Linux

There is a world of difference between a bash script and something like NixOS. The most important difference is that with NixOS something that you don't specify won't be there. Whereas a bash script (or other config management tools like Puppet, Chef or Ansible) only mutate things listed.

So it is very easy to write a script like:

ensure_installed python3
write_file /etc/foo.cfg 'thing = 7'
chgrp users /mnt/backups

But if you remove ensure_installed python3 it will stay installed. You can try to be very careful and always add ensure_not_installed python3 but this is both error prone and dead code as soon as you run it. I used to have a script like this and I used each of configuration management tools mentioned above and always ran into these issues. The exact error flow would be something like this:

1. Enable/setup some service A that pulls in package X.
2. Disable service A or remove package X because it isn't needed anymore.
3. Write configuration for service B.
4. Forget to add ensure_installed X but it works anyways because X is still installed from step 1.

Now you have a non-reproducible config because if you try to re-install or setup service B on a new machine it won't work because X isn't present. This may sound like a niche problem but I ran into it almost every time I tried to bring up a new machine using my config.

It is still possible to do this in NixOS as it isn't completely reproducible (you can have mutable state) but in general it is much harder because any configuration that isn't specified doesn't exist. As soon as you remove package X or service Y from your config it is removed from your system. I've been using NixOS for 8 years now and this problem is mostly gone. It is definitely more reproducible than bash scripts and it has a tangible effect on my workflow.

I wrote a blog post about it a long time ago but the core is still relevant: https://kevincox.ca/2015/12/21/service-management-with-nixos/.