12= Fleet3:order: 045An NixOS cluster deployment tool.67== Advantages over existing configuration systems (NixOps/Morph)89- Modules can configure multiple hosts at once (i.e. for wireguard/kubernetes installation)10- Secrets can be securely stored in Git (no one except target hosts can decrypt them), automatically regenerated, reencrypted, etc.11- Automatic rollback on deployment failure, which will work as long as system is passing initrd stage1213== Flake example1415[source,nix]16----17{18 description = "My cluster configuration";19 inputs = {20 nixpkgs.url = "github:nixos/nixpkgs";21 fleet = {22 url = "github:CertainLach/fleet";23 inputs.nixpkgs.follows = "nixpkgs";24 };25 flake-parts.url = "github:hercules-ci/flake-parts";26 };27 outputs = inputs:28 inputs.flake-parts.lib.mkFlake {inherit inputs;} {29 imports = [inputs.fleet.flakeModules.default];3031 fleetConfigurations.default = {32 nixos = {33 34 };3536 imports = [37 ./wireguard38 ];3940 hosts.controlplane-1 = {41 system = "x86_64-linux";42 nixos = {43 imports = [44 ./controlplane-1/hardware-configuration.nix45 ./controlplane-1/configuration.nix46 ];47 };48 };49 };50 };51}52----5354== Secret generator example5556[source,nix]57----58{config, ...}: {59 secrets = {60 gitlab-initial-root = {61 generator = {mkPassword}: mkPassword {};62 owner = "gitlab";63 group = "gitlab";64 };65 gitlab-secret = {66 generator = {mkPassword}: mkPassword {};67 owner = "gitlab";68 group = "gitlab";69 };70 };71 services.gitlab = {72 enable = true;73 initialRootPasswordFile = config.secrets.gitlab-initial-root.secret.path;74 secrets.secretFile = config.secrets.gitlab-secret.secret.path;75 };76}77----