Nix fleet configuration

One flake. Every machine.

Collective is a typed Nix flake that configures thirty machines, from NixOS servers and WSL devboxes to a Mac, its Linux VM and Android phones. They share one registry, one module tree and one command, and their builds happen somewhere else first.

Why it is built this way

Most dotfile repositories describe one computer and copy it to the next. Collective describes a fleet, so the same change lands on a phone, a laptop and a cloud devbox, and a new machine is one registry entry. Five ideas carry it.

A typed inventory

Each machine is a value such as Tagged [VM WSL] System.NixOS.X86, not a string. A misspelt platform fails evaluation instead of silently doing nothing, and every fleet list, cache map and SSH target derives from the same entries. Fleet

Assembled, not copied

Machines get their modules from their type: agnostic modules, their platform's tree, the public flake, tag modules and first-party project modules. Machine directories hold only what is genuinely theirs. Architecture

Built elsewhere

Cache nodes build other machines from an immutable revision of main and publish them. A phone activates its closure with cltv switch --cached, which refuses anything older than what it already runs. Delivery

Infrastructure as modules

The CI runner fleet, binary caches, liveness reporting and even the Windows hosts under the WSL devboxes are declared and converged like any other service. CI runners

Agents are users too

Coding agents, their skills, model gateway, credentials and fleet services are installed by the same modules, and their live configuration is editable without a rebuild. Agents & AI

The everyday loop

1. Change a module or the registry

   Everything lives in one repository: machines in machines/, shared modules in modules/, packages in pkgs/ and live configuration in standalone/.

2. Evaluate without switching

   Ask the evaluated configuration of any machine a question before anything is built.

   cltv nix eval home -e 'config.programs.zsh.enable'cltv nix eval system -e 'config.services.openssh.enable' \    --system-name NAME --system-type nixos

3. Try a package without installing it

   Run any package from the configured package set at the checkout's pins, without touching the profile.

   cltv run tools#aztts -- --version

4. Push to main; cache nodes prebuild

   Every two hours, each cache node archives the newest revision of main, builds the machines assigned to it and publishes them to its Attic cache.

5. Switch

   Evaluate and build here, or activate the prebuilt generation, or pull and switch a list of machines at once, each in its own tmux window over SSH.

   cltv switchcltv switch --cachedjust collective-switch all --cached

Where to go

• FleetThe registry: typed systems, tags, groups and roles, and the lists that derive from them.
• ArchitectureTwo flakes, machine assembly, special arguments, overlays, the first-party tool path and live configuration.
• DeliverySwitch modes, scheduled prebuilds, self-hosted Attic caches and activation that only moves forward.
• CI runnersA declared GitHub Actions fleet: ephemeral pools, a registration gate and health checks for silent failures.
• PlatformsWSL devboxes that converge Windows, the Mac and its Linux VM, desktops, handhelds and containers.
• AndroidPhones as fleet members: services, Termux and Shizuku bridges, Tailscale, nested Wayland and APKs.
• Agents & AIAgent CLIs, the model gateway, credential recovery between machines, skills and local inference.
• OperationsSecrets without reading them, fleet liveness, fleet-wide recipes and the runbooks behind the design.
• Librarycollective-lib: types, dispatch, variadic functions, collections, logging and inline tests in Nix.
• cltv CLIEvery command and option, generated from the commands' own help, and the framework behind them.
• DevelopmentEvaluate, test and check changes without switching; conventions and hand-off.