NixOS

We're trying to explore different options for running services, and NixOS on Proxmox containers is one of them. Here's how it is supposed to work:

• Malleable: it should be relatively easy to modify an existing service config, update software version, and migrate one software to another, as everything are written in Nix configuration files.
• Recoverable: NixOS keeps old copies of the system, which can be reverted if we see any immediate issues.
• Discoverable: Services are located in one canonical, centralized location. This reduces the time needed to find the specific config for a specific software, and also makes it easy for someone to know what services are running.
• Replicable: As NixOS service configuration files are written in a human readable format, anyone wishing to use the "normal" way to configure their service should be able to understand how to setup their service in a similar way.
• Trackable: Easy to manage and track changes using Git, maybe even with CI.

Setting up a Proxmox VM

If there isn't a template already, use https://hydra.nixos.org/job/nixos/release-26.05/nixos.proxmoxLXC.x86_64-linux (replace 26.05 with the latest release)

Use "Create CT", add a SSH public key, and use the vmbr0 bridge. Start the container and look at its IP on the network tab. You should then be able to SSH into the container with a command like:

ssh -J [WatIAM]@neotame.csclub.uwaterloo.ca root@129.97.[ACT.UAL]

Setting up the system flake

Because the new proxmoxLXC tarball appears to not have anything under /etc/nixos/, a system flake needs to be created from scratch. First run nix-channel --update then get into a shell with your favorite editor, e.g. nix-shell -p vim. Then create a new empty directory, enter it, and run:

nix flake init --extra-experimental-features nix-command --extra-experimental-features flakes

In flake.nix:

{
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-26.05";
  };

  outputs = { nixpkgs, ... } @inputs: {
    nixosConfigurations.[hostname] = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      specialArgs = { inherit inputs; };
      modules = [ ./main.nix ];
    };
  };
}

in main.nix:

{ modulesPath, pkgs, ... }:
{
  imports = [
    (modulesPath + "/virtualisation/proxmox-lxc.nix")
  ];
  boot.isContainer = true;
  # Supress systemd units that don't work because of LXC
  systemd.suppressedSystemUnits = [
    "dev-mqueue.mount"
    "sys-kernel-debug.mount"
    "sys-fs-fuse-connections.mount"
  ];
  system.stateVersion = "26.05";
  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  users.users."root".openssh.authorizedKeys.keys = [
    # syscom public key
    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC+l5+EvUkm/+I96y4mOrgmQA4h40UDHB59xCok8q23zNgzeRNZQFT9dx9vLZXSuYaZaecaBkC6IF+jHSvQRAbAhPnVPzlabbBOmIuZek6vWEjvr726UJhitW+HV3KNy1BMU6FMUxIboYbo1/zSpQTiyOzcQ+KWiFETxMKYl5bejlLdZUyl6OPYIAp5fwFRVneQHUkhJ/+QufzJz+HNVSCtrPGfNfoVsFiu6zzBDH0EwVxs9Ks2alyE0GT3jYGq8CkFB5ejdgt9FjlW1QG2F3eIsYVZOQ5vd/4KxqnAXcM2zkCyRlSaFNCRG3G3bOWBndc/gp9b+duRXfZyNguo3SVBZpQ9jDYxCdxyvKJVFKMOHDuVjIyE56J/vLB+SI5bRdb/zyPo5psqZVuSgt91WjpH1izGEkYYQjeOhyk57OOLPqIWyXvCoxCM1NkYy8Ld3JebRo0KwEFsNtaq0JUuCtgitfdM9qc3UQHVaKfU1PVKhYoLRtUYq18LY/7jvdRvAMM= root@xylitol"
  ];
  users.users.[user] =
    {
      isNormalUser = true;
      extraGroups = [ "wheel" ];
      openssh.authorizedKeys.keys = [
        "[key1]"
        "[key2]"
      ];
      shell = pkgs.[shell];
    };
  programs.fish.enable = true;
  programs.git.enable = true;
  services.openssh = {
    enable = true;
    settings.PasswordAuthentication = false;
    settings.KbdInteractiveAuthentication = false;
    settings.PermitRootLogin = "without-password";
  };
  security.sudo.wheelNeedsPassword = false;
  environment.systemPackages = with pkgs; [ vim fish ];
}

Then run nixos-rebuild switch --flake . and the system flake should be setup. This can be used to create a non-root user that performs administration.