NixOS/Nix for runner setup automation

[dergoegge]

See initial discussion in #90

[dergoegge]

Re #90 (comment)

You are currently using docker for this, right?

Fuzzor itself is just a rust project but it uses docker to build and run fuzzing campaigns for the supported projects. The main thing that is run and manages the fuzzing campaigns is: https://github.com/dergoegge/fuzzor/blob/master/fuzzor-cmds/src/bin/fuzz-project.rs (it assumes that docker is installed and the base image exists on the system).

This sounds like something that's done about once by a user?

The base image is built once but needs to be updated occasionally (e.g. to bump the used LLVM version etc.).

We can ignore initial corpus fetch for now, but yes that would most likely happen once (but potentially also more often).

that wouldn't resolve your "hoster restarted my host"?

That's true, I guess nix run should be automatically launched on restart.

[0xB10C]

That's true, I guess nix run should be automatically launched on restart.

On NixOS you get this with "modules", which are basically systemd services with a bit of human-friendly configuration on top. You get these on e.g. Ubuntu or Debian too. You tell systemd to make sure a service runs after reboot.

Here's the bitcoind module in NixOS for example. You configure it with "options", e.g. prune as listed on https://search.nixos.org/options?channel=25.11&query=services.bitcoind#show=option%253Aservices.bitcoind.%253Cname%253E.prune

services.bitcoind."mainnet" = {
    enable = true;
    prune = 450;
};

from https://github.com/NixOS/nixpkgs/blob/687f05a9184cad4eaf905c48b63649e3a86f5433/nixos/modules/services/networking/bitcoind.nix#L135-L154

which then get applied into the systemd service https://github.com/NixOS/nixpkgs/blob/687f05a9184cad4eaf905c48b63649e3a86f5433/nixos/modules/services/networking/bitcoind.nix#L213-L260

In your case that would probably be a systemd service starting a docker container. And if the docker container stops, the systemd unit would "fail" and try to restart automatically, which you can alert on.

You can also have timers that run something like a "fetch base img" each night.

But a systemd unit and timer file is possible on Ubuntu too.

[dergoegge]

Thank you! Sounds to me that, NixOS + nix modules is a reasonable way to codify the maintenance.

[0xB10C]

For peer-observer, I ended up having a very involved and opinionated libary flake that defines how a peer-observer node should look like with all monitoring and everything setup: https://github.com/peer-observer/infra-library - the implementation of a node ends up looking something like this: https://github.com/peer-observer/infra-demo/blob/e89aaef4aef14003532269732a8d11219e13e359/infra.nix#L34-L81

But I don't recommend you start there. You probably want to ship a NixOS Module for it in a flake.nix first. I'm not too sure about a Nix package, as you'll still be building and running your fuzzor binary in docker. The flake.nix can live in this repostiory and people can use it into their host definitions with something like:

...

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-25.11";
    fuzzor = {
      url = "github:dergoegge/fuzzor";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };


  outputs =
    {
      self,
      nixpkgs,
      fuzzor
      ...
    }:

...

and then for their host set

services.fuzzor = {
   enable = true;
   project = "bitcoind";
   ...
};

which could automatically make sure docker is enable (or assert if it's not)

Claude is pretty good at Nix, and if you point him to this discussion, I think he can come up with something that will work well. Happy to test it a bit.