NixOS Declarative Configuration and Instant Rollback: A Practical Guide

The problem: configuration drift in traditional Linux

When administrators edit files manually, run ad‑hoc scripts, or mix package managers, the system state diverges from what is documented. Auditing becomes a forensic exercise and recovering from a broken update often means reinstalling or chasing down missing dependencies.

Thesis: NixOS makes the whole OS a pure function of a declarative file

In NixOS every package, service, and filesystem layout is expressed in "\/etc\/nixos\/configuration.nix". Changing a line triggers a deterministic rebuild that yields a new system generation. Each generation is stored immutably under "\/nix\/var\/nix\/profiles" and can be booted or rolled back instantly.

Worked example: adding nginx and rolling back

1. Edit "\/etc\/nixos\/configuration.nix" and add services.nginx.enable = true;.
2. Run the rebuild as root:

   sudo nixos-rebuild switch

3. Verify the service:

   systemctl status nginx

   should show active (running).
4. To test rollback, intentionally break the config: set services.nginx.enable = false; and add a bogus line like services.nginx.nonExistent = true;.
5. Run

   sudo nixos-rebuild switch

   again; the build will fail.
6. Roll back to the last working generation:

   sudo nixos-rebuild switch --rollback

   .
7. Confirm the system is back:

   systemctl status nginx

   shows active and ls -l "\/run\/current-system" points to the previous generation directory.

Trade‑offs and practical limits

• Learning curve: the Nix language is functional and lazy; initial investment is required to write modules or overlays.
• Build time: if a substitute is not available, NixOS compiles packages from source, which can be lengthy on low‑power or bandwidth‑constrained hosts.
• Imperative leaks: running commands like apt-get install or editing files outside "\/etc\/nixos" breaks reproducibility; such changes must be encapsulated in Nix modules or avoided.

Actionable closing

Start by experimenting in a virtual machine, commit your "\/etc\/nixos\/configuration.nix" to Git, and make it a habit to list generations with

sudo nix-env --list-generations -p "\/nix\/var\/nix\/profiles\/system"

before major updates. Over time the atomic upgrades and instant rollbacks turn system maintenance from a risky chore into a reliable, version‑controlled process.