mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-07-07 21:35:17 +02:00
Ryan Yin
0fe12bef5a
Setting nix.settings.sandbox-paths replaces Nix compiled sandbox defaults. Keeping only /dev/net made local builds lose the sandbox shell that normally provides /bin/sh, which broke upstream scripts with /bin/sh shebangs in packages such as X11-fonts and openldap. Use extra-sandbox-paths for /dev/net instead. This keeps Nix daemon defaults intact, including the configured sandbox shell, while still allowing builds that need /dev/net. Add eval coverage for both Linux output sets so future changes keep /dev/net in extra-sandbox-paths and do not reintroduce an explicit sandbox-paths override.
47 lines
1.7 KiB
Nix
47 lines
1.7 KiB
Nix
{ lib, ... }:
|
|
{
|
|
# auto upgrade nix to the unstable version
|
|
# https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/tools/package-management/nix/default.nix#L284
|
|
# nix.package = pkgs.nixVersions.latest;
|
|
|
|
# https://lix.systems/add-to-config/
|
|
# nix.package = pkgs.lix;
|
|
|
|
# to install chrome, you need to enable unfree packages
|
|
nixpkgs.config.allowUnfree = lib.mkForce true;
|
|
|
|
# do garbage collection weekly to keep disk usage low
|
|
nix.gc = {
|
|
automatic = lib.mkDefault true;
|
|
dates = lib.mkDefault "weekly";
|
|
options = lib.mkDefault "--delete-older-than 7d";
|
|
};
|
|
|
|
# Manual optimise storage: nix-store --optimise
|
|
# https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-auto-optimise-store
|
|
nix.settings = {
|
|
auto-optimise-store = true;
|
|
|
|
# Reference: https://github.com/NixOS/nixpkgs/pull/478109
|
|
# NixOS tests using systemd-nspawn containers require the Nix daemon to be
|
|
# configured with the following settings:
|
|
auto-allocate-uids = true;
|
|
extra-system-features = [ "uid-range" ];
|
|
experimental-features = [
|
|
"auto-allocate-uids"
|
|
"cgroups"
|
|
];
|
|
# Use extra-sandbox-paths instead of sandbox-paths here. The plain
|
|
# sandbox-paths setting replaces Nix's compiled sandbox defaults, including
|
|
# the sandbox shell that provides /bin/sh for builders with legacy shebangs.
|
|
# extra-sandbox-paths keeps those defaults and only adds the paths we need.
|
|
# After deploying, verify the effective daemon config with:
|
|
# nix config show | grep sandbox-paths
|
|
extra-sandbox-paths = [
|
|
"/dev/net"
|
|
];
|
|
};
|
|
|
|
nix.channel.enable = false; # remove nix-channel related tools & configs, we use flakes instead.
|
|
}
|