No experience with NASty, but:
Had a server die on me about a year ago and wanted more Infra as Code. Tried Fedora CoreOS first, but the cycle was constantly creating a new USB bootable, it was just a bad fit for me.
Switched to NixOS and definitely still not an expert, but it’s simple enough that 4 machines are running it. I really enjoy it. Already migrated a critical machine, where I basically used a second machine for A/B testing, to ensure minimal downtime and rollback possibility.
My deploy story is still kinda jank. I just looked at what worked and didn’t read too much about the internals. Using deploy-rs and falling back to nixos-anywhere when necessary.
Some new services were really basically as easy as adding services.example.enabled = true; and deploying.
Hope it helps an good luck!
Personally didn’t worry about it. Some issues in CoreOS with SELinux left a sour taste; tried to get my reverse proxy running, but a policy was missing and I either had to compile custom policies or turn off enforcement.
In NixOS, I was careful about checking file permission setup, service users and systemd service hardening options for the services I’m running. Defaults on what I installed seemed pretty good hardening, better than what I’d do myself.
I think it’s easy to overlook as a first time user that everything in the nix-store is readable to all, so no secrets in there, anywhere. I ended up using sops-nix.