What is Nest?

Nest generates infrastructure configs from a single source of truth. Describe your hosts and users once as a tree, classify them with traits, write rules that apply config by selector. All your environments come out of the same topology.

graph LR
    A["topology\n+ rules"] --> B["prod"]
    A --> C["staging"]
    A ==> D["devbox[llm=gpu-local,db=snapshot]"]

    B ==> BA["lb"]
    B ==> BB["web-1"]
    B ==> BC["web-2"]
    B ==> BD["db=prod"]
    BD --> BB
    BD --> BC

    BB --> BA
    BC --> BA

    C ==> CA["web-3[db=stg]"]

    A --> DA
    A --> DB

    DA["alice[devenv=frontend]"] --> D
    DB["bob[devenv=bakend]"] --> D

---

Three concepts

DOM — your infrastructure as a tree. Tree group nodes and share attributes down. Nodes are hosts, users, services.

Traits — mark nodes with what their traits. host, web, any semantic markers.

Rules — CSS-like selectors apply Nix config. Match node by name, Nix class, trait, attributes, or relation to other nodes in tree.

# trait: defines classification and shared data
nest.trait.web = { port = 8080; };

# node: marked with the traits it implements
nest.prod.web-1.is = [ host web ];

# rule: web-1 has web trait, so it gets nginx
nest.rules.web = { nixos.services.nginx.enable = true; }

# default config for all host nodes
nest.rules.host = { nixos.system.stateVersion = "25.11"; };

# more complex selectors refine config: web trait with monitoring Nix class
nest.rules."prod > web.monitoring" = { alivePath = "/_check/alive"; };

---

Multi-environment

Prod, staging, dev from one topology. Rules apply everywhere or per-environment.

Scale without friction

Add a host. All matching rules apply automatically.

Cross-host data

Rules query sibling nodes. Load balancers discover backends. /etc/hosts stays current.

Role-based access

Define users once. Rules assign them per environment and role.

---

Getting Started Five minutes to your first Nest config.

Multi-Environment Fleet Prod + staging topology with role-based users.

CSS Selectors Why CSS concepts work for infrastructure.

---

Try it Now

nix flake init -t github:vic/nest#default