Open table of contents
Conclusion
OpenTofu compares resource configuration with state to produce a change plan. Nix can declare the environment used to perform that work. Pinning both does not freeze cloud resources, credentials or external services. Record reproducibility separately for tools, change inputs and the deployed environment.
Three things to manage
| Subject | Managed inputs | What pinning alone does not solve |
|---|---|---|
| Execution environment | Nix inputs, CLI and supporting tools | Host compatibility and valid credentials |
| Change inputs | Configuration, variables, modules and provider versions | External API behavior and manual changes |
| Deployed environment | State, resources, permissions and dependencies | Drift, concurrent changes and recovery constraints |
Review the provider lock file, module references and Nix inputs separately. A provider lock does not pin every module or execution tool.
Changing an existing project
These commands assume the project already has its configuration, authentication, state backend and locking, and a Nix development environment.
nix develop
tofu version
tofu init -lockfile=readonly
tofu validate
tofu plan -out=review.tfplan
tofu show -no-color review.tfplanIf initialization fails with -lockfile=readonly, investigate a missing lock file or a mismatch with configuration. Keep ordinary change review separate from dependency updates and review any required update explicitly.
Inspect deletion, replacement, permissions, exposure and unexpected resources in the plan. Tie approval to the configuration revision and saved plan. If configuration, state or the deployed environment changes before application, reassess and obtain a new plan and approval where necessary.
State and saved plans may contain secrets. Keep them out of public repositories and broadly accessible logs; manage storage, encryption, access and retention.
Recovery needs its own procedure
Returning configuration to an earlier revision does not necessarily restore deleted data or reverse external effects. A state backup is not a substitute for application-data backups. Separate resource recreation, data restoration and checks before resuming service, including availability of recovery credentials.
Trade-offs and Limitations
Pinned environments and saved plans make differences easier to explain, while adding dependency maintenance, state protection and review operations. Evaluate reproducibility and recoverability independently; successfully running the same commands is not a sufficient completion criterion.
Sources
- OpenTofu plan
- OpenTofu Sensitive Data in State
- Nix: Declarative shell environments
- Managing Kubernetes Updates with Nix
Related case context
These cases provide attributed design context. They do not establish that the proposed experiments or configurations were delivered in those engagements.