me and fedora have been boxing for a while now and I’m thinking I want to try something else after I finish designing my next home server case for it.

I’m considering NASty https://github.com/nasty-project/nasty as it’s doing pretty much everything out of box I want to do with this next one already, and even though it’s young, it’s build on nixOS, which I consider mature at this point.

But I have no experience with nixOS. It sounds like it’s a less obnoxious form of fedora coreOS. Any opinions?

all 23 comments

sorted by: hot top controversial new old
[–] 13 points 1 day ago* (2 children)

Right now my server is Proxmox/Debian/Docker and I've been waiting for it to blow up so I can finally have an excuse to put time into migrating to something better, but after years of barely touching it it still works lol.

This is my first time hearing about NASty. Right now I run NixOS in a VPS with some basic services and have it managed with OpenTofu and for that it works great, but when I migrate my main setup I think I'm going to do a slightly different setup that's still Nix-managed but uses k3s on top of VMs instead of just using NixOS services on the host.

I mostly use NixOS on my laptop right now and really like it, but I might start putting everything in VMs there also, and if that works well use the same configuration between my laptop and server for that.

  • source
  • hideshow 2 child comments
  • [–] [S] 2 points 1 day ago

    I migrated the system from ARM to X86 for the GPU last time when I built it, and I’ve been looking for ways of reducing energy consumption, and one of those ways is collapsing every virtual machine I can into containers so this can fit surprisingly well for me

  • source
  • parent
  • [–] 8 points 1 day ago

    I'm personally very happy with my proxmox based server(s). I'm using community scripts for many of the setups of actual services. Over all, it's low maintenance and if I'm having issues it isn't with the host system. Not once did a system update cause a failed boot after.

    That being said, NASty sounds rather promising. I doubt I'll switch over, but it might at least make for a fun experiment. And being nix based is rather nice for reproducibility.

  • source
  • [–] 7 points 1 day ago (2 children)

    No experience with NASty, but:

    Had a server die on me about a year ago and wanted more Infra as Code. Tried Fedora CoreOS first, but the cycle was constantly creating a new USB bootable, it was just a bad fit for me.

    Switched to NixOS and definitely still not an expert, but it's simple enough that 4 machines are running it. I really enjoy it. Already migrated a critical machine, where I basically used a second machine for A/B testing, to ensure minimal downtime and rollback possibility.

    My deploy story is still kinda jank. I just looked at what worked and didn't read too much about the internals. Using deploy-rs and falling back to nixos-anywhere when necessary.

    Some new services were really basically as easy as adding services.example.enabled = true; and deploying.

    Hope it helps an good luck!

  • source
  • hideshow 2 child comments
  • [–] [S] 2 points 1 day ago (1 child)

    Do you think the lack of apparmor or selinux is a problem for nixOS?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 14 hours ago*

    Personally didn't worry about it. Some issues in CoreOS with SELinux left a sour taste; tried to get my reverse proxy running, but a policy was missing and I either had to compile custom policies or turn off enforcement.

    In NixOS, I was careful about checking file permission setup, service users and systemd service hardening options for the services I'm running. Defaults on what I installed seemed pretty good hardening, better than what I'd do myself.

    I think it's easy to overlook as a first time user that everything in the nix-store is readable to all, so no secrets in there, anywhere. I ended up using sops-nix.

  • source
  • parent
  • [–] 6 points 1 day ago (13 children)

    This is the first I've heard of NASty. Thanks for the new rabbit hole!

    Genuine question: what's obnoxious about Fedora? TIA

  • source
  • hideshow 13 child comments
  • [–] [S] 12 points 1 day ago* (5 children)

    Fedora always felt slower no matter what I did with it. Selinux sent me to therapy. Cockpit always felt incomplete. Some updates require me to box with fedora to get it to boot again because selinux had an opinion.

    Fedora touched me in places they don’t even have on the doll.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 6 points 1 day ago (4 children)

    . Fedora touched me in places they don’t even have on the doll

    ;D That's going in my lexicon. Moreover, I feel duly warned; thanks for that.

  • source
  • parent
  • hideshow 4 child comments
  • [–] [S] 6 points 1 day ago* (3 children)

    It’s not necessarily a bad thing, SELinux is doing exactly what it’s supposed to do. The default is no, and you’re gonna have to convince it otherwise. I’m just not all that great at convincing it otherwise cleanly.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 day ago (2 children)

    Just know that NixOS has no support for SELinux or apparmor. Though if you are into that model of 'no by default' I have something related but for the files under root: https://github.com/nix-community/impermanence

  • source
  • parent
  • hideshow 2 child comments
  • [–] [S] 1 point 1 day ago* (last edited 1 day ago) (1 child)

    Which is weird but I get it. I wanted to force myself to learn selinux with fedora and I get it I’m just bad at it. I shoudnt have a headless machine running all the time without some protections, but I suppose I could do well enough by having ip2d and bittorrent in a VM and local only stuff in containers. its not great but it should be good enough.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 day ago

    I never tried SELinux before and I don't know all that much about NixOS but apparently it has to do with how NixOS works under the hood which makes it hard and there's no incentive to actually struggle to implement support.

    A big shame because SELinux model is something I would love to have on my system as I don't want everything to have access to everything by default.

  • source
  • parent
  • [–] 3 points 1 day ago (6 children)

    Do you mind sharing the rabbit hole? I tried to search NASty too, but it looks like the result is mostly porno or other irrelevant shit.

  • source
  • parent
  • hideshow 6 child comments
  • [–] [S] 5 points 1 day ago (5 children)
  • [–] 1 point 1 day ago (2 children)

    Fyi you may want to include this in the body of your post. I doubt a lot of people want to search "nasty" while on their lunchbreak at work

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 day ago* (1 child)