Docs: how-to for pairing system-manager with an Ansible convergence oneshot

[Dauliac]

Hi,

I've been running system-manager on a Debian workstation for a few months and hit the usual wall: system-manager handles everything that has a Nix module, but a real host still needs a pile of things that don't (kernel cmdline tweaks on a specific distro, vendor firmware quirks, dpkg diversions, PAM lines, apt repo pinning, per-user dotfiles under $HOME).

I've been solving this by pairing system-manager with a small Ansible layer that runs as a single systemd oneshot (ansnix.service), gated by a hash-based ExecCondition so it stays idle when nothing changed. system-manager owns the reproducible surface, Ansible owns the residue. The library is here: https://github.com/Dauliac/ansnix.

Would a short how-to page in the system-manager docs on this pattern be welcome? Rough outline:

• When to reach for it (no upstream Nix module exists, or the module doesn't cover the distro-specific bits).
• The oneshot unit shape: ExecCondition on a config hash so it's a no-op after convergence.
• Failure model: activation fails loud if the oneshot exits non-zero.
• Explicit non-goals: not a replacement for Nix modules, not a way to skirt reproducibility.

Happy to draft the PR against the docs tree if there's appetite. If the answer is "we'd rather not endorse this pattern," that's also a useful signal I'd like to hear before writing.

Thanks.

[zimbatm]

Hi Dauliac,

Thanks, providing and documenting fallbacks is a good idea, and helps for scenarios where we can't move everything to a pure environment. Being able to move a good chunk of the config to Nix is already helpful to reduce maintenance. The alternative is to have everything in Ansible, which is strictly worse.