nixos/nix-daemon: Add enable option
Don't worry, it's is true by default. But I think this is important to
have because NixOS indeed shouldn't need Nix at run time when the
installation is not being modified, and now we can verify that.
NixOS images that cannot "self-modify" are a legitamate
use-case that this supports more minimally. One should be able to e.g. do a
sshfs mount and use `nixos-install` to modify them remotely, or just
discard them and build fresh ones if they are run VMs or something.
The next step would be to make generations optional, allowing just
baking `/etc` and friends rather than using activation scripts. But
that's more involved so I'm leaving it out.
commitcc3f2432d0d05ed12ef8b9858c54048edadbccbb
authorJohn Ericson <John.Ericson@Obsidian.Systems>
dateSat 24 Apr 2021, 21:02 (6 years ago)
parent1d88d6f
nixos/modules/services/misc/nix-daemon.nix+10−1
@@ -82,6 +82,15 @@ in
8282
8383 nix = {
8484
85+ enable = mkOption {
86+ type = types.bool;
87+ default = true;
88+ description = ''
89+ Whether to enable Nix.
90+ Disabling Nix makes the system hard to modify and the Nix programs and configuration will not be made available by NixOS itself.
91+ '';
92+ };
93+
8594 package = mkOption {
8695 type = types.package;
8796 default = pkgs.nix;
@@ -499,7 +508,7 @@ in
499508
500509 ###### implementation
501510
502− config = {
511+ config = mkIf cfg.enable {
503512
504513 nix.binaryCachePublicKeys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
505514 nix.binaryCaches = [ "https://cache.nixos.org/" ];
nixos/tests/all-tests.nix+1
@@ -478,6 +478,7 @@ in
478478 wasabibackend = handleTest ./wasabibackend.nix {};
479479 wiki-js = handleTest ./wiki-js.nix {};
480480 wireguard = handleTest ./wireguard {};
481+ without-nix = handleTest ./without-nix.nix {};
481482 wmderland = handleTest ./wmderland.nix {};
482483 wpa_supplicant = handleTest ./wpa_supplicant.nix {};
483484 wordpress = handleTest ./wordpress.nix {};
nixos/tests/without-nix.nixnew file+23
@@ -0,0 +1,23 @@
1+import ./make-test-python.nix ({ lib, ... }: {
2+ name = "without-nix";
3+ meta = with lib.maintainers; {
4+ maintainers = [ ericson2314 ];
5+ };
6+
7+ nixpkgs.overlays = [
8+ (self: super: {
9+ nix = throw "don't want to use this";
10+ })
11+ ];
12+
13+ nodes.machine = { ... }: {
14+ nix.enable = false;
15+ };
16+
17+ testScript = ''
18+ start_all()
19+
20+ machine.succeed("which which")
21+ machine.fail("which nix")
22+ '';
23+})