Deploy: declarative deployment on NixOS

[oesteban]

Operators should be able to describe a node in a configuration file and have it come up, identically, on every machine they run.

This uses NixOS, a Linux distribution whose whole system is defined by declarative configuration and builds reproducibly. Two Nix terms recur below. A flake is Nix's standard unit for a reproducible, version-pinned build, so nix run gives everyone the exact same binary. A NixOS module is a reusable piece of configuration that adds a service to a system, here services.dspeer.

This task delivers a first-class NixOS module and a flake that builds both the daemon and the client reproducibly. It adds an automated test in which two nodes federate a collection inside a virtual machine on every commit. It is developed in dialogue with the NixOS packaging community.

Outcomes

• services.dspeer NixOS module: hardened systemd unit with a dedicated user and state directory, declarative collection and peer configuration, and a generated option reference
• Flake building daemon and client reproducibly; nix run works from a clean checkout on an unprepared machine
• NixOS virtual-machine integration test in CI: two nodes federate a collection inside the test harness on every commit
• Declarative state, backup and secret handling wired to module options, compatible with the two standard NixOS secret-management tools (sops-nix and agenix)