I feel like NixOS might be the only distro that could realistically handle all these use cases, but I’m a bit scared of the learning curve and the maintenance work it’d take to migrate everything over.

It’s a very steep learning curve, but I personally think it is worth it if what you want is to sync up all your various devices to a single common baseline configuration. I sought a single-distro solution for all of my systems for a long time and always ended up fragmenting them eventually because nothing I tried until NixOS was capable of handling such a diverse set of use cases in a way that would satisfy me.

I am similar to you, in that I regularly use a three server cluster, a gaming desktop, a multi-purpose personal laptop, and a work WSL instance on my work laptop. I still have some purpose-built distros where it makes sense; I use Proxmox for the actual server hosts themselves and then run NixOS VMs on them, along with running VMs for Home Assistant OS and TrueNAS (with the drives passed through, of course). All of these things I could do on raw NixOS (even Home Assistant is packaged in Nix, and there is a project to port Proxmox UI and tooling to NixOS) but I like the stability of the dedicated and battle-tested distros for critical infrastructure, especially for stuff whose configuration is very specific to a given task.

With NixOS, each other device has a consistent shared configuration and package set, they all get updated to the exact same versions thanks to flakes so everything works the same and as expected no matter where I am, and it’s all declaratively configured and documented in one spot. Spinning up a new system or rebuilding an existing system is as easy as pulling the config and changing a few relevant lines, and from there it effectively assembles itself from scratch to the exact state I want it to be in. There’s never any lingering packages or configuration cruft because the system is assembled from scratch every time it updates. Much of my home configuration is also managed, so aliases, environment variables, even vim configs are consistent across the board and set in one location.

The main downside is resource efficiency. Nix is designed to be reproducible and declarative, not fast or lean. It uses much more storage than a typical package manager, and packages are built with wide compatibility in mind so you often are leaving performance on the table from not using newer instruction sets like CachyOS. You can compile your own packages to fix that part, but that obviously takes a lot of spare processing power. I’ve been considering setting up my server cluster to do automatic building for me, but haven’t gotten around to it yet.

My main use case is using it to protect my exposed Home Assistant instance in a way that doesn’t require a VPN that family can screw up. I can just install the cert into the app for them and it Just Works. I also use it for my own Gotify notifications.

As a more general rule, I apply it to anything I want to expose but can’t easily protect using OIDC logins. I used to put more behind it, but I recently opened up my services to friends and family, so I moved to using Authentik as my primary defense for most things. mTLS was great when it was just me, I can easily install the cert into my own browser and all of my Android apps (except Firefox Android…) but friends and family just zone out when I explain why their new phone doesn’t connect, so I had to adjust my systems to compensate.

It’s definitely dried up a fair bit over the last couple of years. In January 2025 I got some recertified 12TB Ironwolfs for $140 each from GoHardDrive, and that was already a fair bit over what they historically had been. Same drives are now $200 on GoHardDrive, and $220 on Amazon. You can just get them new $250, so at that point I barely think it’s worth it to get recertified unless you’re really stretching a budget. I’m sure the businesses are very happy with the demand they got now, but it’s hard to escape the conclusion that LTT and other Youtubers covering these sites really drove up demand and prices.

Also, the smaller drives are a lot harder to find recertified these days since enterprise users will usually go for much larger capacities, so yeah, for 4TB you’ll probably have to go for new. You could also just get a larger drive and only use 4TB of it, assuming this is going into some kind of array. Upgrade the other one at a later date, then just expand your pool!

Authentik has done the opposite of enshittification. As they’ve gotten more successful, they’ve taken enterprise features and moved them into the community edition. I’ve been extremely happy with Authentik so far and the dev has been nothing short of fantastic every time I’ve seen them interacting with the community.

Something you might want to look into is using mTLS, or client certificate authentication, on any external facing services that aren’t intended for anybody but yourself or close friends/family. Basically, it means nobody can even connect to your server without having a certificate that was pre-generated by you. On the server end, you just create the certificate, and on the client end, you install it to the device and select it when asked.

The viability of this depends on what applications you use, as support for it must be implemented by its developers. For anything only accessed via web browser, it’s perfect. All web browsers (except Firefox on mobile…) can handle mTLS certs. Lots of Android apps also support it. I use it for Nextcloud on Android (so Files, Tasks, Notes, Photos, RSS, and DAVx5 apps all work) and support works across the board there. It also works for Home Assistant and Gotify apps. It looks like Immich does indeed support it too. In my configuration, I only require it on external connections by having 443 on the router be forwarded to 444 on the server, so I can apply different settings easily without having to do any filtering.

As far as security and privacy goes, mTLS is virtually impenetrable so long as you protect the certificate and configure the proxy correctly, and similar in concept to using Wireguard. Nearly everything I publicly expose is protected via mTLS, with very rare exceptions like Navidrome due to lack of support in subsonic clients, and a couple other things that I actually want to be universally reachable.

Use lemmy.ml how you want to use it, and if you want to participate in other political leanings, go to a different instance. No one is really stopping you, and that’s the whole idea of the fediverse. And there really isn’t any value lost, because this isn’t a “choose one and only one” situation. You’ve got all of the fediverse at your fingertips.

Until you make the mistake of replying with the wrong kind of comment to the wrong sub, and get banned from the entire instance and lose the ability to post on many of the largest subs on this side of the fediverse. Or maybe they just see you out and about and decide to ban you on sight because they don’t like what you said. There’s nothing stopping that.

Admin overreach and abuse is a major issue for the fediverse because it affects more than just the user in question. Admins of large instances get to decide who has access to the users and communities on their instances, and very often the users of the instance aren’t even aware of the actions taken on their behalf. Mastodon recently implemented a notification for when blocks and defederation remove your follows or followers, and this is a great first step. Users deserve to know when they are impacted by decisions such as these.

I love the fediverse and want to see it thrive, so we need to stop putting our heads in the sand on this issue. It’s always discussed as if it’s an issue with a few problematic instances rather than the systemic issue in need of a solution that is is. Admins need the tools to protect their instances from real abuse, but we need to balance that with the right of the users to know what’s going on and not be unfairly deprived of the social aspect of this social media experiment, especially without knowing.

I have no idea how you’re getting packages older than Debian. Unstable is a rolling release and stable has a 6 month release cadence with no LTS. Were you pulling from an old dead repo? If you followed an outdated guide, they probably linked you to an old one.

I do agree that the learning curve is steep and the knowledge is nontransferrable though. In my case, that just encouraged me to unify all my systems onto NixOS at home. Not sure if that’s a solution or addiction yet.