I can touch on it more. Docker and compose files are great for getting things going, contained, and keeping everything declarative
But I found the more services I used with Docker, the more time it took to update. I didn't want to just update to latest, I wanted to update to specific version, for better rollback. That meant manually checking and updating every single service, bringing each file down, and then back up. It's not entirely unmanageable, but it became enough friction I wasn't updating things consistently. And yes, I could have automated some of that, but never got around to it
NixOS, in addition to the things I mention in the post, is just a two step process to update everything (`nix flake update` and `nixos-rebuild`). That makes updating my OS and every package/service super easy. And provides built in rollback if it fails. Plus I can configure things like my firewall and other security things in NixOS with the same config I do everything else
Also, Nix packages/services provides a lot of the "containerization" benefits. It's reproducible. It doesn't have dependency problems (see this for morehttps://nixos.org/guides/how-nix-works/). And most services use separate users with distinct permissions, giving pretty good security.
It's not that Docker can't do those things. It's that Nix does those things in a way that work really well with how I think
Hey, I ruled out a mail server for external, since I've heard many people have issues with other providers (Gmail, Outlook, etc) randomly blocking email. Didn't feel I could rely on it
Having an internal only mail server for notifications is an interesting idea. I've been using ntfy and Matrix to achieve something like that, but not all services support those notification methods. I'll keep that in mind!
I found the Tailscale client experience is quite nice and headscale had built in OIDC support (so easy auth for my users)
If I started this setup later I might have also used pangolin, which also provides a nice management interface on top of WireGuard https://github.com/fosrl/pangolin
It is something I considered. Ultimately I didn't want to depend on Clouflare (or any other provider) for something as core to my setup as my remote access
But it's a totally valid option, just not one that fit with my preferences
I do have to sit down and walk folks through setting up Tailscale, Nextcloud, etc on their devices. So far though, I haven't had any complaints once that is done. Nextcloud just syncs in the background and they can navigate to sites like normal. But my family is probably more tech literate than most, so that helps
It's entirely because I've used it before. I just wanted something familiar to solve a problem quickly. I also think it looks nice. I'm not too worried about the security implications, since it is behind Tailscale and Authelia. I'm not committed to it, and do want to explore other options in the future
On my NixOS laptop I you can setup services I'm interested in trying, but just run them locally. So I don't setup things like SSL (you can, it sometimes just makes getting a new SSL cert for that same domain take some time). I just update my /etc/hosts to the local IP and can give that a go
For trying out the more complicated setup parts, like SSL, Tailscale, etc, I created a NixOS VM that I setup the same way I wanted for my "production" use case. Once I have the config file the way I wanted, it's as simple as moving it to my non test VM (baring previous mentioned SSL issues). And I only tested one part at a time, adding them together as I went
But also, one of the great things about NixOS is it's really easy to incrementally try things and rollback. Once I got the skeleton of the setup working, I've mostly done my testing on my "production" server without issue
The big difference for me was NixOS provides really simple rollbacks if something goes wrong, where with Ansible and compose files, that's possible, but you have to do it yourself
But also if you're setup is working for you, I think that's great! It sounds like you have a good system in place
With previous setups, I was certainly guilt of not upgrading and doing the maintenance needed. That's one reason why I like using NixOS and ZFS. Both provide really easy rollback options. So all I need to do is run an update and rebuild. If things work, no more for me to do. If things don't, I can try debugging or just revert back to the previous release till I have time to
But also I think using a cloud provider is fine if you're happy with the experience. It is a time sink to get things setup and it's not zero maintenance time. It's reasonable to weight those costs
The services we use, like Nextcloud or Mealie, are designed for folks to have their own user accounts. SSO means they can use the same login across all of them without me having to manage that for them (and also avoids me having to know their passwords). It does complicated the setup, but not the operation, and that makes it more likely folks will use the services
Nice! I have a friend who is starting to program his infrastructure/services from scratch. It's a neat way to learn and make things fit well for your own needs
Oh yeah, I don't think the way I went about it was necessarily the most cost effective. I bought half of them on sale one year, didn't get around to setting things up, then bought the other two a year later on another sale once I finally got my server put together. I got them before I had my current plan in place. At one point I thought about having more services in a Kubernets cluster or something, but dropped that idea
Also agree, RAID isn't a replacement for a backup. I have all my important data on my desktop and laptop with plans for a dedicated backup server in the future. RAID does give you more breathing room if things go wrong, and I decided that was worth it
But I found the more services I used with Docker, the more time it took to update. I didn't want to just update to latest, I wanted to update to specific version, for better rollback. That meant manually checking and updating every single service, bringing each file down, and then back up. It's not entirely unmanageable, but it became enough friction I wasn't updating things consistently. And yes, I could have automated some of that, but never got around to it
NixOS, in addition to the things I mention in the post, is just a two step process to update everything (`nix flake update` and `nixos-rebuild`). That makes updating my OS and every package/service super easy. And provides built in rollback if it fails. Plus I can configure things like my firewall and other security things in NixOS with the same config I do everything else
Also, Nix packages/services provides a lot of the "containerization" benefits. It's reproducible. It doesn't have dependency problems (see this for morehttps://nixos.org/guides/how-nix-works/). And most services use separate users with distinct permissions, giving pretty good security.
It's not that Docker can't do those things. It's that Nix does those things in a way that work really well with how I think