Dassie on NixOS

Each Dassie release publishes a flake next to its downloads on get.dassie.land. It holds a NixOS module and a package made from the release's own signed binary, so nothing is compiled. The node runs with the same systemd units and sandbox as on any other Linux. What you need is the same as in the Quick Start, on NixOS with flakes.

Installation

Add Dassie's flake to your system's flake, and enable the node:

{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    dassie.url = "https://get.dassie.land/flake/latest.tar.gz";
    dassie.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = { nixpkgs, dassie, ... }: {
    nixosConfigurations.my-server = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        ./configuration.nix
        dassie.nixosModules.default
        {
          services.dassie.enable = true;
          services.dassie.openFirewall = true;
          users.users.alice.extraGroups = [ "dassie-users" ];
        }
      ];
    };
  };
}

Then rebuild with nixos-rebuild switch. The node listens on TCP ports 80 and 443 and UDP port 443, which openFirewall opens. Members of the group dassie-users may talk to the node, and the dassie command is on everyone's path.

flake/latest.tar.gz is the newest release's flake, and your flake.lock records the release it was, such as https://get.dassie.land/0.2.2/flake.tar.gz. To stay on one release, use that URL instead.

The module has a few more options: services.dassie.logLevel, and services.dassie.environment for the node's environment variables.

Checking the signature

Nix checks the flake by the hash in your flake.lock, not by the Dassie release key. To check once that what you locked is what the release key signed, download the flake and the release's signed sums, with VERSION the release your lock names, and check both:

curl -sSO https://get.dassie.land/VERSION/flake.tar.gz
curl -sSO https://get.dassie.land/VERSION/SHA256SUMS
curl -sSO https://get.dassie.land/VERSION/SHA256SUMS.minisig
minisign -Vm SHA256SUMS -P RWQyFJT+UgaWXQaBu5IkTRgPZjjYDNcCm4Sl6Wci0znLMDI0mJEoN3h2
sha256sum -c --ignore-missing SHA256SUMS

minisign prints the signature's trusted comment, but does not compare it: check that it says dassie VERSION, for the version you locked. Otherwise another release's signed sums would pass. The flake names each platform's download by the sum the release key signed, so from there on, Nix installs only the signed binary.

Configuration

As in the Quick Start: run sudo dassie init, and continue the setup in your browser at the URL it prints. dassie status shows how your node is doing, and its logs are in journalctl -u dassie.

Updating Dassie

On NixOS, Dassie does not update itself: the version is the one your flake locks. To update to the newest release, run:

nix flake update dassie
sudo nixos-rebuild switch

dassie status says that this binary is not updated, and it means the updater: Nix updates it instead.

Going back to an older version

A newer version may change the format of the node's database, and an older one refuses a database newer than it knows. If you go back to an older generation after such an update, the node does not start, and you put back the copy of the database it kept from before the change:

sudo systemctl stop dassie
sudo sh -c 'cd /var/lib/private/dassie && mkdir newer &&
  for file in dassie.sqlite3 dassie.sqlite3-wal dassie.sqlite3-shm; do
    [ ! -e "$file" ] || mv "$file" newer/
  done &&
  cp -p dassie.sqlite3.pre-migration dassie.sqlite3'
sudo systemctl start dassie

Only root may enter the node's data directory, so the commands run in one root shell. The newer database stays in newer/. The copy is from just before the newer version changed the database, so it goes back one version only.

Uninstallation

Remove the module from your configuration and rebuild. The node's data stays in /var/lib/private/dassie, in case you change your mind.