NixOS is making me less afraid

On the go? Listen to an ai-narrated version of this article. Confused? More about ai narration. Something funny happened a little while ago: I read about FreshRSS, and it sounded nice, so I installed it on a server and started using it. That would not have happened a year ago, but then again, a year ago I didn’t have any NixOS servers.

出门在外？听听这篇文章的 AI 朗读版。感到困惑？了解更多关于 AI 朗读的信息。不久前发生了一件有趣的事：我读到了关于 FreshRSS 的介绍，听起来不错，于是我把它安装在服务器上并开始使用。一年前我绝不会这么做，但话说回来，一年前我还没有任何 NixOS 服务器。

For the past few years, my rss feeds have lived locally on my phone only. There was a good idea behind that, but it never quite worked in practice. For one, many things are easier to read on a larger screen. But it was also brittle to trust a phone app to manage the read/unread status of thousands of articles across a hundred feeds.

过去几年里，我的 RSS 订阅源只保存在手机本地。这背后的初衷是好的，但在实践中却不太奏效。首先，很多内容在大屏幕上阅读更方便。其次，完全依赖手机应用来管理上百个订阅源中数千篇文章的已读/未读状态，这种方式非常脆弱。

What I really wanted was a server-side feed aggregator. This is software that runs on a server, manages rss feeds, and then I can read the rss feeds either through a web interface, or through client applications. I’ve wanted that for a while, but I’ve never taken the step, because it would be yet another side project to maintain the deployment of.

我真正想要的是一个服务器端的订阅聚合器。这是一种运行在服务器上、用于管理 RSS 订阅源的软件，之后我可以通过网页界面或客户端应用程序来阅读这些内容。我想要这个功能已经很久了，但一直没有付诸行动，因为这意味着又要多维护一个部署项目。

But now, with some NixOS experience, adding a working FreshRSS configuration (including backups) took 9 lines of Nix code. That installation has just hands-off worked for the past few months. If or when that server breaks, I can spin up a new one running the exact same configuration, probably in something like 15 minutes. When we can do something like that, there is literally no reason to not just try the new software.

但现在，有了 NixOS 的经验，添加一个可用的 FreshRSS 配置（包括备份）只需 9 行 Nix 代码。过去几个月里，这个安装一直无需人工干预地正常运行。如果服务器坏了，我可以在大约 15 分钟内启动一台运行完全相同配置的新服务器。当我们能做到这一点时，确实没有任何理由不去尝试新软件。

Contrast this against how FreshRSS is installed outside of NixOS. Then we’d download and extract an archive to the right location; configure permissions according to instructions; install nginx and php-fpm with necessary extra dependencies to the server; configure php-fpm pools and make nginx pass requests through to php-fpm; set up Let’s Encrypt certificates; set up backups; and hopefully remember how to do all the above if something breaks and we need to reinstall FreshRSS on a new or upgraded server later.

对比一下在 NixOS 之外安装 FreshRSS 的过程：我们需要下载归档文件并解压到指定位置；根据说明配置权限；在服务器上安装 nginx 和 php-fpm 以及必要的额外依赖；配置 php-fpm 进程池并让 nginx 将请求转发给 php-fpm；设置 Let’s Encrypt 证书；设置备份；并且希望在未来服务器损坏或升级需要重装 FreshRSS 时，还能记得如何完成上述所有步骤。

Of course, the FreshRSS project provides a container image which would shorten the process a little bit. It purports to set up Apache with mod_php and configure them the right way. Then we’d only need to configure backups, create a systemd service that runs the container, and manage nginx as a tls terminating reverse proxy in front of that, because the container image reasonably does not come with tls support.

当然，FreshRSS 项目提供了一个容器镜像，可以稍微简化这个过程。它声称可以配置好带有 mod_php 的 Apache 并进行正确设置。之后我们只需要配置备份，创建一个运行容器的 systemd 服务，并在前端管理一个作为 TLS 终止反向代理的 nginx，因为容器镜像本身并不包含 TLS 支持，这也是合理的。

This is still stuff to remember, and there’s also no guarantee the same thing works six months down the line when reinstalling, unless we wrote down which exact container image we downloaded. I have mentioned before how much I dislike maintaining side projects. That includes my own code, but also self-hosted services developed by someone else.

这些仍然需要记忆，而且无法保证六个月后重装时同样的方法还能奏效，除非我们记录下了具体下载了哪个容器镜像。我之前提到过我有多讨厌维护副业项目。这不仅包括我自己的代码，也包括别人开发的自托管服务。

I’m okay with a few minutes of maintenance here and there, but having to schedule hours of uninterrupted work to upgrade something, or spending any amount of time at all on emergency maintenance, really kills my desire to work with computers. You’d think someone of my disposition would be deep into configuration management, container orchestration, or both, but no.

我能接受偶尔几分钟的维护，但如果需要专门安排数小时的连续时间来升级某个东西，或者在紧急维护上花费任何时间，真的会磨灭我使用电脑的兴趣。你可能会认为像我这样性格的人会深入研究配置管理或容器编排，但事实并非如此。

I have made honest attempts with CFEngine, Ansible, podman, and k3s but none of them improved my installation/configuration/deployment experience significantly over (a) carefully writing things down, and sometimes (b) turning those careful notes into a shell script performing a sequence of ssh commands. The drawback of the shell script is that it often ends up relying on assumptions that become invalid with time, or when it is used in a different environment. A NixOS configuration reads a lot like the careful instructions to myself, except they’re executable and they produce the same result every time.

我曾认真尝试过 CFEngine、Ansible、podman 和 k3s，但它们在安装、配置和部署体验上，都没有比（a）仔细记录笔记，以及（b）有时将这些笔记转化为执行一系列 SSH 命令的 Shell 脚本有显著提升。Shell 脚本的缺点在于，它往往依赖于随时间推移或在不同环境下会失效的假设。NixOS 的配置读起来很像我写给自己的详细说明，不同之处在于它们是可执行的，并且每次都能产生相同的结果。