Allow nix.conf options to be set in flake.nix #4189

edolstra · 2020-10-26T19:48:00Z

This makes it possible to have per-project configuration in flake.nix, e.g. binary caches and other stuff:

nixConfig.bash-prompt-suffix = "�[1;35mngi# �[0m";
nixConfig.substituters = [ "https://cache.ngi0.nixos.org/" ];

@garbas

This makes it possible to have per-project configuration in flake.nix, e.g. binary caches and other stuff: nixConfig.bash-prompt-suffix = "�[1;35mngi# �[0m"; nixConfig.substituters = [ "https://cache.ngi0.nixos.org/" ];

thufschmitt · 2020-10-27T06:19:42Z

How would that work with dependencies? Like if I depend on a flake foo that sets some Nix options. Would these be ignored or inherited in the top-level flake?

edolstra · 2020-10-27T08:14:35Z

Currently it only uses options from the top-level flake. Since dependencies are fetched lazily that's really the only option, unless we propagate options into the lock file.

matthewbauer · 2020-10-27T19:23:38Z

How useful is substituters without the "trusted-public-keys" setting? Without setting that, I think you just get an error when a new substituter is enabled (unless you happen to have it allowed in your global config). Of course allowing trusted-public-keys per-project is probably a security concern.

It would be nice UX to prompt users if no trusted key matches, asking if they trust the cache URL. If not, it would get on a list of "untrusted-public-keys" so we would avoid trying it in the future.

garbas · 2020-10-27T21:35:25Z

src/libexpr/flake/flake.cc

@@ -223,10 +228,41 @@ static Flake getFlake(
    } else
        throw Error("flake '%s' lacks attribute 'outputs'", lockedRef);

+    auto sNixConfig = state.symbols.create("nixConfig");


I think we can safely rename this to only config.

No, that would be ambiguous with config used in the NixOS module system.

garbas · 2020-10-27T22:51:09Z

Allowing to specify custom binary cache at the project level is worth all this trouble. That would mean no need to explain to your users / coworkers to add a binary cache. And I'm not alone by saying that this is not the easiest thing to do in Nix.

How useful is substituters without the "trusted-public-keys" setting? Without setting that, I think you just get an error when a new substituter is enabled (unless you happen to have it allowed in your global config). Of course allowing trusted-public-keys per-project is probably a security concern.

It would be nice UX to prompt users if no trusted key matches, asking if they trust the cache URL. If not, it would get on a list of "untrusted-public-keys" so we would avoid trying it in the future.

I assume that @edolstra didn't add it to the list of possible options exactly because of the security concern. But it is also true that without it wouldn't pull binaries from the cache. I can only agree with @matthewbauer that we need to prompt users in cache no trusted key matches.

Here are some my ideas / questions / concerns, without thinking about implementation, but trying to put myself in the user and try to meet expectations:

Using the name substitutors is confusing since we are talking about binary cache. As a novice nix user adding a binary cache would mean adding and url to the binary-caches list. (I will use binary-caches from now on).
Most of the time there is one public key per cache. It is easy to miss some keys when adding them to a separate list. Keys could easily be paired with the binary cache. For backward compatibility we can still allow substituters and trusted-public-keys. Example:
```
{
 config.binary-caches = [
   "https://cache.nixos.org"
   # or
   { url = "https://cache1.example.com"; }
   # or
   { url = "https://cache2.example.com";
     key = "cache2.example.com-1:....";
   }
 ];
}
```
User simply providing a link should be enough for nix to (1) check if we trust the binary cache (2) and if we don't where to go to get the correct public keys (and how to do it securely).
When nix detects that we don't have correct public keys (that we don't trust the binary cache) we should prompt the user that (only once for a user, we can store this state in ~/.cache/nix/...) there is no existing key that we already trust and that a user should (go this this url, if this is possible to get from cache and) provide a binary cache with a link to the documentation on how to do it securely.
flake-registry could/should also provide a list of binary cache with public key (as it is a trusted source). If adding an binary cache from the list of caches on flake-registry we could propose to the use to add it.
Currently the nix command does not have any interactive UI in the command line interface. I'm assuming that we would want to change this also for the other commands. We should of course also add an option (eg. --dont-ask / --no-interactive) at the nix command level to disable interactive mode all together.

This is what I have so far, but I'm really happy with this coming to Nix.

edolstra · 2020-10-28T10:07:43Z

binary-caches exists as a deprecated alias of substituters. It's not a good name because there are substituters that are not binary caches and that you might want to configure in flake.nix, e.g. ssh://some-server.

andir · 2020-10-28T16:28:13Z

I like the idea of having per-project configuration. In the past I had to use some weird hacks with direnv to get my nix CLI use a slightly different configuration for some customer project. Not being able to set a public key is reasonable but I wonder what the value in this is if we can't use our own caches? We would still need system-wide (or if trusted, user local) configuration of trusted signing keys. How many binary caches are there that someone would be using in a project/company to warrant that not being configured the same time you configure the public keys?

The given example of an SSH substituters might be the only one I really see as "complete" here. At least with SSH it is common to configure authenticaiton outside of what Nix can do (right now).

As long as we keep the number of supported settings as restrictive as proposed in this PR this is probably fine. If we ever expand it further (e.g. allowing users to set sandbox = false) we should think about requiring an explicit "ack" from the user (the first time the flake, in that version, is being built). I really like the direnv model for confirmation from users.

domenkozar · 2020-10-29T07:36:24Z

src/libexpr/flake/flake.cc

+        if (name != "bash-prompt-suffix" &&
+            name != "bash-prompt" &&
+            name != "substituters" &&
+            name != "extra-substituters")


netrc-file?

Maybe if it's relative to the flake directory, otherwise it's probably not very useful.

I guess to make netrc-file useful we’d also need extra-sandbox-paths?

Btw. I wonder why the path of netrc-file is not automatically added to sandbox? Is there any use of setting this option without adding the path to sandbox?

netrc-file should only be read by the Nix builtin fetchers which aren't subject to sandboxing rules.

nixos-discourse · 2020-11-05T16:51:15Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/tweag-nix-dev-update-4/9862/1

domenkozar · 2020-11-17T15:51:32Z

@edolstra no netrc-file or public keys support? That really limits the use of binary caches for flakes.

nixos-discourse · 2020-12-17T15:11:04Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/tweag-nix-dev-update-5/10560/1

blaggacao · 2020-12-17T20:19:36Z

I want to link to a nascent community project with certain scope overlap. I furthermore suggest and encourage, as far as I'm conceded to do so, to explore any so opportunity for collusion and thought entanglement https://github.com/numtide/devshell

jmatsushita · 2021-03-13T17:41:31Z

For those who like me, wonder where to add the nixConfig attribute, I found here that it is a top level attribute in a flake.nix. So it's used like so:

{
  description = "...";
  nixConfig.bash-prompt = "\[nix-develop\]$ ";
  ...
}

nixos-discourse · 2022-01-25T18:18:47Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/nix-2-6-0-released/17324/11

Allow nix.conf options to be set in flake.nix

343239f

This makes it possible to have per-project configuration in flake.nix, e.g. binary caches and other stuff: nixConfig.bash-prompt-suffix = "�[1;35mngi# �[0m"; nixConfig.substituters = [ "https://cache.ngi0.nixos.org/" ];

garbas reviewed Oct 27, 2020

View reviewed changes

domenkozar reviewed Oct 29, 2020

View reviewed changes

edolstra merged commit 4dbd05e into NixOS:master Nov 17, 2020

edolstra deleted the flake-config branch November 17, 2020 14:39

garbas mentioned this pull request Mar 6, 2021

Configure cli flags via flake.nix #4611

Open

manveru mentioned this pull request Jun 30, 2021

Default to 21.05, standard shell, binary cache aggregation, elimination of etwa alte scheiße 😌 input-output-hk/bitte#38

Merged

ldesgoui mentioned this pull request Aug 1, 2021

Write Nix 2.4 release notes #4521

Closed

lilyball mentioned this pull request Jan 25, 2022

Document nixConfig attribute in flake.nix #5988

Closed

This was referenced Mar 31, 2022

add cache substituter srid/emanote-template#4

Merged

add cache substituter to flake srid/emanote#273

Merged

bcdarwin mentioned this pull request May 10, 2023

set $PS1 or export an environment variable to be displayed in existing $PS1 a la debian_chroot LKS-CHART/medical-imaging-nix#15

Open

jamesdbrock mentioned this pull request Jun 6, 2023

nix flake check breaks on IFD in multi-platform flake #4265

Open

JonathanLorimer mentioned this pull request Dec 13, 2023

Include cache settings in flake informalsystems/cosmos.nix#191

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow nix.conf options to be set in flake.nix #4189

Allow nix.conf options to be set in flake.nix #4189

edolstra commented Oct 26, 2020

thufschmitt commented Oct 27, 2020

edolstra commented Oct 27, 2020

matthewbauer commented Oct 27, 2020 •

edited

garbas Oct 27, 2020

edolstra Nov 17, 2020

garbas commented Oct 27, 2020

edolstra commented Oct 28, 2020

andir commented Oct 28, 2020

domenkozar Oct 29, 2020

edolstra Oct 29, 2020

adrian-gierakowski Nov 12, 2020

matthewbauer Nov 12, 2020

nixos-discourse commented Nov 5, 2020

domenkozar commented Nov 17, 2020

nixos-discourse commented Dec 17, 2020

blaggacao commented Dec 17, 2020

jmatsushita commented Mar 13, 2021

nixos-discourse commented Jan 25, 2022

Allow nix.conf options to be set in flake.nix #4189

Allow nix.conf options to be set in flake.nix #4189

Conversation

edolstra commented Oct 26, 2020

thufschmitt commented Oct 27, 2020

edolstra commented Oct 27, 2020

matthewbauer commented Oct 27, 2020 • edited

garbas Oct 27, 2020

Choose a reason for hiding this comment

edolstra Nov 17, 2020

Choose a reason for hiding this comment

garbas commented Oct 27, 2020

edolstra commented Oct 28, 2020

andir commented Oct 28, 2020

domenkozar Oct 29, 2020

Choose a reason for hiding this comment

edolstra Oct 29, 2020

Choose a reason for hiding this comment

adrian-gierakowski Nov 12, 2020

Choose a reason for hiding this comment

matthewbauer Nov 12, 2020

Choose a reason for hiding this comment

nixos-discourse commented Nov 5, 2020

domenkozar commented Nov 17, 2020

nixos-discourse commented Dec 17, 2020

blaggacao commented Dec 17, 2020

jmatsushita commented Mar 13, 2021

nixos-discourse commented Jan 25, 2022

matthewbauer commented Oct 27, 2020 •

edited