 switch. Other tools exist (I use colmena but the idea is the same). Note how easy it was to set up nginx! If I was setting Nomad up, I would just doservices.nomad.enable = true.As you can see some things you will have to learn (the nix language, what the configs are…) but I think it is worth it.
nopersonalspace@lemmy.world 8 months ago
This is awesome, ZeroToNix is exactly what I was looking for. I’ve been interested in trying NixOS for a while but I always found the documentation obtuse (extensive, which is great, but not super beginner friendly). I’ll give it a try!
nico@r.dcotta.eu 8 months ago
Good luck on your Nix journey! Happy to help if you have questions.
Of all the tech I use, I think Nix is the most ‘avant-garde’ in that it is super different from the usual methods (scripting, stateful things), but works very well once past the paradigm shift and the learning curve that entails.
jkrtn@lemmy.ml 8 months ago
This is such a wealth of information, thank you! I’m really excited to try this out.
johntash@eviltoast.org 8 months ago
Hey, your stack is pretty similar to mine. One thing I recently started testing is Seaweedfs. I saw it listed in your repo too, how are you liking it so far? And do you use it on all of your nodes?
nico@r.dcotta.eu 8 months ago
I struggled a bit to get it up and running well, but now I am happy with it. It’s not too hard to deploy (at least easier than the alternatives), it has CSI which for me was big, and it has erasure coding. The dev that maintains it (yes, the one dev) is very responsive.
It has trade offs, so depending on your needs, I recommend it. Backing store for stateful workloads like postgres DBs? Absolutely not. Large S3 store (with an option for filesystem mount) for storing lots of files? Yes! In that regard it’s good for stuff like Lemmy’s pictrs or immich. I use it as my own Google drive. You can easily replicate in your own cluster, or back it up to an external cloud provider. You can mount it via FUSE on your personal machine too.
Feel free to browse through my setup - if you have specific questions I am happy to answer them.
johntash@eviltoast.org 8 months ago
Thanks! I’ll do some testing over the weekend and see how it goes.
While I’d love to be able to use it for postgres, I figured that wouldn’t work out well so probably won’t try it any time soon. I do have several apps that use sqlite databases though, do you think those would have any issues? e.g. trilium, ntfy, ghost
The main downside to most of the distributed/clustered storage that I’ve tried is they always seem to corrupt sqlite db files due to not supporting locking or some other posix feature. Reading through some older github issues, it looks like that is something the dev of seaweedfs fixed hopefully.
nico@r.dcotta.eu 8 months ago
The problem with using seaweedfs to a back your DBs is more on the filesystem than the implementations of POSIX features. When you are writing to a file, and the connection to seaweedfs breaks (container restart, wifi, you name it), then you might end up with a half-written file. If you upload pictures, this is unlikely, but DBs are doing several writes per second usually. So it is more likely one of those gets interrupted. In my case, my grafana sqlite DB would get corrupted every other week.
What I recommend is using DBs natively in your node’s filesystem, and backing them up to seaweedfs periodically instead. That way your DBs ‘work’ but you can get them running again, and the backup is replicated in the distributed filesystem.
nopersonalspace@lemmy.world 8 months ago
Thanks for this, I’ve been sort if interested in both Nomad and NixOS for the exact reasons it seems like you use them. Thanks for linking that repo, I’ll check it out for inspiration!
Do you find that you sometimes struggle to get things working in Nomad? My one worry is that, because it’s not as well established as kubernetes or docker, there won’t be good compatibility or documentation. For example most services in their docs will show how to deploy with kubernetes or docker, but rarely Nomad. Do you find that it’s easy enough to translate these instructions that it doesn’t matter?
nico@r.dcotta.eu 8 months ago
Good question! So it depends, but TLDR: imo it’s worth it, or it’s fine, but it’s easy to try yourself and see
You are absolutely correct, but I do find that for the large large majority of things, either you can find an online Nomad config, or the Nomad config is easy enough to translate from Docker compose. Only some complicated larger deployments (think Immich) are harder to translate, but even then it just takes some trial and error. I really do think that extra trouble of translating is very much worth the pain you save yourself in terms of deploying k8s though. You might spend a bit longer typing out the Nomad job file yourself, but in exchange you are thankfully not maintaining the k8s cluster.
As far Nomad-specific documentation goes, I think it the official one with more than good enough.
You mentioned compatibility. So far I have not found anything I really wanted that was not possible to set up in Nomad. Nomad does CNI and CSI, which is the same API k8s uses, so thinkgs working there will work for Nomad. Other things you would use with docker compose or k8s don’t work with Nomad, but you don’t need them (for example: portainer or metrics exporters) because Nomad has them natively already (this blog discusses that).
As you can see I am pretty opinionated towards Nomad - I have been using it in my previous job in prod, and in my home-lab for a year now, and I am very happy with it. If you would like to read more I recommend this blog post. For Nomad on NixOS I wrote this one.
For now my advice is: just try nomad yourself (as simple as running
nomad agent -devon your laptop), run the tutorial, and see if it was easy enough that you see yourself using it for the rest of your containers. If you need more help you are welcome to DM me :)