2019-07-02

<clever> arianvp: so as long as the secret is unchanged, the cookies are valid state, and oauth2_proxy doesnt need anything server-side!
<clever> arianvp: the trick, is that the cookie.secret used by oauth2_proxy, is used to encrypt your current credentials, and shove them into a cookie
<clever> arianvp: despite blowing the entire state of the docker image away, i was still signed in after booting a new image up!
<clever> arianvp: i just confirmed something interesting with oauth2_proxy
<clever> dminuoso: yep, that would fix it
<clever> LnL: ack!!, the heredocs all turn into "foo\n"!
<clever> dminuoso: nixos is trying to delete all files in the /boot/efi/nixos directory, and one of the "files" isnt a file!!
<clever> Netsu: getting it into the attribute would require IFD, which isnt allowed in the main nixpkgs repo
<clever> Netsu: nope, it will only exist at build time
<clever> Netsu: and keepDotGit = true; will keep the .git
<clever> Netsu: i would just do preConfigure = ''version=$(git describe)'';
<clever> Netsu: then just run git normally inside the build
<clever> Netsu: keepDotGit = true;
<clever> and postgresql wont run as "root", and doesnt understand that docker root isnt root
<clever> and sudo checks with pam before dropping root
<clever> arianvp: sudo was actually a pretty big pain to get working, pam throws a non-descript error if /etc/shadow is world readable
<clever> LnL: next problem is serviceConfig.User, there is the question of sudo vs su vs just calling setuid in perl
<clever> arianvp: and havent you seen what i did with not-os, just to avoid systemd bloat? lol
<clever> 2019-07-02 06:00:07 < arianvp> so systemd won't start in the container
<clever> its trying to make https calls to google to verify the tokens, and lacked CA's
<clever> i had to add `cacert.out` to the docker image to make oauth work
<clever> everybody has a fork!
<clever> (s)
<clever> whats new with the fork?
<clever> (currently fixing some non-same things in it)
<clever> nixos already auto-generates perl scripts, that read the systemd config, and then do the "same" thing
<clever> its using runit, and the perl runner scripts
<clever> arianvp: its not actually using systemd though!
<clever> arianvp: why?
<clever> i now have basic nixos services, running in docker, without nixos, and without systemd
<clever> arianvp: this takes ~5 systemd services from nixos, jams them into a docker image, and whips them until they work, lol
<clever> arianvp: one min
<clever> and gets rid of the zfs on lvm on luks, since nixos now deals with luks better
<clever> my latest push includes support for /boot on zfs (but i wouldnt call it stable)
<clever> currently, it does the entire nixos-install for you, but a variant using nix copy could also be made
<clever> boom, its now running nixos from ram, ssh in, justdoit
<clever> just drop the tarball into / on any linux machine, and /kexec_nixos
<clever> arianvp: and this kexec script deals with the initrd issue
<clever> arianvp: the nixos options on lines 9-49 configure what it will do to your drive, and which drive
<clever> arianvp: justdoit.nix is a nixos module, that you add to your installer environment
<clever> pie__: ive got a few something attrs, but no something.nix!
<clever> arianvp: so you can get the entire closure into a remote drive, after it has been formatted&mounted
<clever> arianvp: first, the above command, will copy from /nix/store on the local machine, to /mnt/nix/store on the remote machine, over ssh
<clever> arianvp: already done
<clever> Raw
<clever> nix copy --to ssh://root@target?remote-store=local?root=/mnt /nix/store/hash-nixos
<clever> another*
<clever> :D
<clever> arianvp: and for installs, i have anything thing...
<clever> (so it kind of turns into state, embeded within the build)
<clever> but -I nixpkgs= will override that, and persist within the build
<clever> ive seen somebody else do similar with nixos-rebuild, so it always uses whatever nixpkgs it last used, ignoring all state
<clever> and then map <nixpkgs> to that at runtime
<clever> this will save a copy of the nixpkgs used to deploy the machine, to /run/current-system/nixpkgs
<clever> i cant brick things!!
<clever> and if i ever brick things, nix-env -p /nix/var/nix/profiles/per-user/root/rpi3-netboot --rollback!
<clever> which can then netboot from it
<clever> the tftp server is symlinked to share that to the rpi's
<clever> arianvp: that builds a netboot image for the rpi, and stores it into the rpi3-netboot profile
<clever> nix-env -p /nix/var/nix/profiles/per-user/root/rpi3-netboot -f not-os/release.nix -A rpi_image -I nixpkgs=./nixpkgs/ --set
<clever> have you seen what i did with netboot and --set?
<clever> yeah, --set is nice
<clever> > builtins.currentTime
<clever> and it doesnt have to be local, default.nix could be an expr that fetches a nixpkgs based on the current unix epoch time!
<clever> arianvp: nix-env -iA foo.hello will use whatever nixpkgs i have cloned to that dir
<clever> [clever@amd-nixos:~]$ cat .nix-defexpr/test/foo/default.nix
<clever> import /home/clever/apps/nixpkgs
<clever> arianvp: also, line 3 is basically identical to what nix-env does with def-expr, and you can even take advantage of that
<clever> arianvp: builtins.fetchGit will cache it to both ~/.cache/nix/gitv2/, and then import a subtree to /nix/store/
<clever> LnL: blast!, mojave strikes again!!
<clever> 5>Jul 2 09:32:44 nixoss-iMac powerd[52]: Entering Sleep state due to 'Idle Sleep':
<clever> arianvp: roots bash-profile will even create the channels if they are missing
<clever> arianvp: yeah
<clever> arianvp: and then every single time you run anything nix related, it warns you that X doesnt exist
<clever> arianvp: if your user has never ran nix-channel, that directory wont exist
<clever> arianvp: NIX_PATH is used by 90% of the nix tools, ~/.nix-defexpr/ is only used by nix-env -iA
<clever> arianvp: the second layer, is that nix-env will recursively search ~/.nix-defexpr/ for either foo.nix or foo/default.nix, (stopping recursion once it finds one), and that becomes foo in nix-env -iA foo.hello
<clever> arianvp: for both of them, nix-channel --update will mess with nix-env -i to add the latest nixpkgs to the profile
<clever> channels-root points to roots profile (if you arent root)
<clever> channels is always a symlink to the channels profile for the current user (a nix-env profile)
<clever> lrwxrwxrwx 1 root root 44 May 21 10:16 .nix-defexpr/channels -> /nix/var/nix/profiles/per-user/root/channels
<clever> arianvp: there are 2 main layers to it
<clever> arianvp: yeah, its assumed root will always have channels, so those are always in NIX_PATH
<clever> but the check happens at login
<clever> and only adds it when it can be found
<clever> thats why it checks if it exists or not
<clever> because adding it when it doesnt causes a warning on every nix cmd
<clever> the default bash-profile will check if ~/.nix-defexpr/channels/ exists
<clever> arianvp: you have to relog for it to be added to NIX_PATH
<clever> LnL: looks like perl supports 3 forms of heredoc, <<EOF, <<'EOF', and <<"EOF", the single-quote one wont interpolate vars, while the other 2 do
<clever> second problem is .User and PermissionsStartOnly
<clever> then nixos would shove it into a shell script and simplify ExecStart
<clever> LnL: my short-term fix, was to just move things from serviceConfig.ExecStart to .script
<clever> LnL: the heredoc stuff should also deal with all the newline mess ive seen in a few execStarts
<clever> so i cant tell why nix-daemon failed
<clever> the new plist file doesnt send stdout/stderr anywhere
<clever> and the script isnt waiting long enough
<clever> chris___: what channel are you on, and which kernel is it pulling?
<clever> LnL: 2 of the 3 macs failed again, but that was immediately followed by the kickstart you gave me, and then a 30 second sleep
<clever> 13>Jul 2 08:22:55 nixoss-iMac com.apple.xpc.launchd[1] (org.nixos.nix-daemon): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
<clever> 13>Jul 2 09:23:29 nixoss-iMac com.apple.xpc.launchd[1] (org.nixos.nix-daemon): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
<clever> LnL: yep, that exists!
<clever> LnL: ah, that would also work nicely
<clever> chris___: double-check `sudo nix-channel --list` and maybe `--update` it
<clever> chris___: sounds like nix-channel wasnt in sync with what was installed, so its upgrading (or downgrading?) everything
<clever> LnL: trying to think of what the best solution is, a dozen writeText's? passAsFile and a runCommand for all of them? some nix code to escape things?
<clever> my $cmd = 'foo --arg='bar'';
<clever> so now you have
<clever> and this line, auto-generates an ExecStart = "foo --arg='bar'";
<clever> this like, just shoves the entire ExecStart into some single quotes in perl code
<clever> my $cmd = '${service.serviceConfig.ExecStart}';
<clever> so you can take the service definitions in nixos, and then run them without systemd
<clever> LnL: it auto-generates a perl script, that runs ExecStart and friends
<clever> LnL: oh, have you seen the systemd runner thing lately?
<clever> LnL: it may be a race condition, i was booting 3 macs on the same machine
<clever> and now we boot them all over!
<clever> that one is my fault
<clever> *doh*
<clever> error: anonymous function at /Users/nixos/.nixpkgs/iohk-ops/nix-darwin/test.nix:1:1 called without required argument 'host', at /Users/nixos/.nixpkgs/iohk-ops/nix-darwin/modules/basics.nix:5:17
<clever> LnL: then why is it not called restart? lol
<clever> LnL: what exactly does kickstart do?
<clever> LnL: i'll toss that into my script as well then
<clever> LnL: i think nix-darwin restarted nix-daemon, then didnt wait for it to come up
<clever> LnL: ran into a weird glitch with nix-darwin today
<clever> allenj12: i just manually create one with wpa_passphrase
<clever> switchy: `nix-store -l /nix/store/foo`
<clever> sonercirit[m]: all i can think of is to try grub or legacy booting
<clever> sonercirit[m]: what does `nix show-derivation /run/current-system/initrd | grep prepend` report?
<clever> sonercirit[m]: one min
<clever> sonercirit[m]: yeah,that rev is still on 20190618....
<clever> sonercirit[m]: what does `nix eval nixpkgs.lib.version` return?
<clever> sounds like its working just fine
<clever> sonercirit[m]: does dmesg say anything as it boots?
<clever> sonercirit[m]: and then it will write those to the output file, before appending the actual initrd body
<clever> sonercirit[m]: and then the function call to generate the initrd, takes the list of things to prepend
<clever> sonercirit[m]: the nix file just adds a img file to be prepended to the initrd
<clever> sonercirit[m]: https://nixos.org/nixos/options.html#microcode is what ive seen before
<clever> allenj12: and the mkBootTable deals with ext4 or vfat for /boot/
<clever> mount it, if we have one
<clever> ${lib.optionalString (cfg.bootType != "zfs") "mount $NIXOS_BOOT /mnt/boot/"}
<clever> put sda1 into the variable, if we have a boot partition
<clever> ${lib.optionalString (cfg.bootType != "zfs") "export NIXOS_BOOT=${cfg.rootDevice}${x}1"}
<clever> if /boot is not on zfs, make a /boot partition
<clever> ${lib.optionalString (cfg.bootType != "zfs") "1 : size=${toString (2048 * cfg.bootSize)}, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4"}
<clever> if its not efi, it creates bios boot
<clever> ${lib.optionalString (! cfg.uefi) "4 : size=4096, type=21686148-6449-6E6F-744E-656564454649"}
<clever> half of those arent really partition types, and are more of where you mount them
<clever> lordcirth__: legacy on gpt, requires a bios boot partition, which is not /boot and cant be mounted
<clever> lordcirth__: mbr booting doesnt need that much special stuff with the boot partition
<clever> lordcirth__: gpt or mbr?

2019-07-01

<clever> ocharles: ah, i think its already doing static haskell linking, havent confirmed that though
<clever> ocharles: there are plans to make that work on linux, so we can distribute 100% static ELF files, and then users dont need to worry about /nix/store/ deps
<clever> Moredread[m]: i usually unpack the tar, copy the entire dir to something-orig, edit one copy, then `diff -ru something-orig something > foo.patch`

2019-06-30

<clever> asymmetric: but the above wont change channels after you update the cfg
<clever> oops, wrong tab-complete, lol
<clever> symphorien: on the first login as root, if ~/.nix-channels doesnt exist, it will register system.defaultChannel as your channel
<clever> asymmetric: channels are configured via /root/.nix-channels, and something else, one min
<clever> alexarice[m]: nix-build -E 'with import <nixpkgs> {}; runCommand "name" {} "echo foo > $out"'
<clever> cant think of anything else to check
<clever> yunratobe: are you running appimage-run on the appimage?
<clever> compare `env` inside and out
<clever> fresheyeball: what pid os psql actually running as?
<clever> fresheyeball: is that path in an env variable?
<clever> fresheyeball: its connecting to this unix socket, which doesnt exist
<clever> connect(3, {sa_family=AF_UNIX, sun_path="/tmp/.s.PGSQL.5432"}, 110) = -1 ENOENT (No such file or directory)
<clever> fresheyeball: the stuff near the end is most important, right before the error claiming cant connect to server
<clever> fresheyeball: strace psql
<clever> benhart: is it a fresh install? what path was configuration.nix at?
<clever> benhart: does that machine not have an irc client or a pastebin?
<clever> benhart: what is the output from nixos-rebuild switch?
<clever> so if i plug it in, then immediately unplug it, the machine is bork :P
<clever> and for extra fun, xfce will auto-enable any monitor i plug in
<clever> i have to go into the xfce settings, and disable that monitor first
<clever> but, if i unplug a monitor while its active, the video driver crashes, very hard
<clever> after login, xfce restores the monitor layout perfectly
<clever> on bootup, the login prompt is all over the place, but i dont really reboot much so i dont care
<clever> selfsymmetric-mu: on my end, ive got an amd card, and am currently using the amdgpu driver with xfce
<clever> selfsymmetric-mu: the "patch" may already be in $src
<clever> selfsymmetric-mu: what about in the src path?
<clever> benhart: you also need services.xserver.enable = true;
<clever> selfsymmetric-mu: youll see all patches that are being applied, and the path to its src
<clever> selfsymmetric-mu: then run `nix show-derivation` on that drv
<clever> selfsymmetric-mu: now run `nix-store --query --deriver /nix/store/wdzg39mqppqmcv3yh1nxdpwijdx73n2b-xfce4-settings-4.12.1/bin/xfce4-settings-editor` and it should give a .drv file
<clever> selfsymmetric-mu: what is the path in the nix store for the xfce settings binary?
<clever> benhart: display-manager.service will dynamically start whichever DM you enabled in configuration.nix
<clever> selfsymmetric-mu: typo, i renamed it from your example, but missed a place
<clever> benhart: display-manager.service will only exist if you set services.xserver.enable = true;
<clever> only nix-env and nix-build will obey nixpkgs-overlays from $NIX_PATH
<clever> nixos only obeys the nixpkgs.overlays config option
<clever> nixos will also ignore the nixpkgs-overlays path
<clever> correct
<clever> and that part itself, is then doing another overlay, against all xfce packages
<clever> this creates a nixpkgs overlay, that will replace whatever pkgs.xfce is
<clever> the overlay applies to all of nixpkgs
<clever> an overlay is always a function that takes 2 arguments, usually in the `self: super: { ... }` form
<clever> and then nixos will merge it for you
<clever> imports, not import s
<clever> selfsymmetric-mu: you could also just put the entire gistfile1.nix directly into /etc/nixos, and then just do import s= [ ./gistfile1.nix ];
<clever> selfsymmetric-mu: if you pastebin your current file, i can look at it to see whats wrong
<clever> selfsymmetric-mu: if you want to alter the xfce used by nixos, you just want nixpkgs.overlays = [ a_nixpkgs_overlay ];
<clever> selfsymmetric-mu: if you have a clone of nixpkgs, you could just edit xfce4-settings.nix directly and skip the entire overlay system

2019-06-29

<clever> and then you can make an xfceoverlay = self: super: { xfce4-settings = super.xfce4-settings.overrideAttrs (old: { patches = old.patches ++ [ ./foo ]; ); };
<clever> selfsymmetric-mu: for example, to replace xfce.xfce4-settings, you want a nixpkgs overlay, that does: xfce = super.xfce.overrideScope' xfceoverlay;
<clever> which has to be insrted at the right place in the overlays
<clever> selfsymmetric-mu: xfce4-settings = super.xfce4-settings.overrideAttrs (old: { patches = old.patches ++ [ ./foo ]; );
<clever> WilliamHamilton: it takes a list of self: super: functions, so you may need overlays = [ (import ./foo.nix) ];
<clever> WilliamHamilton: when you `import <nixpkgs> {}` you can do `import <nixpkgs> { overlays = [ .... ]; }`
<clever> jaen: this will show the kernel version it wants, vs what it booted
<clever> ls -l /run/{current,booted}-system/kernel
<clever> jaen: if changing the kernel, you will need to reboot
<clever> yeah, v6 can also be a factor
<clever> jaen: there may be an optional driver with better perf
<clever> jaen: if you check `lspci -vv` youll see which kernel driver your using
<clever> jaen: hmmm, on emin
<clever> jaen: you can try 18.09 then, or even 18.03
<clever> 19.03 was cut in march, while unstable continues to evolve
<clever> jaen: its older then unstable :P
<clever> jaen: you can fairly easily downgrade, by just adding the right channel with nix-channel --add, rebuilding, and rebooting
<clever> jaen: maybe try an older kernel, or an older channel like 19.03 or 18.09?
<clever> jaen: yeah, not much else i can think of to check
<clever> nyanloutre[m]: probably best to just run the full steam package and run it via that
<clever> nyanloutre[m]: ah
<clever> nyanloutre[m]: steam-run doesnt actually use steam, it just sets up the same chroot env used to launch steam
<clever> nyanloutre[m]: have you tried steam-run?
<clever> jaen: it could be that your router is good at forwarding packets, but bad at actually processing and responding to things, .... but why was it fast for one machine and slow for nixos
<clever> jaen: and then try an external server
<clever> karetsu: might there be a duplicate pulseaudio daemon still running?
<clever> karetsu: pulseaudio will remember the default device on clean shutdown and restore it next time it starts
<clever> i get barely half of that
<clever> [ 5] 0.00-10.00 sec 26.1 MBytes 21.9 Mbits/sec 247 sender
<clever> jaen: and over my 54mbit wifi
<clever> jaen: over gigabit ethernet, i get nearly 1000mbit
<clever> [ 5] 0.00-10.00 sec 1.10 GBytes 941 Mbits/sec 0 sender
<clever> rfold: ah, that would definitely do it
<clever> > zeromq.outputs
<clever> jaen: on one machine, `nix run nixpkgs.iperf3 -c iperf3 -s`, then on another, `nix run nixpkgs.iperf3 -c iperf3 -c 192.168.2.11`
<clever> rfold: nix-shell doesnt update the MANPATH, youll need to manually `nix-build '<nixpkgs>' -A zeromq and then look under result/share/man and run man on a file
<clever> jaen: one min
<clever> jaen: looks fairly normal, and its properly at gigabit speeds
<clever> jaen: jaen what does `nix run nixpkgs.ethtool -c ethtool enp3s0` report?
<clever> deech___: nope
<clever> jaen: check `top` to see what the cpu usage is like and what process is to blame
<clever> levdub: nix-store --verify --check-contents, to search for any other "damage"
<clever> levdub: youll probably want to also delete it with --delete, to tell nix its gone
<clever> levdub: nix-store --delete /nix/store/foo, and dont use force
<clever> levdub: they are probably built by hydra, and people have been focusing on getting rid of all randomness, so it would make sense for the uuid's to be duplicated
<clever> the other files under video do similar things, for each vendor
<clever> baum: this will check for nvidia/nvidiaBeta/nvidiaLegacy304/nvidiaLegacy340/nvidiaLegacy390 and put the right kernel drivers into the environment
<clever> baum: this will check if amdgpu is an option, and auto-load the radeon kernel module
<clever> baum: this will then create a Driver "foo" entry in the xorg config, for each one
<clever> baum: this piece of code will transform the names, and put them into the drivers section
<clever> noudle: the initrd scripts will already delay and loop until the device appears
<clever> noudle: rootdelay=5 is a kernel, thing, that only applies when you lack an initrd
<clever> noudle: not sure then
<clever> noudle: watch the power LED on the rpi, it will turn off when the voltage starts to dip
<clever> noudle: the nixos boot scripts shouldnt reboot on their own when things fail, so it could be the power supply?
<clever> baum: out of ideas then, thats about the limit of my psql knowledge, lol
<clever> baum: did you services.postgresql.enable = true?
<clever> baum: put some-package into environment.systemPackages
<clever> lordcirth_: when in multiuser mode, root should own it
<clever> lordcirth_: root should also own everything under /nix/var/
<clever> lordcirth_: then run the normal nix-build without root
<clever> lordcirth_: you want to run nix-daemon as root, and make sure root owns /nix/store/
<clever> lordcirth_: ah, sounds like a purity issue, it should be forcing a uid when creating the image

2019-06-28

<clever> codedmart: overlays.nix is supposed to return a list of overlays, i think you want overlays/thing.nix
<clever> nh2: note, that sshd opens itself in the firewall automatically, but some people want to restrict ssh to certain IP's, at the aws level
<clever> nh2++
<clever> nh2: its likely part of lazyness, it needs to know the keys of the set, before it can know what nodes contains
<clever> nh2: it should just work...
<clever> so, you can do `resources.ec2SecurityGroups.nixops = { pkgs, uuid, name, resources, nodes, ... }: { stuff };
<clever> and that just calls evalModules
<clever> and fixMergeModules is given a set containing pkgs, uuid, name, resources, and nodes
<clever> fixMergeModules is then ran, over all definitions, ec2-security-group.nix, and 2 other things
<clever> so defs is a list of definitions for a given group (so you can define options on the same group in 2 files)
<clever> 79 then runs mapAttrs over that set of groups
<clever> so _resources is the set of security groups