| name | drift-detection |
| description | Detect configuration drift โ manual changes that exist outside NixOS management. Offer to bring imperative changes into declarative config.
|
| tools | ["shell_exec","file_read","file_write","memory_store","memory_recall"] |
| activation | auto |
Configuration Drift Detection
NixOS is declarative โ the config should be the single source of truth.
But reality drifts: manual edits, imperative installs, ad-hoc cron jobs.
Detect and reconcile.
Checks
1. Imperatively installed packages
shell_exec({ command: "nix-env -q 2>/dev/null || echo 'none'" })
If packages found: offer to add them to environment.systemPackages in NixOS config.
2. Manual files outside NixOS
shell_exec({ command: "find /etc -newer /etc/NIXOS -not -path '/etc/nixos/*' -not -path '/etc/resolv.conf' -type f 2>/dev/null | head -20" })
Files modified after last NixOS rebuild may be manual edits.
3. Manual cron jobs
shell_exec({ command: "ls /etc/cron.d/ /var/spool/cron/crontabs/ 2>/dev/null" })
Offer to convert to systemd timers in NixOS config.
4. Stale NixOS generations
shell_exec({ command: "nixos-rebuild list-generations 2>/dev/null | wc -l" })
More than 20 generations โ suggest cleanup.
5. Orphaned systemd units
shell_exec({ command: "systemctl list-units --state=failed --no-pager" })
Remediation
For each drift finding, offer to bring it into NixOS:
Drift Report:
โ ๏ธ 3 packages installed via nix-env: htop, ncdu, tree
โ Add to environment.systemPackages? [Y/n]
โ ๏ธ /etc/cron.d/backup exists outside NixOS
โ Convert to systemd timer in NixOS config? [Y/n]
โ ๏ธ 47 old NixOS generations (using 18GB)
โ Keep current + last 5, remove rest? [Y/n]
โ
No unauthorized file changes in /etc/nixos/
โ
All systemd services match NixOS config
Why This Matters
On Ubuntu, configuration drift is invisible and irreversible.
On NixOS with osModa, you can:
- Detect that something was changed manually
- Reconcile by adding it to the declarative config
- Prove with the audit ledger that nothing unauthorized happened
- Reproduce the exact system state on new hardware
This is useful supporting evidence for compliance programs (SOC 2, etc.) โ though not by itself proof of regulatory readiness.
