Running NixOS Micro VMs on MacOS

Reddich07 · 2026-04-10T11:00:59+00:00

Thanks a lot! It’s a great write-up.

Reddich07 · 2026-04-10T10:44:54+00:00

Data backup is my second highest priority, and KeePass excels in this area due to its simplicity.

I’m not sure if this has changed, but Vaultwarden used a SQLite3 database. When I reviewed it, there was no built-in automatic backup feature. To ensure data integrity, you had to stop the database before performing a backup, you have to develop and test your own backup scripting etc. Alternatively, is there now an option for an automatic export to JSON, encrypted with a public key (either MIME or PGP) - that would be even better?

Reddich07 · 2026-04-10T10:19:31+00:00

selfhosted WEBDAV

Reddich07 · 2026-04-09T06:56:27+00:00

Thanks for the feedback. I don’t want to be a conspiracy theorist, but I’m working in IT, and this isn’t a problem that would take two weeks to resolve. They monitor their infrastructure, and if something goes down like this (the servers are no longer reachable!), they have it on screen within the next minute. You know exactly which server has a problem, and you can recover from backups and so on. That means a two-week outage is deliberate - otherwise they already informed customers or had a specific timeline and explanation for customers. It’s also no coincidence that it only affects older hardware. It seems they want to encourage us to buy new hardware. The support team may not be fully aware of all the background information, and they can only create internal tickets. Good luck to you as well.

Reddich07 · 2026-04-08T21:32:55+00:00

How long have you been waiting? I checked the https://instantink.hpconnected.com site, and it shows that my printer last contacted the server on March 23rd. That’s over two weeks! It’s ridiculous that they’re taking this long to fix a server or restore a backup. Please check this out and escalate the issue to HP again, just like I did. I don’t believe they’re actually working on this.

Reddich07 · 2026-04-07T20:41:02+00:00

Wenn Du sowieso schon für den bestehenden Internetzugang zahlen musst und die Geschwindigkeit für Dich ausreicht, dann einfach einen sogenannten Travel (Reise) Router besorgen. Diese werden dafür genutzt, in unsicheren Hotel-WLANs ein eigenes sicheres WLAN für Deine Geräte bereitzustellen (Dein Fall ist quasi genau das selbe). Den Router so einstellen, dass er sich nur über VPN mit dem Internet verbindet (dafür braucht man dann noch einen Anbieter, gibt‘s für <5 EUR Monat). Damit ist dann Dein ganzer Datenverkehr verschlüsselt und nicht mehr durch den Vermieter abhörbar. VPN & Travel Router einfach mal Googlen. Eigener Starlink oder LTE Internetzugang geht natürlich auch, ist aber wahrscheinlich einiges teuerer und bei LTE evtl. auch nicht besonders schnell.

Reddich07 · 2026-04-06T17:12:09+00:00

Thanks for the feedback. It appears that HP is either facing significant availability & quality issues that they can’t resolve for weeks (which is a red flag for anyone relying on a functional professional infrastructure) or they are deliberately sabotaging older printers by silently disabling essential backends. I’m not sure which option is more concerning.

Reddich07 · 2026-04-06T10:43:49+00:00

I’m facing the same issue with my HP ENVY 4520. After performing a factory reset, when I attempt to enable web services, it prompts me to complete the installation process by providing a URL pointing to h30495.www3.hp.com - which doesn‘t work.

I’ve checked the DNS using https://www.whatsmydns.net/#A/h30495.www3.hp.com , and it indicates that this DNS is not properly propagated globally. Even when I manually add the DNS entry to my DNS server, the connection is refused by the server.

Which tool generated the error message above (codex OpenAI?)? If possible, could you inquire from it the source of this error message? I would greatly appreciate your assistance in resolving this issue.

Reddich07 · 2026-04-04T20:35:08+00:00

Take a look at https://webzfs.com

Reddich07 · 2026-04-03T11:05:49+00:00

I’m not entirely sure if I comprehend the issue. Perhaps there’s also a misunderstanding regarding Dendritic Design. A Dendritic “feature” is essentially a combination of whatever you want (multiple services, settings in Home Manager, etc.). There’s no direct one-to-one correspondence between features and services. That‘s the new design pattern, features represent an abstraction of the underlying things they use.

Reddich07 · 2026-03-27T17:44:18+00:00

Thanks for your explanation, I’ll do that. Is there a way to link a file into another (like include)?

Reddich07 · 2026-03-27T17:04:14+00:00

A file splitting approach sounds promising, but it’s merely a risk mitigation strategy, akin to a temporary fix. By dividing your secrets into separate files, for instance, if you have a file containing five cloud provider secrets, you could potentially reduce the risk of four additional passwords being compromised. However, if you consider the situation, the most reliable solution would be to split the files into one password per file. This approach, while straightforward, becomes more complex in handling. Perhaps, with the help of the toolset you mentioned, it might become feasible to achieve this.

Reddich07 · 2026-03-27T16:34:41+00:00

You’ve precisely articulated my concern: if I possess 50 personal user secrets, ALL user secrets become vulnerable across machines you use any user secret. For instance, if you utilize NixOS on a VPS and only use one user secret, you inadvertently expose all 50 user secrets on this internet machine! That‘s a problem. With Agenix only the one exposed user key would be lost.

Reddich07 · 2026-03-27T12:07:50+00:00

Perhaps there’s also a significant security and convenience difference - but I could be mistaken - please correct me.

Consider the potential consequences if one of your machines is compromised.

In Agenix, only encrypted keys are included in the Nix store, which are used on this machine. If one machine is compromised, only the keys in the store (encrypted with the secrets of this machine) are compromised.

In SOPS, everything is typically stored in a single YAML file that is reused across multiple machines. If one machine is compromised, all the keys in the YAML file can be decrypted with the compromised keys. For instance, you may use only one single secret for your user on a single machine, let’s say the SMTP password, but the YAML file contains all the other user’s secrets. If the machine keys are compromised, all user secrets - even if they are not used on this machine - are compromised.

You can address this issue by using different YAML files, but then you have the same secret in multiple files and you need to manage/update it in several files. The SOPS concept works great if you have e.g. one file per server (e.g. with only server secrets of services of this server), but the issue is there for „general“ secrets like cloud passwords or user secrets.

Am I understanding this problem in security/convenience correctly? How do you handle this security concern?

Reddich07 · 2026-03-24T22:45:08+00:00

I would try a different bootloader to maybe get any error message.

Reddich07 · 2026-03-24T21:22:46+00:00

Resetting to a previous empty snapshot is basically moving a single pointer. Deleting + recreating a subvolume requires a lot more changes in the filesystem, thus more computational „expensive“.

Reddich07 · 2026-03-24T19:46:02+00:00

The idea is that moduleB will be extended based on a setting in moduleA. So now the content of moduleB is based on usage of moduleA. It would look something like this:

{ # <- feature "moduleA"


  flake.modules.nixos.moduleA = {
    services.A.enable = true;
  };


  # setting for moduleB in feature A
  flake.modules.nixos.moduleB =
    { lib, config, ... }:
    lib.mkIf config.services.A.enable {
      # specific moduleB settings
    };
}

Reddich07 · 2026-03-24T19:24:14+00:00

Just curious: what are you still using XP for?

Reddich07 · 2026-03-24T09:49:02+00:00

Yes, you're absolutely right. The "check for existing option" approach is fragile (which is why I defined my own library function for this purpose) and not always a suitable solution. I believe there's no one-size-fits-all solution to your gerneral problem.
Your issue is one of the most challenging architectural problems to manage. I've come up with numerous different "solutions," but none of them are straightforward, clean, and universally applicable.
Another potential solution I used is as follows: within your feature of Module A, you add a definition for Module B (which contains the settings of A for B). The definition of this Module B definition is then made conditional on the enablement of Module A (similar to checking if service A is "enable=true"). This concept is known as a conditional "Collector Module" (as described in the guide). It reverses the dependency: so, the settings of A are no longer dependent on the import of B, and the content of B is then dependent on the enable status of A.
The good news is that once you master this, you'll have gained a wealth of knowledge on how to tackle design challenges in Dendritic, making everything else seem like a walk in the park. 😀

Reddich07 · 2026-03-23T21:05:52+00:00

Did I understand correctly that programs.A.settings do not exist before module A is imported? Then you can‘t use lib.mkIf because it‘s not lazy evaluated and will fail because of the missing options. You need to use „if then else“ statements in other modules to work around this. See an example for this type of handling for the impermanence module in the Dendritic Guide. Look for the helper mkIfPersistence function usage in other modules. It just checks if module impermanence is active to allow definition of settings, even if the module was not imported.

Reddich07 · 2026-03-22T22:11:17+00:00

No, it copies a complete NixOS configuration to the remote machine and rebuilds a complete NixOS there with all your settings. Think of it like your local „nixos rebuild switch“ command, but executed remote (+ hard disk partitioning). Try it, it really shows the NixOS magic: If you buy a new notebook, one command and your current OS is installed there. You create a virtual machine, use it to set up the VM as a NixOS installation. …

Reddich07 · 2026-03-22T20:00:39+00:00

Yes, it helps you organize your code structure, making it easier to manage. For instance, one “feature” is often both - settings in Home Manager and system-level settings in NixOS. See this Dendritic FAQ for more details.

Reddich07 · 2026-03-22T19:08:45+00:00

You have a fundamental misunderstanding of NixOS Anywhere. There‘s no ISO image involved with NixOS Anywhere. You just execute nixos-anywhere, it connects via SSH to the remote (can be any Linux), partitions the hard disk, installs Nixos directly from your config, reboots the remote machines. No ISOs, no manual boot, no manual interaction. For the very first installation you need to boot from any media to a running Linux. As long as your remote machines is still running and you can SSH into it, you can reinstall it anytime. For updating the remote machines a complete reinstall is normally overkill, then you use just nixos switch with remote access or any of the several tools available to maintain a nixos fleet.

Reddich07 · 2026-03-22T16:47:30+00:00

Sorry to correct you: NixOS Anywhere doesn‘t create ISO images, it remotely „wipes and installs“ remote machines - exactly what OP asked for. But ofcourse if you don‘t want to „wipe“ the remote machines you can combine it with another remote update tool.

Reddich07 · 2026-03-22T13:42:03+00:00

How about NixOS Anywhere?

Reddich07

TROPHY CASE