Infrastructure & networks

Most infrastructure problems come down to missing history. Nobody knows why a rule is there, who added a package, or whether the staging box matches production. With declarative configuration, that history is in the repository.

NixOS

Every machine is described in a file: packages, services, users, firewall, certificates, cron and kernel parameters, all in your Git repository. nixos-rebuild switch makes the machine match the file. If something goes wrong, the previous generation is still on disk and one reboot away.

As a result staging matches production, a new region is a copied file, and an auditor’s question can be answered with git log instead of a guess.

WireGuard

A flat, encrypted network across your offices, servers and laptops, with public keys as the only identity. It runs in the kernel, it copes with roaming between networks, and the implementation is small enough that its reviewers have read all of it.

pf

Filtering at the edge with the OpenBSD packet filter. Macros, tables and anchors give a ruleset a new engineer can read top to bottom without a vendor course. Rules go through the same review process as application code, and pf loads each new ruleset atomically.