Rigging

Opinionated multi-repo NixOS + Nomad infrastructure management. One CLI to rule all your flakes.

Rigging follows a dendritic pattern: each repo self-describes what it provides (hosts, Nomad jobs, secrets) via a flake-parts module. The rigging CLI aggregates any number of repos and gives you a single interface for deployments, job management, and secret rekeying — no more bouncing between nixos-rebuild, nix run .#bosun, and per-repo Justfiles.

Quick start

Add rigging to your flake:

# flake.nix
{
  inputs.rigging.url = "git+ssh://git@git.toph.so/toph/rigging.git";

  outputs = inputs: inputs.flake-parts.lib.mkFlake { inherit inputs; } {
    imports = [ inputs.rigging.flakeModules.default ];

    bosun = {
      meta.name = "myinfra";
      hosts = {
        webserver = {
          targetHost = "webserver.example.com";
          tags = [ "production" "web" ];
        };
      };
    };

    perSystem = { ... }: {
      bosun = {
        enable = true;           # only if you have Nomad jobs
        jobsDir = ./jobs;
        nomadAddress = "http://nomad:4646";
      };
    };
  };
}

Then register and go:

rigging repo add /path/to/myinfra
rigging status                        # see everything
rigging host deploy webserver         # nixos-rebuild switch
rigging job run forgejo               # compile + nomad job run
rigging secret rekey                  # agenix rekey across all repos

Architecture

• Flake-parts module (flake-module.nix) — repos import this to declare hosts/jobs/secrets and expose a bosun-manifest JSON derivation
• Nushell CLI (rigging) — reads ~/.config/bosun/config.toml, builds each repo's manifest, aggregates, dispatches
• Bash CLI (bosun) — repo-local Nomad operations (compile, run, plan, stop, logs) with runtime variable support