NixOps User's Guide

The LUKS volumes to be created. The name of each attribute set specifies the name of the LUKS volume; thus, the resulting device will be named /dev/mapper/name.

Default: { }

Example: { secretdisk = { device = "/dev/xvdf"; passphrase = "foobar"; } ; }

Declared by:

If the underlying device does not currently contain a filesystem (as determined by blkid, then automatically initialise it using cryptsetup luksFormat.

Default: false

Declared by:

The cipher used to encrypt the volume.

Default: "aes-cbc-essiv:sha256"

Declared by:

The underlying (encrypted) device.

Default: none

Example: "/dev/xvdg"

Declared by:

The size in bits of the encryption key.

Default: 128

Declared by:

The passphrase (key file) used to decrypt the key to access the volume. If left empty, a passphrase is generated automatically; this passphrase is lost when you destroy the machine or underlying device, unless you copy it from NixOps's state file. Note that unless deployment.storeKeysOnMachine is set to false, the passphrase is stored in the Nix store of the instance, so an attacker who gains access to the disk containing the store can subsequently decrypt the encrypted volume.

Default: ""

Declared by:

The RAID-0 volumes to be created. The name of each attribute set specifies the name of both the volume group and the logical volume; thus, the resulting device will be named /dev/name/name.

Default: { }

Example: { bigdisk = { devices = [ "/dev/xvdg" "/dev/xvdh" ] ; } ; }

Declared by:

The underlying devices to be combined into a RAID-0 volume.

Default: none

Example: [ "/dev/xvdg" "/dev/xvdh" ]

Declared by:

The AWS Access Key ID. If left empty, it defaults to the contents of the environment variables EC2_ACCESS_KEY or AWS_ACCESS_KEY_ID (in that order). The corresponding Secret Access Key is not specified in the deployment model, but looked up in the file ~/.ec2-keys, which should specify, on each line, an Access Key ID followed by the corresponding Secret Access Key. If it does not appear in that file, the environment variables environment variables EC2_SECRET_KEY or AWS_SECRET_ACCESS_KEY are used.

Default: ""

Example: "AKIAIEMEJZVMPOHZWKZQ"

Declared by:

EC2 identifier of the AMI disk image used in the virtual machine. This must be a NixOS image providing SSH access.

Default: none

Example: "ami-ecb49e98"

Declared by:

Block device mapping. /dev/xvd[a-e] must be ephemeral devices.

Default: { }

Example: { /dev/xvdb = { disk = "ephemeral0"; } ; /dev/xvdg = { disk = "vol-d04895b8"; } ; }

Declared by:

The cipher used to encrypt the disk.

Default: "aes-cbc-essiv:sha256"

Declared by:

For automatically created EBS volumes, determines whether the volume should be deleted on instance termination.

Default: none

Declared by:

EC2 identifier of the disk to be mounted. This can be an ephemeral disk (e.g. ephemeral0), a snapshot ID (e.g. snap-1cbda474) or a volume ID (e.g. vol-d04895b8). Leave empty to create an EBS volume automatically.

Default: ""

Example: "vol-d04895b8"

Declared by:

Whether the EBS volume should be encrypted using LUKS.

Default: false

Declared by:

Filesystem type for automatically created EBS volumes.

Default: "ext4"

Declared by:

The provisioned IOPs you want to associate with this EBS volume.

Default: 0

Declared by:

The size of the encryption key.

Default: 128

Declared by:

The passphrase (key file) used to decrypt the key to access the device. If left empty, a passphrase is generated automatically; this passphrase is lost when you destroy the machine or remove the volume, unless you copy it from NixOps's state file. Note that the passphrase is stored in the Nix store of the instance, so an attacker who gains access to the EBS volume or instance store that contains the Nix store can subsequently decrypt the encrypted volume.

Default: ""

Declared by:

Filesystem size (in gigabytes) for automatically created EBS volumes.

Default: 0

Declared by:

URI of an Amazon EC2-compatible cloud controller web service, used to create and manage virtual machines. If you're using EC2, it's more convenient to set deployment.ec2.region.

Default: none

Example: "https://ec2.eu-west-1.amazonaws.com/"

Declared by:

Whether you want to boot from an EBS-backed AMI. Only EBS-backed instances can be stopped and restarted, and attach other EBS volumes at boot time. This option determines the selection of the default AMI; if you explicitly specify deployment.ec2.ami, it has no effect.

Default: true

Declared by:

Preferred size (G) of the root disk of the EBS-backed instance. By default, EBS-backed images have a root disk of 20G. Only supported on creation of the instance.

Default: 0

Declared by:

Elastic IPv4 address to be associated with this machine.

Default: ""

Example: "203.0.113.123"

Declared by:

The name of the IAM Instance Profile (IIP) to associate with the instances.

Default: ""

Example: "rolename"

Declared by:

EC2 instance type. See http://aws.amazon.com/ec2/instance-types/ for a list of valid Amazon EC2 instance types.

Default: "m1.small"

Example: "m1.large"

Declared by:

Name of the SSH key pair to be used to communicate securely with the instance. Key pairs can be created using the ec2-add-keypair command.

Default: none

Example: "my-keypair"

Declared by:

Attribute set containing number of CPUs and memory available to the machine.

Default: { }

Example: { cores = 4; memory = 14985; }

Declared by:

Path of the SSH private key file corresponding with deployment.ec2.keyPair. NixOps will use this private key if set; otherwise, the key must be findable by SSH through its normal mechanisms (e.g. it should be listed in ~/.ssh/config or added to the ssh-agent).

Default: ""

Example: "/home/alice/.ssh/id_rsa-my-keypair"

Declared by:

Amazon EC2 region in which the instance is to be deployed. This option only applies when using EC2. It implicitly sets deployment.ec2.controller and deployment.ec2.ami.

Default: ""

Example: "us-east-1"

Declared by:

Security groups for the instance. These determine the firewall rules applied to the instance.

Default: [ "default" ]

Example: [ "my-group" "my-other-group" ]

Declared by:

EC2 tags assigned to the instance. Each tag name can be at most 128 characters, and each tag value can be at most 256 characters. There can be at most 10 tags.

Default: { }

Example: { foo = "bar"; xyzzy = "bla"; }

Declared by:

Specifies the type of cloud. This affects the machine configuration. Current values are "ec2" and "nova".

Default: "ec2"

Example: "nova"

Declared by:

The EC2 availability zone in which the instance should be created. If not specified, a zone is selected automatically.

Default: ""

Example: "us-east-1c"

Declared by:

NixOps will set up an encrypted tunnel (via SSH) to the machines listed here. Since this is a two-way (peer to peer) connection, it is not necessary to set this option on both endpoints. NixOps will set up /etc/hosts so that the host names of the machines listed here resolve to the IP addresses of the tunnels. It will also add the alias machine-encrypted for each machine.

Default: [ ]

Declared by:

The set of keys to be deployed to the machine. Each attribute maps a key name to a key string. On the machine, the key can be accessed as /run/keys/name>. Thus, { password = "foobar"; } causes a file /run/keys/password to be created with contents foobar. The directory /run/keys is only accessible to root.

Default: { }

Example: { password = "foobar"; }

Declared by:

List of emailaddresses of the owners of the machines. Used to send email on performing certain actions.

Default: [ ]

Declared by:

The AWS Access Key ID. If left empty, it defaults to the contents of the environment variables EC2_ACCESS_KEY or AWS_ACCESS_KEY_ID (in that order). The corresponding Secret Access Key is not specified in the deployment model, but looked up in the file ~/.ec2-keys, which should specify, on each line, an Access Key ID followed by the corresponding Secret Access Key. If it does not appear in that file, the environment variables environment variables EC2_SECRET_KEY or AWS_SECRET_ACCESS_KEY are used.

Default: ""

Example: "AKIAIEMEJZVMPOHZWKZQ"

Declared by:

The DNS hostname to bind the public IP address to.

Default: ""

Example: "test.x.logicblox.com"

Declared by:

The time to live (TTL) for the A record created for the specified DNS hostname.

Default: 300

Example: 300

Declared by:

If true (default), secret information such as LUKS encryption keys or SSL private keys is stored on the root disk of the machine, allowing the machine to do unattended reboots. If false, secrets are not stored; NixOps supplies them to the machine at mount time. This means that a reboot will not complete entirely until you run nixops deploy or nixops send-keys.

Default: true

Declared by:

This option specifies the type of the environment in which the machine is to be deployed by NixOps. Currently, it can have the following values. "none" means deploying to a pre-existing physical or virtual NixOS machine, reachable via SSH under the hostname or IP address specified in deployment.targetHost. "ec2" means that a virtual machine should be instantiated in an Amazon EC2-compatible cloud environment (see deployment.ec2.*). "virtualbox" causes a VirtualBox VM to be created on your machine. (This requires VirtualBox to be configured on your system.)

Default: "none"

Example: "ec2"

Declared by:

This option specifies the hostname or IP address to be used by NixOps to execute remote deployment operations.

Default: none

Declared by:

Definition of the virtual disks attached to this instance.

Default: { }

Example: { big-disk = { port = 1; size = 1048576; } ; }

Declared by:

If set, this disk is created as a clone of the specified disk image (and the size attribute is ignored).

Default:

Example: "/home/alice/base-disk.vdi"

Declared by:

SATA port number to which the disk is attached.

Default: none

Example: 1

Declared by:

Size (in megabytes) of this disk.

Default: none

Declared by:

If set, the VirtualBox instance is started in headless mode, i.e., without a visible display on the host's desktop.

Default: false

Declared by:

Memory size (M) of virtual machine.

Default: 512

Declared by:

NixOps extends NixOS' fileSystem option to allow convenient attaching of EC2 volumes.

Default: none

Declared by:

EC2 disk to be attached to this mount point. This is shorthand for defining a separate deployment.ec2.blockDeviceMapping attribute.

Default:

Declared by:

The cipher used to encrypt the disk.

Default: "aes-cbc-essiv:sha256"

Declared by:

For automatically created EBS volumes, determines whether the volume should be deleted on instance termination.

Default: none

Declared by:

EC2 identifier of the disk to be mounted. This can be an ephemeral disk (e.g. ephemeral0), a snapshot ID (e.g. snap-1cbda474) or a volume ID (e.g. vol-d04895b8). Leave empty to create an EBS volume automatically.

Default: ""

Example: "vol-d04895b8"

Declared by:

Whether the EBS volume should be encrypted using LUKS.

Default: false

Declared by:

Filesystem type for automatically created EBS volumes.

Default: "ext4"

Declared by:

The provisioned IOPs you want to associate with this EBS volume.

Default: 0

Declared by:

The size of the encryption key.

Default: 128

Declared by:

The passphrase (key file) used to decrypt the key to access the device. If left empty, a passphrase is generated automatically; this passphrase is lost when you destroy the machine or remove the volume, unless you copy it from NixOps's state file. Note that the passphrase is stored in the Nix store of the instance, so an attacker who gains access to the EBS volume or instance store that contains the Nix store can subsequently decrypt the encrypted volume.

Default: ""

Declared by:

Filesystem size (in gigabytes) for automatically created EBS volumes.

Default: 0

Declared by:

A set of peer-to-peer tunnels set up automatically over SSH.

Default: { }

Example: { tunnel1 = { localIPv4 = "172.16.12.1"; localTunnel = 0; privateKey = "/root/.ssh/id_vpn"; remoteIPv4 = "172.16.12.2"; remoteTunnel = 1; target = "192.0.2.1"; } ; }

Declared by:

IPv4 address of the local endpoint of the tunnel.

Default: none

Declared by:

Local tunnel device number.

Default: none

Declared by:

Path to the private key file used to connect to the remote machine.

Default: none

Declared by:

IPv4 address of the remote endpoint of the tunnel.

Default: none

Declared by:

Remote tunnel device number.

Default: none

Declared by:

Host name or IP address of the remote machine.

Default: none

Declared by:

IPv4 address of this machine within in the logical network. This address can be used by other machines in the logical network to reach this machine. However, it need not be visible to the outside (i.e., publicly routable).

Default: none

Example: "10.1.2.3"

Declared by:

Publicly routable IPv4 address of this machine.

Default: none

Example: "198.51.100.123"

Declared by:

The AWS Access Key ID.

Default: none

Declared by:

Amazon Resource Name (ARN) of the queue. This is set by NixOps.

Default: ""

Declared by:

Name of the SQS queue.

Default: "charon-<uuid>-<name>"

Declared by:

Amazon EC2 region.

Default: none

Declared by:

URL of the queue. This is set by NixOps.

Default: ""

Declared by:

The time interval in seconds after a message has been received until it becomes visible again.

Default: 30

Declared by:

The AWS Access Key ID.

Default: none

Declared by:

Name of the EC2 key pair.

Default: "charon-<uuid>-<name>"

Declared by:

Amazon EC2 region.

Default: none

Declared by:

The AWS Access Key ID.

Default: none

Declared by:

Amazon Resource Name (ARN) of the S3 bucket. This is set by NixOps.

Default: "arn:aws:s3:::charon-<uuid>-<name>"

Declared by:

Name of the S3 bucket.

Default: "charon-<uuid>-<name>"

Declared by:

Amazon S3 region.

Default: none

Declared by:

The AWS Access Key ID.

Default: none

Declared by:

Name of the IAM role.

Default: "charon-<uuid>-<name>"

Declared by:

The IAM policy definition (in JSON format).

Default: none

Declared by: