netbox-nixos: automatically turning NetBox devices into NixOS configurations

NetBox has become a widely-used source of truth for datacentre and network infrastructure: devices, interfaces, IP addresses, prefixes, VLANs.
When those devices run NixOS, you'll want that data reflected in your NixOS configurations. Traditionally, the NixOS configuration lives in a repository and NetBox is treated as just another data source. If not managed very carefully, this results in error-prone maintenance and a steady supply of configuration drift.
netbox-nixos inverts that relationship and makes NetBox authoritative for NixOS configuration as well. Every NixOS device in NetBox is rendered into a NixOS configuration, served from a flake endpoint under NetBox's domain. Deploying a host is then just:

$ nixos-rebuild switch --flake https://my.netbox/nixos#myDevice --target-host root@myDevice

No repository round-trip, no drift. And as a bonus, non-Nix operators can manage host configuration directly through NetBox's UI.
In this talk we introduce netbox-nixos, show how a device configured in NetBox derives a complete NixOS configuration, and cover the questions this immediately raises: how NetBox's data model maps onto NixOS options, where the boundary sits between NetBox-owned network configuration and the modules you still write yourself, and what serving a flake from a live web service means for reproducibility and trust.

Kierán Meinhardt

Kierán Meinhardt fell down the Nix rabbit hole in 2018 by way of Haskell. Today, he is a NixOS consultant at Applicative Systems and a long-time regular at the weekly Berlin NixOS meetup. Upstream he is best known for introducing systemd-nspawn container tests to nixpkgs.