12= Fleet3:slug: index4:order: 056An NixOS cluster deployment tool.78== Advantages over existing configuration systems (NixOps/Morph)910- Modules can configure multiple hosts at once (i.e. for wireguard/kubernetes installation)11- Secrets can be securely stored in Git (no one except target hosts can decrypt them), automatically regenerated, reencrypted, etc.12- Automatic rollback on deployment failure, which will work as long as system is passing initrd stage1314== Flake example1516[source,nix]17----18{19 description = "My cluster configuration";20 inputs = {21 nixpkgs.url = "github:nixos/nixpkgs";22 fleet = {23 url = "github:CertainLach/fleet";24 inputs.nixpkgs.follows = "nixpkgs";25 };26 flake-parts.url = "github:hercules-ci/flake-parts";27 };28 outputs = inputs:29 inputs.flake-parts.lib.mkFlake {inherit inputs;} {30 imports = [inputs.fleet.flakeModules.default];3132 fleetConfigurations.default = {33 nixos = {34 35 };3637 imports = [38 ./wireguard39 ];4041 hosts.controlplane-1 = {42 system = "x86_64-linux";43 nixos = {44 imports = [45 ./controlplane-1/hardware-configuration.nix46 ./controlplane-1/configuration.nix47 ];48 };49 };50 };51 };52}53----5455== Secret generator example5657[source,nix]58----59{config, ...}: {60 secrets = {61 gitlab-initial-root = {62 generator = {mkPassword}: mkPassword {};63 owner = "gitlab";64 group = "gitlab";65 };66 gitlab-secret = {67 generator = {mkPassword}: mkPassword {};68 owner = "gitlab";69 group = "gitlab";70 };71 };72 services.gitlab = {73 enable = true;74 initialRootPasswordFile = config.secrets.gitlab-initial-root.secretPath;75 secrets.secretFile = config.secrets.gitlab-secret.secretPath;76 };77}78----