netbox-nixos: automatically turning NetBox devices into NixOS configurations
NetBox has become a widely-used source of truth for datacentre and network infrastructure: devices, interfaces, IP addresses, prefixes, VLANs.
When those devices run NixOS, you'll want that data reflected in your NixOS configurations. Traditionally, the NixOS configuration lives in a repository and NetBox is treated as just another data source. If not managed very carefully, this results in error-prone maintenance and a steady supply of configuration drift.
netbox-nixos inverts that relationship and makes NetBox authoritative for NixOS configuration as well. Every NixOS device in NetBox is rendered into a NixOS configuration, served from a flake endpoint under NetBox's domain. Deploying a host is then just:
$ nixos-rebuild switch --flake https://my.netbox/nixos#myDevice --target-host root@myDevice
No repository round-trip, no drift. And as a bonus, non-Nix operators can manage host configuration directly through NetBox's UI.
In this talk we introduce netbox-nixos, show how a device configured in NetBox derives a complete NixOS configuration, and cover the questions this immediately raises: how NetBox's data model maps onto NixOS options, where the boundary sits between NetBox-owned network configuration and the modules you still write yourself, and what serving a flake from a live web service means for reproducibility and trust.
Kierán Meinhardt fell down the Nix rabbit hole in 2018 by way of Haskell. Today, he is a NixOS consultant at Applicative Systems and a long-time regular at the weekly Berlin NixOS meetup. Upstream he is best known for introducing systemd-nspawn container tests to nixpkgs.
Jacek Galowicz is a systems architect, Nixpkgs contributor and maintainer of the NixOS Integration Test Driver. He is the founder of Applicative Systems, a software development consulting firm, and Nixcademy, corporate Nix/NixOS training provider. With a background ranging from microhypervisors, CI/CD automation, and writing technical books, Jacek focuses on building resilient, machine-verified software infrastructure that lasts.