Features & Capabilities

NXD reconciles Nix-authored desired state across the whole environment — the operating systems and the hypervisors, tailnet, and backup servers beneath them — through one evaluation, one action graph, and one approval gate.

Canonical configuration and evaluation

• Offline evaluation. nxd.lib.evalConfiguration turns consumer flake modules into a canonical JSON specification without contacting any endpoint or decrypting any secret. Planning cannot be influenced by the state of the infrastructure being planned against.
• Target-scoped selection. Evaluates the dependency closure for the selected targets rather than forcing a whole-site build, so planning one host does not evaluate every host.
• Direct flake integration. Consumes nixosSystem, darwinSystem, and homeManagerConfiguration derivations as OS closures.

Deterministic action graph

• Ordering across providers. One acyclic graph orders work that spans provider boundaries — mint a preauth key, create the guest, activate the OS, verify enrollment — because those dependencies are edges, not runbook steps.
• Five risk levels, lowest to highest: ReadOnly, Reversible, ServiceImpacting, Destructive, IdentityCritical. Plan output lists destructive and identity-critical actions first and names the exact resources touched.
• Bounded parallelism. Independent actions apply concurrently (--parallel, default 5) while the graph’s edges are still respected.

Digest-bound approval

• Plans are artifacts. Each plan is persisted and hashed; approval evidence binds to that exact digest.
• Fail-closed refusals. Apply refuses an expired plan, a digest mismatch, an approval summary that disagrees with the plan’s own actions, and any destructive plan reaching non-interactive stdin without evidence. Evidence cannot outlive the plan it approves.
• Approval is a separate, non-mutating command. nxd approval create and nxd approval validate never touch a target, so review can happen away from the machine that applies.

Secret mediation

• Nothing sensitive in the store. The Nix store is world-readable. Configuration and canonical JSON carry binding references such as secret/hosts/medo/tailscale-preauth-key — never values.
• Runtime resolution. SOPS/age resolves bindings at apply time into process memory, or into 0600 staging files when a subprocess needs a path. Values never appear in argv, logs, events, or URLs.
• Portable by construction. Host schemas carry no workstation-local paths or embedded credentials.

Transport and identity

• One shared SSH layer. Every provider uses nxd-transport, which enforces exact Ed25519 host key pinning with ControlMaster multiplexing by default. Host key verification and connection reuse are one decision enforced in one place, not twelve.
• Jump-host routing and per-target key material, with no ambient authority or unverified shell fallback.

Providers

Lifecycle intents

Selected with nxd plan --intent, and wrapped by ergonomic commands where a verb is used often:

switch additionally accepts --reactivate to re-activate an already-current target and --reenroll to replace host-plane enrollment. install takes --install-mode create|reinstall|replace for existing-guest policy.

Operator surfaces

• nxd dashboard — browse selected configuration, reviewed plans, and run history locally in a browser.
• nxd show / nxd info — inspect a persisted plan or a target’s provider-observed endpoint.
• nxd monitor, nxd cancel — follow and stop in-flight runs.
• nxd clean — dry run by default; with --apply archives only expired plans that carry no approval, journal, or pin evidence.
• --format json on plan and verify, for CI and coding agents.