Skip to content

Operator Roadmap

Path for people who run and maintain NixOS systems: rebuilds, upgrades, rollbacks, deploy, secrets, caches, and troubleshooting. Prefer operations and infra pages; pull concepts only as needed to act safely. This page is a curated reading order only — no runnable example.

Goals

  • Rebuild, test, boot, and roll back generations with a clear activation model
  • Upgrade channel- or flake-pinned systems without painting yourself into a corner
  • Deploy to remote hosts and keep secrets, trust, and binary caches under control
  • Diagnose failed builds, activation, and substituter problems with the right CLI

Prerequisites

  • A working NixOS host (or VM) you can rebuild
  • Comfort with a shell and SSH; no need to write packages or modules yet
  • Optional: skim Beginner if store/flake vocabulary is new
  • Keep Reading manuals and search handy for option lookups

Reading order

Mental model (short)

Day-2 NixOS operations (core)

Config you must touch to operate

Scenario paths (pick one track)

Risky change on production — read in order: rebuild switch / boot / test (test first) → rollbacks → troubleshooting activation vs systemd table → FAQ: common errors.

Pin bump (channel or flake) — upgrades → flake lockfile or channel → specialisations if you maintain boot variants on the same host.

Fleet / multi-host — Fleet deploy chooser → remote deploy → machine mesh + inter-machine trust → tool pick: Colmena / deploy-rs / Clan and mesh → overlay networks when SSH/store URIs need VPN → private cache mesh when several hosts share private substituters.

Disconnected or lab site — airgap and offline → nix copy and bundles → binary cache hosting → netboot and PXE for LAN imaging.

Desktop laptop ops — networking → NixOS Desktop → secrets strategies for Wi‑Fi PSKs.

Homelab / self-hosted — homelab patterns → homelab proxy, services, and secrets (worked example) → common service examples → backups and restore → overlay networks for tailnet-only exposure.

Multi-host flake repo — config repo layout → multi-host config repo (worked example) → nixosConfigurations → imports and profiles.

Disk + ephemeral root — disk and persistence (cheatsheet) → Disko + impermanence host (worked example) → disko / impermanence.

Remote install then day-2 fleet — install and bootstrap → nixos-anywhere bootstrap (worked example) → fleet deploy → deploy-rs fleet (worked example) → remote deploy.

Config flake CI — CI with Nix → Flake CI with GitHub Actions (worked example) → binary caches (cheatsheet).

Virtualization and guests (optional)

CLI and daemon config

Store, caches, and GC

Deploy and infra

Security and trust

Next steps

See also