2019-02-23

<clever> it may help to rename it from a livecd
<clever> renaming it will break a lot, but it repairs all of it on bootup
<clever> and since its only a rename, you can recover what you wanted to keep
<clever> you could maybe rename /etc/ entirely, and then reboot, and nixos will repair the missing /etc/
<clever> while i wouldnt do it on your machine, `rm -rf /etc/` made things 100% better
<clever> it literally broke everything
<clever> ive run into similar problems, when i forcibly installed nixos on the same rootfs as gentoo, lol
<clever> adamantium: i suspect you just need to delete the problem files in /etc/
<clever> but otherwise, they both follow master, and usually update at the same time
<clever> nixos-unstable has extra testing, to make sure it cant brick a nixos machine
<clever> yeah
<clever> adamantium: nixos and nixpkgs will usually only differ by a few days, and having both will just add to the confusion
<clever> adamantium: you only need nixos (nixos-unstable) on root
<clever> bsima: line 57, preStart gets ran as root
<clever> you can also just change it on a case-by-case basis, only when it has trouble
<clever> changing TMPDIR is simpler, then you can use the 30gig of space / has, without any worries
<clever> but if you dont have enough ram+swap, using too much can hang the machine
<clever> cwhy: you can always do `mount /run/user/1000 -o remount,size=10g` to just make it 10gig
<clever> cwhy: /run/user/1000 is a systemd thing, its a tmpfs, and the default size is based on how much ram you have
<clever> cwhy: try `TMPDIR=/tmp nix-shell ....` ?
<clever> checking the source...
<clever> --keep-failed tells it to not clean up, youll want to delete `/run/user/1000/nix-build-pycharm-professional-2018.3.1.drv-0` yourself now
<clever> part of the confusion, is that nix cleaned things up after failing
<clever> cwhy: and what does `df -h /run/user/1000` report as the total size?
<clever> cwhy: ahh, its using /run/user/1000 as a temp dir
<clever> note: keeping build directory '/run/user/1000/nix-build-pycharm-professional-2018.3.1.drv-0'
<clever> there should be a minor difference at the end
<clever> cwhy: if you re-run it with --keep-failed, what happens?
<clever> normal ext4 rootfs, no /tmp mount, everything looks normal and should just work
<clever> cwhy: what is the output of `mount` ?
<clever> cwhy: does it fail again if you re-run that command?
<clever> strange, you have 30gig free, and i doubt pycharm is 30gig in size
<clever> cwhy: can you pastebin the full output of nix-shell, and the error it gave?
<clever> looks fairly normal, what where you doing when you ran out of space?
<clever> ,paste cwhy
<clever> ,pastebin cwhy
<clever> cwhy: what about `df -i` ?
<clever> some of it is
<clever> something might be in a weird state
<clever> rebooting?
<clever> unknown
<clever> but mask/unmask/enable/disable just wont work on nixos
<clever> not sure what causes that
<clever> nixos-unstable has 3.3.0.20
<clever> yeah, 18.09 has 3.1.4.0
<clever> Arahael: and android-studio still exists there, did you enable unfree?
<clever> not that old
<clever> Arahael: sudo nix-channel --list
<clever> > android-studio
<clever> android-studio is already packaged
<clever> ,locate bin fsnotifier
<clever> ,locate bin fsnotifier64
<clever> or just use the version in nixpkgs
<clever> Arahael: thats ld.so, you need to patchelf --set-interpreter
<clever> Arahael: what is the error it gives?
<clever> Arahael: also, linux-vdso.so.1 isnt a file, its a weird quirk in how the kernel works
<clever> Arahael: or use nix-locate (from the nix-index package)
<clever> ,locate linux-vdso.so.1
<clever> therealwaphire[m: https://nixos.org/nixos/options.html#services.%3Cname%3E.path will also help
<clever> therealwaphire[m: the nas-hydra.nix is simpler
<clever> therealwaphire[m: a package that i imported on line 11
<clever> but thats also a bug in the nixos module, and should maybe be fixed within nixpkgs, via a PR
<clever> is an example of modifying an existing service
<clever> you can set the .path in a different file (such as configuration.nix) and leave all the other values as they already are
<clever> therealwaphire[m: you need to set systemd.services.kubelet.path = [ pkgs.something ]; to add things to PATH for the unit
<clever> therealwaphire[m: systemd units have a different $PATH
<clever> and the above file, also lets you bake a list of overlays into the built nixos, so they become the default for nix-build/shell/env
<clever> there is a nixos option, nixpkgs.overlays
<clever> nope, it has its own overlay config
<clever> more a matter of the nixpkgs rev breaking core things
<clever> yeah
<clever> but you could always change the pkgs.path to be a pinned one
<clever> so if your kernel becomes faulty, the rescue-boot kernel is also faulty!
<clever> the only major fault i can see with the design of rescue-boot, is that it rebuilds on every nixos-rebuild
<clever> samueldr: nice
<clever> that minor tweak, would add aws to the list above, and allow any FS on aws
<clever> no wasted space from the old generation in the AMI
<clever> then deploy the final build, directly to the EBS
<clever> 2019-02-22 22:17:10 < clever> nix copy --to ssh://root@target?remote-store=local?root=/mnt /nix/store/hash-nixos
<clever> so it boots into a livecd env, running entirely from ram
<clever> what if we had an AMI, containing only that?
<clever> both of those, deal with jamming the "netboot" image into /boot/ and running it with grub
<clever> which reminds me
<clever> the same way AMI id's are baked into nixpkgs
<clever> samueldr: yeah, but you can bake the url of a known-good one into nixops, and not need to update it to the latest on every eval
<clever> would almost need a way to upload a small binary to packet.net, "run this"
<clever> yeah
<clever> and the new script, will lock signing as required
<clever> that code embeds an x509 cert into the ipxe binary, and bakes a script into it (replacing the default one)
<clever> gchristensen: but, you can also always chain-load a newer ipxe, that has your own certs baked into it (but still needs https), and then verify the signatures on the files: https://github.com/cleverca22/not-os/blob/master/ipxe.nix#L64-L85
<clever> but you really want to prevent mitm attacks on that boot
<clever> and then bake the url of a recent image into nixops
<clever> i was thinking, the image doesnt have to change that often, so it could just be hosted along-side the installer ISO's in a channel
<clever> ah
<clever> gchristensen: only comes into play if the server has OCSP stapling enabled?
<clever> ?
<clever> gchristensen: do you know if the ipxe on packet.net supports https?
<clever> so if you can get root in a recovery env (digital ocean, packet.net, ovh, kexec), you can just call out to that module to finish the job
<clever> i'm thinking you would want to put that logic into a common nixops file, so any cloud provider can use it
<clever> you could easily do any fs, with any partition layout, before you nix copy
<clever> because you have root, without / being mounted
<clever> it also greatly changes the FS/partition dynamic
<clever> so its very different from how packet.net normally handles things
<clever> it would need to be a special "nixops" OS, that is only used by nixops, and provides root ssh before the os is installed
<clever> then you just have to do the normal chroot, switch-to-configuration boot --install-bootloader, and reboot
<clever> gchristensen: so, if you get ssh to the install image, you can copy the final build, directly to the hdd, and skip that 1st generation
<clever> gchristensen: this lets you copy a closure, to /mnt/nix/store, on a remote box
<clever> 2019-02-22 22:17:10 < clever> nix copy --to ssh://root@target?remote-store=local?root=/mnt /nix/store/hash-nixos
<clever> gchristensen: why install nixos (with a random nixpkgs rev) when nixops is going to deploy a closure that likely is a mass-rebuild?
<clever> gchristensen: oh, random idea about packet.net and nixops
<clever> gchristensen: now my karma is binary, lol
<clever> jasom: your welcome :)
<clever> jasom: i did the same thing when i ran gentoo
<clever> gchristensen: that lack of curl, is how i discovered a bug in the adobe flash player
<clever> jasom: heh, i know what you mean
<clever> gchristensen: gentoo lets you do crazy things, like not even have a libcurl, anywhre
<clever> not a 10min job anymore
<clever> jasom: should be fairly fast to build the kernel on a modern system
<clever> jasom: gentoo?
<clever> but i prefer to have the sandbox on 24/7
<clever> jasom: its used by the sandboxing, which could be disabled
<clever> the neat thing, is that you can use nix on one box (without root) to build it, in a pure manner, and then copy it to another box (also without root)
<clever> but you wont have any help from the binary cache
<clever> and nix will continue to work there
<clever> you then move the whole /home/clever/rootfs/home/$X to /home/$X on another machine
<clever> so it creates a /home/clever/rootfs/home/$X/nix/store
<clever> but also, at the same time, it will chroot into /home/clever/rootfs/ while building that
<clever> that makes a special build of nix, that expects the store to live in /home/$X/nix/store
<clever> ottidmes: this is the most complex one of them all
<clever> NIX_REMOTE=local?root=/home/clever/rootfs/ NIX_CONF_DIR=/home/$X/etc/nix NIX_LOG_DIR=/home/$X/nix/var/log/nix NIX_STORE=/home/$X/nix/store NIX_STATE_DIR=/home/$X/nix/var nix-build -E 'with import <nixpkgs> {}; nix.override { storeDir = "/home/'$X'/nix/store"; stateDir = "/home/'$X'/nix/var"; confDir = "/home/'$X'/etc"; }'
<clever> and --delete-generations 42, can delete one root
<clever> ottidmes: this lists every nixos generation
<clever> [root@amd-nixos:~]$ nix-env --profile /nix/var/nix/profiles/system --list-generations
<clever> behind the scenes, nixos-rebuild just calls nix-env to manage the profile
<clever> ottidmes: this will just set the current generation to a given path
<clever> NIX_REMOTE=local?root=/mnt/img/ nix-env --profile /mnt/img/nix/var/nix/profiles/system --set /nix/store/hash-nixos
<clever> but variations can be made for other uses
<clever> ottidmes: this will setup the system profile, inside a chroot, and cross-compile
<clever> ottidmes: this is another fun one
<clever> Raw
<clever> NIX_REMOTE=local?root=/mnt/img/ nix-env --profile /mnt/img/nix/var/nix/profiles/system --set -f '<nixpkgs/nixos>' -A system -I nixos-config=/mnt/img/etc/nixos/configuration.nix --option system aarch64-linux
<clever> ottidmes: with some minor tweaks, you could teach nixops about this, and then it can install to a blank hdd
<clever> boom, your installed
<clever> ottidmes: then you just chroot in (nixos-enter), and run `/nix/store/hash-nixos/bin/switch-to-configuration boot --install-bootloader`
<clever> ottidmes: basically, you can boot a nixos livecd, mount the rootfs to /mnt/, then run this to copy a pre-made nixos, directly into /mnt/, over ssh
<clever> nix copy --to ssh://root@target?remote-store=local?root=/mnt /nix/store/hash-nixos
<clever> ottidmes: mostly, to skip the 1st generation nixos-install makes, and let you deploy to a 100% empty hdd
<clever> ottidmes: basically, nixops + nixos-install
<clever> ottidmes: having trouble searching up the gist...
<clever> ottidmes: that reminds me, let me find it...
<clever> i need to automate `zfs send` on my end
<clever> :D
<clever> i dont drink :P
<clever> aanderse-liveusb: did you run `nix-channel --update` as well?

2019-02-22

<clever> simpson: propagatedBuildInputs doesnt have any impact on the runtime of packages
<clever> ottidmes: yeah, i'm thinking you want something like nix eval or just plain nix-build
<clever> furrycatherder: at build time, you want to add glibcLocales to your nativeBuildInputs
<clever> ottidmes: and you cant just run something like `make` in nix-shell?
<clever> elvishjerricco: docker also says docker is not a security measure
<clever> furrycatherder: i think glibc always obeys that
<clever> furrycatherder: an env var like this is setup by things like bashrc
<clever> LOCALE_ARCHIVE=/run/current-system/sw/lib/locale/locale-archive
<clever> ottidmes: why exactly do you need the path to a given library?
<clever> vaibhavsagar: what kind of isolation do you want? because not even docker is really good at that
<clever> vaibhavsagar: yeah
<clever> ottidmes: the cc-wrapper around gcc makes it obey that, so gcc -lname can just find things
<clever> ottidmes: the libraries are in $NIX_LDFLAGS
<clever> vaibhavsagar: nixos-container will share the host store and nix-daemon with the guests
<clever> sondr3: and donttttttt forget to umount before yyyyou unplug it
<clever> if the USB isnt listed, then it wasnt auto-pointed, `lsblk` to find the device, and mount it yourself
<clever> sondr3: the `mount` command shows everything that is currently mounted
<clever> bgamari: i remember making backups of some old install floppies, but cant ifnd them, or a modern drive
<clever> bgamari: uhhh, do i even have a floppy drive on a modern system.....
<clever> yep
<clever> bgamari: a function accepting 2 sets, and returning another set
<clever> the irc logs for this machine are ~5gig
<clever> which is why i prefer to host my own kind of thing like that, just run irssi in screen on a server
<clever> softinio: from this end, all i know of matrix is that its the thing that spams the channel every time the server crashes, and 200 people disocnnect
<clever> mdash: so if this drive fails, i'm never configuring the bios again
<clever> mdash: this is also one of those weird machines, where the config for the bios, is a special parittion on the hdd
<clever> mdash: its also got a 484sx, so it can be difficult to even run some software, due to the lack of an FPU
<clever> bgamari: lol, the NIC (an ISA card) doesnt even have a netboot rom
<clever> bgamari: ok, the old dos box is unpacked...
<clever> i should try that.....
<clever> i suspect it might even be able to run dos? lol
<clever> bgamari: this ipxe command makes it remap the 1st legacy hdd, and then chain-load its MBR
<clever> sanboot iscsi:192.168.2.11:::1:iqn.2016-01.laptop-root
<clever> bgamari: and ipxe is able to re-route the legacy bios routines for reading the hdd, so grub thinks its a local hdd, but its actually iscsi
<clever> bgamari: when i was netbooting the rpi, it still had /boot/ on an SD card, but later on with the laptop, it had a non-netboot grub, in the MBR of the iscsi image
<clever> bgamari: mine was originally to netboot an rpi, and i later used it to netboot a laptop as well
<clever> bgamari: main problem with this, is that it predates the initrd having proper network, so i peek at the static ip config, and bring the network up with `ip`
<clever> it was originally meant for root on iscsi, but nothing says it cant be non-root
<clever> ive got a nixos module for connecting to iscsi during the initrd, probably need to update it
<clever> ah, like EBS on AWS
<clever> what iscsi features/options does packet.net have?
<clever> ddellacosta: your only options are to manually add it to the systemPackages array, or use roots profile (just nix-env -i as root)
<clever> ddellacosta: very, the system profile only works with --set, and using -i or -e will break it
<clever> thats what i was guessing
<clever> heh, the bot has more karma then i do!
<clever> drager1: you want `nix-shell -p openssl pkgconfig`
<clever> ,libraries drager1
<clever> laas: https://github.com/NixOS/nix/blob/master/src/libexpr/primops.cc has the source behind every builtin
<clever> laas: i run irssi on a box that is basically dedicated to irc (and its also an old 4tb nas)
<clever> LnL: ah, i'll try to avoid pasting you too much
<clever> softinio: i still use irssi
<clever> softinio: i dont know the vim plugin framework that well
<clever> drager1: nix-shell -p
<clever> LnL: my irc client only highlights if my name is at the start, so i dont always think about others names being in the middle of a msg
<clever> laas: that i believe
<clever> 2019-02-22 01:19:19 < clever> 2019-02-21 18:17:49 < LnL> ah https://nixos.org/nixpkgs/manual/#chap-functions
<clever> laas: builtins.fetchurl happens at eval time, so it cant download in parallel, but it can be impure (lacks a sha256)
<clever> charukiewicz: its a function you run on the haskell package, either in an overlay, or where you refer to it somewhere
<clever> charukiewicz: pkgs.haskell.lib.justStaticExecutables disables profiling and does a few other helpful things
<clever> charukiewicz: yep, the .o files it builds are normal outputs, and the .p_o are the same thing with profiling enabled
<clever> charukiewicz: i'm guessing you want to run pkgs.haskell.lib.justStaticExecutables over it
<clever> charukiewicz: that design is how you prevent it from building twice, can you pastebin the build log?
<clever> cbarrett: thats just how nixops is currently designed
<clever> cbarrett: i would recomend just having a central box that you run nixops on, and maybe have an api to remotely trigger `git pull` and `nixops deploy`
<clever> cbarrett: the problem with any idea like that, is that if 2 people mess with the state file at the same time, you get merge conflicts, and aws resources can get lost, and never destroyed, running up a bill
<clever> catern: ahh
<clever> what does starman's support do?
<clever> or systemd waits for a connection attempt, then spawns the real daemon, and gives it the listening socket
<clever> either systemd does accept() always, and launches a new worker for each connection
<clever> there are also 2 different ways systemd can do that
<clever> ah
<clever> what is the feature?
<clever> ahhh
<clever> catern: is it not packaged on either end? ive noticed desync between hydra's release.nix and the nixpkgs expression for it before
<clever> and the env when running those things, is provided by nix-shell
<clever> so when you try to run `nix-shell foo.nix`, it runs some things (impurely), and then exits
<clever> i sometimes make shell.nix files, with a shellHook that will just `exit` at the end
<clever> jonreeve[m]: yeah, under `nix repl '<nixpkgs>'`
<clever> > builtins.attrNames haskell.compiler
<clever> ,callPackage
<clever> its a variant of:
<clever> jonreeve[m]: nix-build -E 'with import <nixpkgs>{}; haskellPackages.callPackage ./open-editions.nix {}'
<clever> i would also say to use overrideAttrs, but given that apache is trying to do its own .override afterwards, overrideAttrs wont work right
<clever> callPackages is a variant, that will add it to every attr inside the set instead
<clever> but when you .php72, the override is lost
<clever> callPackage will add a .override to its return value, so the entire set php/default.nix returned, has a .override
<clever> aanderse: i think you want to use callPackages
<clever> ikitat: and nixpkgs-overlays being in NIX_PATH to setup overlays, thats probably in the nixpkgs manual
<clever> but nix.nixPath is in the nixos options docs
<clever> yeah, system.extraSystemBuilderCmds is much more of an internal thing i discovered by just reading the source of nixos
<clever> ikitat: the path copying is a nix level feature, so i would expect it to be in the nix manual
<clever> it will copy it to /nix/store/longhash-path, and then insert that into the bash level script
<clever> yep
<clever> if you elevate the path to a nix level value, it gets copied automatically
<clever> 17 ln -sv ${./overlays} $out/overlays
<clever> ikitat: that path isnt at the nix level, so nix doesnt know to copy it
<clever> ikitat: can you pastebin the nix code you used?
<clever> 1.4gig, that explains it
<clever> oh
<clever> ["nix-build", "-I", "nixpkgs=/home/clever/nixpkgs", "
<clever> Nix daemon out of memory
<clever> ok, now this is strange.....
<clever> 16 ln -sv ${pkgs.path} $out/nixpkgs
<clever> it lets you set nixpkgs-overlays to a directory, but the nixos level forces you to import them all yourself
<clever> gchristensen: dang!
<clever> error: The option value `nixpkgs.overlays' in `/home/clever/nixos-configs/nixops-managed.nix' is not of type `list of nixpkgs overlays'.
<clever> ,cache
<clever> ikitat: i used this to confirm how nixpkgs-overlays works, and change my overlays to fit that style
<clever> [clever@system76:~/nixos-configs]$ nix repl '<nixpkgs>' -I nixpkgs-overlays=./overlays/ --show-trace
<clever> ikitat: `nixops deploy --build-only` can also be useful for testing things without actually deploying them
<clever> and since that string is just a chunk of bash ran inside a derivation, plain old `env` is enough
<clever> gchristensen: i think the question, is "what env vars besides $out are available here" https://github.com/cleverca22/nixos-configs/blob/master/nixops-managed.nix#L14
<clever> and then it will copy the products to the remote targets
<clever> nixops will build everything using normal nix, which can then either be built locally, or with build slaves (if enabled)
<clever> ikitat: that part of the code is running under bash, so you can just `env ; exit 1` to see the vars
<clever> yeah
<clever> ikitat: i think you want to copy a directory full of overlays to $out/overlays, and then set nixpkgs-overlays=/run/current-system/overlays in nix.nixPath
<clever> ,xy
<clever> Myrl-saki: there is also a --install-bootloader flag i think
<clever> arq1: the nixos-enter script handles setting up /run/current-system for you
<clever> it feels like an `or` statement would handle checking the local package first, then checking elsewhere
<clever> > let a = {}; b = 42; in a.foo or b
<clever> package.components.sublibs.bar or package.components.library maybe?
<clever> that sounds pretty much the same
<clever> and when other parts of foo.cabal refer to bar, as you translate it to nix, you know bar is a sublib, so translate it to foo-bar again
<clever> so foo.cabal, with a sublibrary called bar, will show up as foo-bar in the nix
<clever> my first guess is to just namespace things a bit, under the parent library
<clever> nice
<clever> lol
<clever> almost to 100!
<clever> jasom: `echo kernel.unprivileged_userns_clone=1 > /etc/sysctl.d/nix-user-chroot.conf` will make it persist after a reboot
<clever> jasom: `sysctl -w kernel.unprivileged_userns_clone=1` will immediately enable it, but is lost at reboot
<clever> teto: it has its own on/off switch
<clever> teto: python packages all use the installCheckPhase, which runs the tests after `make install`
<clever> > python3Packages.pandas.doInstallCheck