NixOS + sops-nix production stack

The setup

A production server where the entire machine is code:

• Single flake entrypoint for dev, CI, and production — identical tool chains
• devenv.sh modules for the dev shell: node, postgres, s3-compatible storage (Garage), git hooks — all versioned
• sops-nix for production secrets: age-encrypted files land in /run/secrets/* at activation, systemd units read them as env vars
• Declarative systemd services with hardening (DynamicUser, StateDirectory, PrivateTmp), TLS via Caddy with ACME DNS challenge, and restic backup unit wired to the same S3 bucket

Why this pattern wins

• Secrets never reach the repo or the build output
• Deploys are atomic rollbacks; the previous system is one --rollback away
• Bootstrapping a new box (firewall, users, services, backups) takes minutes

View

I use this stack on my own fleet and ship it as a consulting deliverable for clients who want to stop hand-rolling servers.