https://youtube.com/watch?v=-Ck0c9bpzjw
youtube.com

https://github.com/mcdonc/.nixconfig/blob/master/videos/nix-serve/script.rst

Btw, why is remote caching with substituter so iffy with NixOS? I encountered the same issues demonstrated in the video. It’s not obvious why an offline substituter should block a local rebuild unless there is some nix option denoting as optional or required. Or why some matching entries in the remote nix-serve store are ignored (or untrusted?)

  • balsoft@lemmy.mlEnglish
    41·
    3 days ago

    I think the current best solution to this is to add your substituter to trusted-substituters and then add it to the nixConfig.extra-substituters attribute of your system config flake (or do some NIX_CONFIG hackery in your .envrc if you’re not using flakes). That way if that substituter dies, you can easily disable it (by removing it from your system flake) without rebuilding the configuration.

    Oh, and BTW, Nix has a --fallback option that will rebuild locally if a substituter is not available, but that will make things painfully slow, better to use the method I previously mentioned.

    • ruffslOPEnglish
      2·
      3 days ago

      Do you know of a complete example or live config I could read through as a reference for that first method recommended?

      I’d also be interested in complete examples for a working pair of remote builder and local client (both NixOS multi user), as all the documentation I’ve come across thus far are either:

      • balsoft@lemmy.mlEnglish
        3·
        3 days ago

        I don’t have an exact example to hand because I’m not using a custom substituter for now. I have a remnant of that in my config still, here: https://github.com/balsoft/nixos-config/blob/master/flake.nix#L5 . But it should be relatively straightforward: add nix.settings.trusted-substituters = [ "http://your-substituter/" ]; to your (client device) NixOS config (e.g. in configuration.nix); add nixConfig.extra-substituters = [ "http://your-substituter/" ]; to your config flake.nix; answer yes when prompted by nixos-rebuild, and you should be good.

        As for remote builders, I don’t really dig them myself. They require fully trusting all users who wish to build on them and are finicky to set up. Instead I just ssh into the build machine, build whatever I need there, and nix copy it back to my laptop. That said,

        intent on modifying root ssh configs in spite of security practices

        You can set up your nix-daemon to run as its own user nowadays, mitigating all issues related to root entirely.

        botch use of substituters on the remote builder

        Never had this issue so don’t really know how to help

        is awkward or incompatible with non-interactive sudo sessions

        This one is pretty much unfixable due to how remote building works

        works for nixos build but not to switch

        You should probably use nixos-rebuild switch --use-remote-sudo and run it as your user rather than root.