I posted this in the Terranix channel, but am hoping to get more eyes on it - sorry for double posting!

The high level idea I have is as follows:

1. Orchestrator flake: sources all other flakes using input following. Hydra builds this flake, and some cron job regularly runs flake update to pick up new changes to all packages in the pipeline.
2. Pipeline flake: a set of impure builds with a sequential dependency chain that are responsible for executing terraform plan and apply for each stage. These builds would use something like fixed output derivations with a fake hash to skirt network sandboxing. Integration tests would also be represented this way.
3. Infrastructure flake: defines the terranix infrastructure, gets used by the various pipeline stages for deployment.
4. Application flakes: flakes that define how to build and package application code, these get used by the infrastructure flake.

Then configure Hydra, and one machine should be able to act as a full devops pipeline?

This should let developers easily work on any subset of the system in a local workspace by modifying the flake inputs, as well as allowing things like manual deployments for rollbacks or emergency situations. There might be flaws with this idea, but I am curious to hear what folks think