manage, the Dolomite deploy tool

manage is the tool that drives Dolomite. The name is nothing clever; I am not good at naming things. It began as a nushell script of about 800 lines and was then rewritten in Rust, the second such rewrite in the Dolomite story after the nixpak launcher, and for the same reason: nushell while it was a script, safe Rust once correctness started to matter.

What it owns

manage covers far more than deployment. It is a single front-end to the whole machine lifecycle. It wraps or replaces nix build, nixos-rebuild, and the rest; it manages build artifacts and input overrides; and it wraps nixos-anywhere for provisioning. That scope is why colmena, nixops, and deploy-rs did not fit: they are deploy-only and shaped around an SSH root session, whereas manage owns build, provision, deploy, and secrets as one correctness-first tool, and it reaches targets they cannot, including non-NixOS machines and ones with no SSH at all.

Provisioning a machine

It uses disko everywhere it can, because a partition layout has to be written down somewhere, and once it is machine-readable manage can create it without a human, with no hand-partitioning step for an agent to get wrong. Impermanence, an ephemeral root wiped on boot, is used on some machines and not others; it is a per-machine choice, not a rule.

manage bootstraps sops by imperatively initializing the seed secrets: the initrd SSH key for remote unlock and the userspace SSH key. This resolves a chicken-and-egg problem, since the sops age keys derive from a host key a fresh machine does not have yet. It can also side-step sops entirely when that is what you want. That initrd SSH key is the remote-unlock capability: a machine can boot encrypted and be unlocked over the network.

Transport is not fixed. manage pushes over SSH by default, but it can pull, and it can consume signed artifacts instead.

A failed activation rolls back rather than stranding an encrypted, remote-unlock machine at a LUKS prompt no one can reach. That safety net is what lets Dolomite be bold about running modern, fast-moving components: a bad change is caught and reversed, not lived with in production.

When there is no SSH

Some products have no SSH access at all, HyperPrint among them, where Dolomite forms the basis of the firmware. For those, a companion daemon uses nix copy to pull builds from their CI. But the same daemon can be pointed at a package source of the end user's choosing, and from there build the entire OS from scratch. They do not need to trust us: the system rebuilds itself from source they control and proves its own provenance, rather than asking them to take our word.