Most infrastructure problems are archaeology problems. Nobody knows why that rule is there, who added that package, or whether the staging box matches production. Declarative configuration ends the archaeology.

NixOS

Every machine is a file. Packages, services, users, firewall, certificates, cron, kernel parameters — all of it, in one place, in your Git repository. nixos-rebuild switch makes the machine match the file. If it goes wrong, the previous generation is still on disk and one reboot away.

That means staging genuinely matches production, a new region is a copied file, and an auditor’s question is answered with git log rather than with a guess.

WireGuard

A flat, encrypted network across your offices, servers and laptops, with public keys as the only identity. It lives in the kernel, it survives roaming between networks, and its entire implementation is small enough to have been read by the people who reviewed it.

pf

Filtering at the edge with the OpenBSD packet filter: macros, tables and anchors that produce a ruleset a new engineer can read top to bottom without a vendor course. Rules ship through the same review process as application code, and take effect atomically.

The long-form case

Why we reach for these in particular — the comparison tables, the numbers, and the situations where we would tell you to pick something else.

Infrastructure & networks

NixOS

WireGuard

pf

The long-form case

Tell us what you are running.
We will tell you what it should be.

NixOS

WireGuard

pf

The long-form case

Tell us what you are running.We will tell you what it should be.

Tell us what you are running.
We will tell you what it should be.