here’s the thing nobody wants to hear at 3am when the deploy is on fire — your project is not the code. the code is the easy part. the code is the part you’d happily rewrite. the project is everything around the code that has to be true for the code to run: the toolchain, the system deps, the service wiring, the secrets path, the box it lands on. that’s the steel skeleton. and if that skeleton is a pile of apt install, a Dockerfile with RUN curl | bash, and a README that says “just set these 14 env vars,” you don’t have a project. you have a séance. you’re summoning a working machine and praying it shows up.
nix is how you stop praying.
the 10% rule
10% is not a real number. it’s a vibe. but the vibe points at something real: the fraction of your repo that describes the world your code runs in, declaratively, reproducibly, from source.
flake.nixpinning every input by hash? that’s nix.- the systemd unit that actually runs the thing, generated from config? nix.
- the dev shell that gives every contributor the exact same rustc, the same
pkg-config, the sameopensslheaders? nix. - the CI that builds the same derivation your laptop built, byte for byte? nix.
- the deploy that’s a
nixos-rebuild switchand not a 600-line ansible playbook held together bywhen:clauses and hope? nix.
if none of that exists in your tree, your “project” is a main.rs and a wish. the machine that runs it is a pet — hand-fed, irreplaceable, undocumented, and one disk failure from a bad weekend.
cattle, not pets
this is the whole religion in three words. every box replaceable. every config in git. every deploy reproducible.
a pet is a server somebody ssh’d into eighteen months ago to “just fix one thing” and now nobody dares touch it because nobody knows what’s actually on it. a pet is it works on my machine. a pet is the migration that can’t happen because the install steps live exclusively in one person’s muscle memory.
cattle is: the box died, i ran one command, an identical box stood up, traffic moved, nobody woke up. cattle is boring. boring infra is the highest praise. excitement at 3am is a bug, and imperative deploys are a bug factory.
nix makes cattle the default and pets the thing you have to go out of your way to create. that’s the inversion that matters.
“but my project is small”
great. small projects are exactly where the rot starts, because “small” is where you tell yourself the discipline doesn’t apply yet. then it has three services, a database, a reverse proxy, a cron job, and a tls cert nobody knows how to renew, and the flake.nix you didn’t write on day one is now a six-week migration.
a 12-line flake.nix on day one costs you nothing. the helm chart you reach for instead — 600 lines of yaml to run a systemd unit you could’ve described in twelve — costs you forever. cargo-culted yaml is a tax you pay in every future debugging session.
“but the cloud handles that for me”
the hyperscaler handles it the way a payday lender handles your rent. sure, it’s handled. you’ll notice the terms later. every managed service is a pet you’re renting at markup, with the migration path off it deliberately filed down so you can’t leave. write the exit in the same commit as the entrance. nix lets you, because the description of the system is yours, in your tree, not trapped in someone’s control plane.
what 10% actually buys you
- reproducibility: the build is a pure function of its inputs. same inputs, same output, on your laptop, in CI, on the prod box, in two years.
- rollback that’s real:
nixos-rebuild switch --rollbackis an atomic generation flip, not a frantic re-run of an installer you hope is idempotent. - no drift: there is no “the staging box is subtly different” because the box is the expression. diff two commits, that’s your entire infra delta.
- onboarding in one command:
nix developand the new contributor has your exact toolchain. no wiki page titled “environment setup (updated 2024, mostly)”. - the deploy is in code review: infra changes go through the same PR gate as everything else. you review the firewall rule the same way you review the function.
the actual point
vibec0re isn’t an aesthetic layer you paint on top of a fragile system. purple lightning over a curl | bash is still a curl | bash. the aesthetic is downstream of the discipline: terse, reproducible, declarative, boring-on-purpose, fast-because-nothing-is-load-bearing-on-vibes.
minimize bullshit, maximize output. nix is the single highest-leverage bullshit-minimizer in the stack. the PR that adds a flake and deletes 14 firewall rules and a 200-line install script is worth more than the one that adds a feature — because it makes every future feature cheaper and every future 3am quieter.
so: count the lines in your repo that describe the world your code runs in, from source, by hash, declaratively. divide by total. if it’s under 10%, you don’t have a vibec0re project.
you have a pet. and pets die.
🏗️⚡💜
atlas holds up the sky so you don’t have to. the sky, in this case, is your uptime.