Roadmap

Everything below is planned. None of it exists yet, and the order can change. The scaffold itself has not been evaluated, so step zero is getting it to build.

0. Evaluate the scaffold. Run ./check-hosts.sh, fix what breaks, and build the example host.
1. Secrets with sops-nix. Per-client key groups in .sops.yaml, with age keys derived from server SSH keys. Options take file paths only, so no secret values sit in the repo.
2. ZFS feature. Pools and snapshot retention. The hostId option already exists for this.
3. NetBird mesh. A nixmsp.networking.mesh option for connecting a client’s machines.
4. Colmena for fleet deploys. Hosts tagged by client and role.
5. msp-agent package. A systemd timer first, then monitoring with Prometheus, Loki and Grafana.
6. Roles and client folders. Roles such as firewall and database, plus clients/<name>/ once a real second client exists.
7. msp CLI and public release. Add-client command, a nix flake init template, and a release checklist: dummy keys, a license, and nix flake check in CI.

Out of scope for v1

A web portal and a JSON inventory were considered and dropped. v1 is pure Nix.

Sources

The design comes from two planning conversations (February and October 2026) and from an earlier migration of a personal NixOS configuration to the same auto-loaded feature layout. The scaffold is a fresh minimal rebuild, not a copy of that configuration.