Remotely deploying NixOS configuration using SSH Jump Host

nixos-rebuild --target-host <user@host> is a powerful tool to remotely deploy a NixOS configuration. However, there are scenarios where you can’t reach a machine directly but need an SSH jump host.

Suppose you want to deploy to the host 192.168.124.42, which is only reachable from the host ssh-gate. Then your nixos-rebuild invocation might look as follows:

NIX_SSHOPTS="-J user1@ssh-gate" nixos-rebuild switch --flake ".#target-host" \
      --target-host "user2@192.168.124.42" \
      --use-remote-sudo \
      --use-substitutes \
      --verbose

It’s simple as that. Using -J <jumphost> option (see man page), we instruct SSH to find the right remote via the jump host.