Archived
beatzaplentyandClaude Sonnet 4.6
2123e4ad69
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m27s
nix was installed as root on pve1 (the codex-setup.sh root path, meant for container/Codex environments), making nix build require sudo there. After cleaning up the root install and reinstalling as the SSH user (wayne), nix is owned by that user and runs directly without sudo. create-proxmox-resource.sh: drop sudo_pfx from nix build in both remote scripts. The SSH user owns the store after reinstall; nix build goes through the nix daemon-or-store directly. sudo stays on pct/qm/pvesh (cluster IPC) and the disko image-writer script (writes to disk). codex-setup.sh: add build-users-group = (empty) to the user nix.conf written by the non-root install path. Guards against a stale /etc/nix/nix.conf from a prior root install (which sets build-users-group = nixbld) silently breaking single-user builds. Manual cleanup required once on each Proxmox node that had root's nix: sudo rm -rf /nix /etc/nix sudo rm -f /etc/profile.d/nix.sh /etc/profile.d/nix-daemon.sh for i in $(seq 1 10); do sudo userdel nixbld$i 2>/dev/null||true; done sudo groupdel nixbld 2>/dev/null || true After that, the next create-proxmox-resource.sh run auto-reinstalls nix as the SSH user via codex-setup.sh. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
89 lines
2.2 KiB
Bash
Executable File
89 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib/nix-bootstrap.sh
|
|
source "${script_dir}/lib/nix-bootstrap.sh"
|
|
# shellcheck source=lib/nix-eval.sh
|
|
source "${script_dir}/lib/nix-eval.sh"
|
|
|
|
install_nix_if_missing() {
|
|
if command -v nix >/dev/null 2>&1; then
|
|
return
|
|
fi
|
|
|
|
echo "Nix not found. Installing Nix..."
|
|
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
echo "Running as root; preparing nixbld users for container/Codex environment..."
|
|
|
|
if ! getent group nixbld >/dev/null; then
|
|
groupadd -r nixbld
|
|
fi
|
|
|
|
for i in $(seq 1 10); do
|
|
if ! id "nixbld$i" >/dev/null 2>&1; then
|
|
useradd \
|
|
-r \
|
|
-g nixbld \
|
|
-G nixbld \
|
|
-d /var/empty \
|
|
-s /usr/sbin/nologin \
|
|
"nixbld$i" || true
|
|
fi
|
|
done
|
|
|
|
mkdir -p /etc/nix
|
|
cat > /etc/nix/nix.conf <<'EOF'
|
|
experimental-features = nix-command flakes
|
|
accept-flake-config = false
|
|
warn-dirty = false
|
|
build-users-group = nixbld
|
|
EOF
|
|
|
|
# The official installer's single-user root path still shells out to
|
|
# `sudo` to create /nix even though it already knows it's running as
|
|
# root -- confirmed live against a sudo-less minimal Debian/Proxmox
|
|
# node, where it fails with "sudo: not found" and prints this exact
|
|
# mkdir/chown as the manual fix. Pre-create it so that branch of the
|
|
# installer is skipped entirely.
|
|
if [ ! -d /nix ]; then
|
|
mkdir -m 0755 /nix
|
|
chown root /nix
|
|
fi
|
|
|
|
sh <(curl -L https://nixos.org/nix/install) --no-daemon
|
|
else
|
|
sh <(curl -L https://nixos.org/nix/install) --no-daemon
|
|
fi
|
|
|
|
ensure_nix_profile
|
|
}
|
|
|
|
install_nix_if_missing
|
|
ensure_nix_profile
|
|
|
|
mkdir -p "$HOME/.config/nix"
|
|
cat > "$HOME/.config/nix/nix.conf" <<'EOF'
|
|
experimental-features = nix-command flakes
|
|
accept-flake-config = false
|
|
warn-dirty = false
|
|
build-users-group =
|
|
EOF
|
|
|
|
echo "Nix version:"
|
|
nix --version
|
|
|
|
echo "Enabling tracked git hooks (pre-commit secret scan)..."
|
|
git config core.hooksPath .githooks
|
|
|
|
echo "Installing jq if unavailable..."
|
|
if ! command -v jq >/dev/null 2>&1; then
|
|
nix profile install nixpkgs#jq
|
|
fi
|
|
|
|
echo "Available NixOS hosts:"
|
|
list_flake_targets .
|
|
|
|
echo "Codex setup complete. Run bash scripts/codex-maintenance.sh to validate changes."
|