Dassie on NixOS

Each Dassie release publishes a flake next to its downloads on get.dassie.land. It holds a NixOS module and a package made from the release's own signed binary, so nothing is compiled.

The node runs with the same systemd units and sandbox as on any other Linux. What your server needs is on Requirements: here, NixOS with flakes, on x86-64 or arm64, takes the place of the installer.

Installation

Add Dassie's flake to your system's flake, and enable the node:

{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    dassie.url = "https://get.dassie.land/flake/latest.tar.gz";
    dassie.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = { nixpkgs, dassie, ... }: {
    nixosConfigurations.my-server = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        ./configuration.nix
        dassie.nixosModules.default
        {
          services.dassie.enable = true;
          services.dassie.openFirewall = true;
          users.users.alice.extraGroups = [ "dassie-users" ];
        }
      ];
    };
  };
}

Then rebuild:

$sudo nixos-rebuild switch

The node listens on TCP ports 80 and 443, UDP port 443 for QUIC, and UDP port 7768 for requests for its snapshot, the signed quotes it swaps assets at. openFirewall opens all four. The node doesn't start while another program holds UDP port 443. Members of the group dassie-users may talk to the node, and the dassie command is on everyone's path.

flake/latest.tar.gz is the newest release's flake, and your flake.lock records the release it was, such as https://get.dassie.land/0.3.0/flake.tar.gz. To stay on one release, use that URL instead.

The module's options are enable, package, log, environment and openFirewall, all under services.dassie. NixOS module options describes each.

Checking the signature

Nix checks the flake by the hash in your flake.lock, not by the Dassie release key. To check once that what you locked is what the release key signed, download the flake and the release's signed sums, with VERSION the release your lock names, and check both:

$curl -sSO https://get.dassie.land/VERSION/flake.tar.gz
$curl -sSO https://get.dassie.land/VERSION/SHA256SUMS
$curl -sSO https://get.dassie.land/VERSION/SHA256SUMS.minisig
$minisign -Vm SHA256SUMS -P RWQyFJT+UgaWXQaBu5IkTRgPZjjYDNcCm4Sl6Wci0znLMDI0mJEoN3h2
$sha256sum -c --ignore-missing SHA256SUMS

minisign prints the signature's trusted comment, but does not compare it: check that it says dassie VERSION, for the version you locked. Otherwise another release's signed sums would pass. The flake names each platform's download by the sum the release key signed, so from there on, Nix installs only the signed binary.

Why it works this way: the flake carries the signed binaries, not a build of its own.

Setting it up

From here it is the same as on any server. Give the node its domain name and a certificate, then set it up:

$sudo dassie init

It asks for the domain name, your agreement to Let's Encrypt's terms and an email address, gets the certificate, and prints a link. Open it in your browser: the wallet makes your recovery phrase there and sets the node up. Write the phrase down; it is the only way back into your node. The Quick Start walks through it, and Set up your wallet covers the wallet's side.

To set the node up from a phrase on the server instead, with no browser, use dassie setup: see Headless setup, which has a unit for NixOS too.

The node's environment comes from the module, not from drop-ins:

services.dassie.log = "dassie::peer=debug";
services.dassie.environment = {
  DASSIE_EXTRA_CA_FILE = "/etc/dassie-roots.pem";
};

Configure your node explains the variables. dassie status shows how your node is doing, and its log is in journalctl -u dassie.

Updating Dassie

On NixOS, Dassie does not update itself: the version is the one your flake locks. To update to the newest release, run:

$nix flake update dassie
$sudo nixos-rebuild switch

dassie status says that this binary was not installed by the installer, so it is not updated. That is about Dassie's own updater: Nix updates it instead.

Coming from a 0.2 release? Its database and phrase don't work with 0.3.0, and a 0.2 node can't peer with a newer one. Set the node up again, with a new phrase, from a fresh database: A node from the 0.2 releases.

Going back to an older version

A newer version may change the format of the node's database, and an older one refuses a database newer than it knows. If you go back to an older generation after such an update, the node does not start, and you put back the copy of the database it kept from before the change:

$sudo systemctl stop dassie
$sudo sh -c 'cd /var/lib/private/dassie && mkdir newer &&
  for file in dassie.sqlite3 dassie.sqlite3-wal dassie.sqlite3-shm; do
    [ ! -e "$file" ] || mv "$file" newer/
  done &&
  cp -p dassie.sqlite3.pre-migration dassie.sqlite3'
$sudo systemctl start dassie

Only root may enter the node's data directory, so the commands run in one root shell. The newer database stays in newer/. The copy is from just before the newer version changed the database, so it goes back one version only.

Uninstallation

Remove the module from your configuration and rebuild. The node's data stays in /var/lib/private/dassie, in case you change your mind. It holds your node's key and books; see Uninstall before you delete it.