Fleet deploy¶
Day-2 hub deploy (evaluate → copy over SSH → activate) vs install-time wipe/install vs peer/mesh fleets. Fresh install ≠ ongoing update. Colmena, deploy-rs, Morph, Nixinate, and bare nixos-rebuild --target-host are hub → hosts SSH push; Clan adds inventory + declared networking/mesh, not a Colmena-style hive.
Decision table¶
| Situation | Prefer | Leaf | Avoid if… |
|---|---|---|---|
| 1–few already-NixOS hosts; same CLI as local rebuild | nixos-rebuild --target-host / --build-host |
Remote deploy | Need tags, parallel fleets, multi-profile, or magic-rollback |
| Many hosts; tags / parallel apply; classic or flake hive | Colmena (colmena apply --on @tag) |
Colmena | Expecting peer mesh / no-central-controller ops (use Clan) |
| Multi-profile (system + Home Manager / darwin) on flakes | deploy-rs (deploy.nodes / profiles) |
deploy-rs | Non-flake Morph-style network file only |
| Need post-activate SSH confirm + auto rollback | deploy-rs magic-rollback (default on) | deploy-rs | You intentionally change SSH port/IP mid-deploy (disable carefully) |
Existing Morph network deployment file |
Morph (morph deploy … switch) |
Morph / Nixinate | Greenfield flake fleet (prefer Colmena / deploy-rs) |
Minimal flake apps per nixosConfigurations.* |
Nixinate (nix run .#apps.nixinate.<name>) |
Morph / Nixinate | Need rich multi-host orchestration (PoC / lightly maintained) |
| Peer/inventory fleet; mesh VPN + networking fallback | Clan (clan machines update) |
Clan and mesh | You only want hub→SSH push with no inventory/mesh story |
| Still installing (no NixOS yet); remote wipe + flake | nixos-anywhere | nixos-anywhere | Day-2 config pushes on a running NixOS host |
Bootstrap chooser (ISO / disko / anywhere / non-NixOS): Install and bootstrap. Deploy authority / SSH keys: Inter-machine trust.
Failure callouts¶
| Symptom / mistake | Fix |
|---|---|
| Re-running nixos-anywhere for ordinary updates | Day-2: remote deploy or Colmena / deploy-rs—not install-time wipe |
| Deploy “succeeds” then rolls back after intentional net/SSH change | deploy-rs magic-rollback (default on) reconnects to confirm; disable for that change — deploy-rs |
| Treating Colmena “hive” as a host mesh / overlay | Colmena is hub→hosts SSH push only; peer fabric → Clan and mesh |
| Digga / Hive collectors confused with Colmena hive | Different “Hive”—see Colmena name-clash note → Digga / Hive |
See also¶
- Install and bootstrap
- Remote deploy
- Deployment and infra
- Machine mesh
- Inter-machine trust
- deploy-rs fleet (worked example)
- nixos-anywhere bootstrap (worked example) — install-time, not day-2