It seems like Nix and NixOps are designed for this type of thing, since they're built on a functional language instead of yaml. But I haven't played with them too much yet -- anyone have experience using them?