Selfhoster on NixOS here too.
Nix (and operating services on a NixOS machine) is a learning curve, and even though tho project is over 10 years old now the semantic differences between the conventional approach to distro design/software development/ops is still a source of friction. But the project has come a long way and lots of popular software is packaged and hostable and just works (when you are aware of said semantic differences)
But when it works, and it often it does, it's phenomenal and a very well integrated experience.
The problem in my exparience with using LLMs to assist is that the declarative nature of Nix makes them prone to hallucination: "Certainly, just go services.fooService.enable = true; in your configuraton.nix and you're off to the races". OTOH, because nix builds are hermetic and functional they're pretty safe to include as a verification tool that something like Claude code can use to iterate on a solution.
There are some pretty good examples of selfhosting system configurations one can use as inspiration. I just discovered github.com/firecat53/nixos that is an excellent example of a modular system configuration that manages multiple machines, secrets, and self hosted services.
Hmm isn't that a somewhat paradoxical take?
If the proposed solution is to pin your idea of what is safe on a rigorously formalised security policy, doesn't that entail that you know what you're doing (i.e. your problem domain is sufficiently narrow that you are capable of comprehending it fully) and isn't that exactly not the case with most/all(?) applications that benefit from AI?
Didn't read the complete article, so mea culpa, but some examples of systems where this is feasible would be welcome.
It certainly doesn't seem feasible for my goto example of software development using claude code.