---
title: "nixa — NixOS, declarative. nixad — your assistant."
url: https://nixa.systems/en/
lang: en
description: "nixa is the NixOS configuration of an entire fleet of machines, nixad the assistant that goes with it: questions in plain language, changes only after approval. A real session to read along."
updated: 2026-10-09
---

# nixa — NixOS, declarative. nixad — your assistant.

```
NixOS Stage 2 (nixa)
[  OK  ] Started Network Configuration.
[  OK  ] Reached target Network is Online.
[  OK  ] Started nixad Daemon.
[  OK  ] Reached target Multi-User System.

[root@rinzler:~]# NIXBIN=$(dirname $(readlink -f /proc/$(pgrep -x nixad-daemon)/exe))/nixad
[root@rinzler:~]# NIXAD_API_SOCKET=/run/nixad/api.sock "$NIXBIN"
nixad ▸ what timeout does the sshd jail currently have
ℹ No data available for the sshd jail. Please run a system scan or provide a configuration/@/path marker that defines the sshd jail.
nixad ▸ install fail2ban and show me the current disk usage
✓ fail2ban is already installed, disk usage shows no critical bottlenecks.
  ✓ fail2ban is installed: fail2ban (version 1.1.0) is already present in the Nix store and can be enabled through the NixOS configuration.
  [system_packages]
  ✓ Disk usage within the normal range: the main partition /dev/sda3 (35G) is 22% full (7.0G used). No partition shows critical utilisation.
  [df]
nixad ▸ show me the fail2ban config
ℹ Reading file contents requires an explicit path marker (@/path) or an attached file. Please provide the exact path to the fail2ban configuration,
e.g. '@/etc/fail2ban/jail.local' or '@/etc/fail2ban/jail.conf'.
nixad ▸ @/etc/fail2ban/jail.conf
✓ The fail2ban configuration at /etc/fail2ban/jail.conf has not been modified locally and matches the default configuration from the Nix store.
  ✓ Default configuration from the Nix store: the file /etc/fail2ban/jail.conf is a symlink to the default configuration from the Nix store
  (/nix/store/k7wq1drs2dr2mvczy011i77ax908rghg-fail2ban-1.1.0/etc/fail2ban/jail.conf). There are no local modifications. [file contents match the
  Nix store path]
:apply      :approve    :ask        :attach     :daemon     :options    :proposals  :reject     :skills
nixad ▸ :skiils
· Help: unknown command ':skiils'. Available: :ask :apply :attach :daemon :proposals :approve :reject :skills :options
nixad ▸ :skills
· Help: usage: :skills reload
nixad ▸ :proposals
ℹ Open proposals: #24  proactive: ssh_bruteforce   2d ago
      The log shows 5 invalid SSH login attempts within the last hour (5 events, 100% of the last hour). The average rate over the last day is
      1.71, which points to an ongoing threat. Fail2Ban is the native NixOS answer for blocking such sources automatically.
:approve <id> · :reject <id> · :proposals
nixad ▸
rinzler · tui v0.1.0 (84dbe46) · daemon v0.1.0 (84dbe46) · up 59d
```

## One configuration for the whole fleet

nixa is the NixOS configuration of every machine here: servers, workstations, laptops, all in one repository.

Each machine is declared rather than grown over the years — whatever is not in the configuration does not exist.

If a machine is lost, the same commit brings it back identical. rinzler, the host in the terminal above, is one of them.

## The assistant that understands the configuration

nixad is an assistant for NixOS in plain language, written in Rust: a daemon on the host, a TUI in front of it.

It reads the state of the system, answers questions about it and puts changes forward as proposals — on its own initiative too, when something catches its eye.

Nothing is applied without approval: :approve is the only way into the configuration.

## Let us talk about it

[$ mail kontakt@dominik.saar.systems](mailto:kontakt@dominik.saar.systems)

nixa and nixad are built at Dominik Saar.Systems in the Westerwald, Germany. Access to the repositories on request.