NixMSP_

~/nixmsp

NixOS for MSPs. Client machines, declared once.

NixMSP is a declarative way for an MSP to set up and manage client machines on NixOS. Each machine is a short file of option values. Shared behavior lives in typed features, and unsafe settings fail with a clear message.

Scaffold stageNot yet evaluated
Read the docsQuick start
the 2-minute demo
# same machine, one option different
$ nix eval .#nixosConfigurations.example.config.services.fail2ban.enable
false
$ nix eval .#nixosConfigurations.example-strict.config.services.fail2ban.enable
true

Expected output from reading the code. These commands have not been run yet.

01 / the idea

A small, readable way to describe a machine.

The scaffold has three features and one example host. It is written, and it has not been through Nix yet.

./features/*.nix

Typed options

Each feature declares its own nixmsp.* options with types. A wrong value fails at evaluation time, not on the client's machine.

./features/ (import-tree)

Auto-loaded features

Add a file to features/ and it is picked up. There is no list to keep in sync.

./hosts/<name>/

Hosts only set values

A host folder says what is different about one machine. The behavior stays in the features, so it is the same for every client.

./features/security.nix

Refuses to lock you out

The strict baseline turns off SSH passwords, and it will not evaluate without at least one authorized key.

02 / one option

Standard or strict, with one line.

The first feature we wrote is a security baseline. It is meant to change a handful of things together.

standard (default)

Sensible defaults

  • sudo asks for a password
  • SSH keeps the NixOS defaults
  • Authorized keys are optional

strict

Locked down

  • Key-only SSH, no root login
  • fail2ban turned on
  • Authorized keys required

This comes from reading the code. We will confirm it with a real evaluation before saying it works. Details in the docs.

03 / what is next

Mostly not built yet.

The order below is the plan. Every item is planned, and none of it exists today.

  1. 00
    Evaluate the scaffoldRun it, fix what breaks, build the example host.
    next
  2. 01
    Secrets with sops-nixPer-client key groups. Options take file paths only.
    planned
  3. 02
    ZFSPools and snapshot retention.
    planned
  4. 03
    NetBird meshConnect a client's machines.
    planned
  5. 04
    Colmena fleet deploysHosts tagged by client and role.
    planned

Full roadmap

04 / follow along

A public repository is planned.

It does not exist yet, so there is nothing to clone today. When the scaffold has passed its first evaluation, the generic parts will be released as a fresh repository.

About FOSSadmin