From c88944f025429430a58dff13b9b4c653ce955535 Mon Sep 17 00:00:00 2001 From: Andrew Marshall Date: Wed, 12 Oct 2022 08:27:21 -0400 Subject: [PATCH] nixos: nix.readOnlyStore -> boot.readOnlyNixStore The placement of this option under `nix` was misleading, as it is not configuration of the Nix daemon, but rather configuration of the NixOS boot process and how it mounts the Nix store. As such, make it an option of `boot` to clarify what it actually affects, and imply that it will only take effect on a reboot. Since it no longer has the context of nix, adjust the name to include it. --- .../from_md/release-notes/rl-2305.section.xml | 7 +++++++ nixos/doc/manual/release-notes/rl-2305.section.md | 2 ++ nixos/modules/services/misc/nix-daemon.nix | 12 +----------- nixos/modules/system/boot/stage-2-init.sh | 2 +- nixos/modules/system/boot/stage-2.nix | 14 ++++++++++++-- 5 files changed, 23 insertions(+), 14 deletions(-) diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml index c8bd237dbb00..757a719bfefd 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml @@ -78,6 +78,13 @@ relying on this should provide their own implementation. + + + The nix.readOnlyStore option has been + renamed to boot.readOnlyNixStore to clarify + that it configures the NixOS boot process, not the Nix daemon. + +
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md index c438fdc1aaaf..1b105fdd1f3f 100644 --- a/nixos/doc/manual/release-notes/rl-2305.section.md +++ b/nixos/doc/manual/release-notes/rl-2305.section.md @@ -29,6 +29,8 @@ In addition to numerous new and upgraded packages, this release has the followin - The EC2 image module previously detected and activated swap-formatted instance store devices and partitions in stage-1 (initramfs). This behaviour has been removed. Users relying on this should provide their own implementation. +- The `nix.readOnlyStore` option has been renamed to `boot.readOnlyNixStore` to clarify that it configures the NixOS boot process, not the Nix daemon. + ## Other Notable Changes {#sec-release-23.05-notable-changes} diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix index 8eb1ed53d0c7..c88fceb9a92c 100644 --- a/nixos/modules/services/misc/nix-daemon.nix +++ b/nixos/modules/services/misc/nix-daemon.nix @@ -115,6 +115,7 @@ in (mkRenamedOptionModuleWith { sinceRelease = 2003; from = [ "nix" "useChroot" ]; to = [ "nix" "useSandbox" ]; }) (mkRenamedOptionModuleWith { sinceRelease = 2003; from = [ "nix" "chrootDirs" ]; to = [ "nix" "sandboxPaths" ]; }) (mkRenamedOptionModuleWith { sinceRelease = 2205; from = [ "nix" "daemonIONiceLevel" ]; to = [ "nix" "daemonIOSchedPriority" ]; }) + (mkRenamedOptionModuleWith { sinceRelease = 2211; from = [ "nix" "readOnlyStore" ]; to = [ "boot" "readOnlyNixStore" ]; }) (mkRemovedOptionModule [ "nix" "daemonNiceLevel" ] "Consider nix.daemonCPUSchedPolicy instead.") ] ++ mapAttrsToList (oldConf: newConf: mkRenamedOptionModuleWith { sinceRelease = 2205; from = [ "nix" oldConf ]; to = [ "nix" "settings" newConf ]; }) legacyConfMappings; @@ -366,17 +367,6 @@ in ''; }; - readOnlyStore = mkOption { - type = types.bool; - default = true; - description = lib.mdDoc '' - If set, NixOS will enforce the immutability of the Nix store - by making {file}`/nix/store` a read-only bind - mount. Nix will automatically make the store writable when - needed. - ''; - }; - nixPath = mkOption { type = types.listOf types.str; default = [ diff --git a/nixos/modules/system/boot/stage-2-init.sh b/nixos/modules/system/boot/stage-2-init.sh index f2a839d07868..78cc8e8d45a3 100755 --- a/nixos/modules/system/boot/stage-2-init.sh +++ b/nixos/modules/system/boot/stage-2-init.sh @@ -68,7 +68,7 @@ fi # like squashfs. chown -f 0:30000 /nix/store chmod -f 1775 /nix/store -if [ -n "@readOnlyStore@" ]; then +if [ -n "@readOnlyNixStore@" ]; then if ! [[ "$(findmnt --noheadings --output OPTIONS /nix/store)" =~ ro(,|$) ]]; then if [ -z "$container" ]; then mount --bind /nix/store /nix/store diff --git a/nixos/modules/system/boot/stage-2.nix b/nixos/modules/system/boot/stage-2.nix index 6b4193ea2967..6ed915c339e0 100644 --- a/nixos/modules/system/boot/stage-2.nix +++ b/nixos/modules/system/boot/stage-2.nix @@ -10,9 +10,8 @@ let src = ./stage-2-init.sh; shellDebug = "${pkgs.bashInteractive}/bin/bash"; shell = "${pkgs.bash}/bin/bash"; - inherit (config.boot) systemdExecutable extraSystemdUnitPaths; + inherit (config.boot) readOnlyNixStore systemdExecutable extraSystemdUnitPaths; isExecutable = true; - inherit (config.nix) readOnlyStore; inherit useHostResolvConf; inherit (config.system.build) earlyMountScript; path = lib.makeBinPath ([ @@ -42,6 +41,17 @@ in ''; }; + readOnlyNixStore = mkOption { + type = types.bool; + default = true; + description = lib.mdDoc '' + If set, NixOS will enforce the immutability of the Nix store + by making {file}`/nix/store` a read-only bind + mount. Nix will automatically make the store writable when + needed. + ''; + }; + systemdExecutable = mkOption { default = "/run/current-system/systemd/lib/systemd/systemd"; type = types.str;