Live data from Hacker News

NixOS 21.05

nixos.org

141–150 of 234 posts

Re: NixOS 21.05

#141
post #16

Earlier quoted context omitted.

IMO the biggest blocker is documentation. The best way to figure out how to do something is typically to search around in the nixpkgs/NixOS options for what you're trying to do, then go read the code. There's very little in the way of "here's a common task that new users want to do and here's the blessed way to do it." Even something that should be Nix's MAJOR selling point, like "create a single repo that configures…

It sounds like nix provides an escape hatch [1] out of the declarative framework into something imperative, e.g. running `apt install $package`. And that seems like it would really ease adoption, since I would assume that it would allow a gradual adoption of the declarative mindset. [1] https://wiki.c2.com/?EscapeHatch

nix-env isn't meaningfully an escape hatch, since you can still only use it with stuff that's packaged in Nix's peculiar way.

Here's an overview of the escape hatches that are currently around in NixOS for package management, meaning you can use them to avoid packaging something natively for Nix, or to run pre-built software for other distros or targeting multiple distros:

• flatpak — use flatpak to install stuff just like you would on any other distro: https://nixos.org/manual/nixos/stable/index.html#module-serv...

• FHS user environments — create a usermode chroot that puts Nix packages where naive `./configure; make; make install` programs will expect to see their dependencies

• steam-run — run whatever in the pre-built FHSUserEnv that Nixpkgs uses for Steam: https://nixos.org/manual/nixpkgs/stable/#sec-steam-run

• AppImage — launch an AppImage using `appimage-run` or create a quick and dirty Nix package that wrapps an existing AppImage: https://nixos.org/manual/nixpkgs/stable/#sec-pkgs-appimageTo...

• Docker — you can run stuff with Docker if ya want: https://search.nixos.org/options?channel=unstable&show=virtu...

NixOS also includes little escape hatches on the configuration side for every service. Basically every module also has an ‘extraConfig’ type of option, which lets you append to the config file that NixOS generates for the service in its original/raw format.

Otherwise, you're generally looking at setting up a chroot environment. I can think of some ways that NixOS could be a little more generous with escape hatches, but I don't think there's much developer interest in the community.

Re: NixOS 21.05

#142
post #4

I recently moved my laptop, desktop, and a few servers from Arch Linux to NixOS with flakes and home-manager. It is amazing! The complete configuration for all machines is in a single git repository, I can share configuration between them, and a `flake.lock` file guarantees all machines are using the same version of everything. No more trying to remember what command I need to run to install and configure software an…

> and a few servers The problem I see with NixOS on a typical personal server is that you have to setup all these things using nix expressions, from which the actual configuration files are generated. That means if you e.g. want to install postfix, instead of learning about main.cf you have to learn the syntax of the nix configuration wrapper for postfix, and postfix having hundreds if not thousands of options, many…

NixOS makes it easy to emit raw configuration files if you want. I do this for software where I want more control than the Nix wrapper exposes.

Re: NixOS 21.05

#143

Earlier quoted context omitted.

Please don't recommend that people use nix-env. It's one of Nix's biggest footguns and a huge support burden for the maintainers. We've been actively trying to remove mentions of it from the documentation. If you want something "installed" use home-manager. If you just want something for quick dev use nix-shell.

I'm so glad this is the official line now. People giving examples using nix-env -I is, IMO, one of the major reasons it's so hard to get up and running. It's like... here are all the amazing reasons to do declarative config... and here's how you do everything using nix-env -I. Good luck figuring out how to translate it into a NixOS config so you can get all the benefits of declarative config that we just described!

> Good luck figuring out how to translate it into a NixOS config so you can get all the benefits of declarative config that we just described!

Guix has a command that converts an imperative profile to a declarative one. Check out the `--export-manifest` option for `guix package`: https://guix.gnu.org/manual/en/guix.html#Invoking-guix-packa...

Adding this to nix-env's replacement would be a sound approach imo. Maybe we could have one that also emits a little message for each package which is used in a NixOS module, directing users to a `programs.whatever` option instead of just dumping it in their `environment.systemPackages` list

Re: NixOS 21.05

#144
post #123

Earlier quoted context omitted.

My experience, a while ago I will admit, is that your experience will vary wildly based on what you’re doing with it. Writing Haskell in it was a joy, but Ruby was pure pain. I actually never could get RoR to run (this might have changed), so I gave up and went to OSX for that stuff.

I haven't used Ruby, but Python also was a huge pain and there were many attempts at fixing it, but all had some issues for me. That is until I found poetry2nix.

How does poetry2nix compare to mach-nix, in your opinion? The way mach-nix handles native (non-Python) dependencies strikes me as really slick.

Re: NixOS 21.05

#145
post #4

I recently moved my laptop, desktop, and a few servers from Arch Linux to NixOS with flakes and home-manager. It is amazing! The complete configuration for all machines is in a single git repository, I can share configuration between them, and a `flake.lock` file guarantees all machines are using the same version of everything. No more trying to remember what command I need to run to install and configure software an…

> and a few servers The problem I see with NixOS on a typical personal server is that you have to setup all these things using nix expressions, from which the actual configuration files are generated. That means if you e.g. want to install postfix, instead of learning about main.cf you have to learn the syntax of the nix configuration wrapper for postfix, and postfix having hundreds if not thousands of options, many…

Your best friend is https://search.nixos.org/options

From a quick search, it seems you can use `services.postfix.config` and pass key-value pairs as arbitrary options. Not familiar with this service, but usually if a given one has more complex syntax, there is a “pass-through” option that will simply append to the given config file whatever text you provide, as well as as the sister reply says you can create manually additional files.

Re: NixOS 21.05

#146
post #140

Earlier quoted context omitted.

>I don't believe it's fair to spread doubts I think it is fair as long as I make it clear (which I hope I have) that I didn't investigate fully after I saw some warning signs. >spread doubts just because they don't get fixed in a day or two. I am not a security expert, but tptacek is, and in 2017 he wrote that "You don't want your browser to be any number of days behind the Chromium patch cycle."[1] IIRC, tptacek or…

That's wrong. The google-chrome packages in nixpkgs are "built" by downloading the official releases (in .deb format I think) and massaging them a little. It takes a few seconds. When the zero-days came out, I just updated the upstream-info.json file in my local nixpkgs checkout (look at previous chrome version bump commits for how to do it) and rebuilt my system. I didn't have to wait for any PRs or merges or CI/hyd…

For anyone reading along, if you visit https://www.google.com/chrome/ from a Linux box, then click the big blue "Download" button, you are offered the choice of a .deb or an .rpm. I take it that that is what parent means by "the official releases".

>massaging them a little. It takes a few seconds.

Interesting and surprising. When I run ldd on my Chrome binary (which comes straight from Google, not my distro), it lists 101 dynamically-linked libraries. I believe that that means that the binary contains references (i.e., file names) to those 101 libraries. Does the massaging process just replace those references (file names) with the appropriate names beginning with "/nix/store/"? I.e., does the massaging process edit the binary?

(If so, I'm a little surprised, what with how paranoid Google is, that Chrome doesn't refuse to start because the binary has a different checksum!)

Re: NixOS 21.05

#147
post #123

Earlier quoted context omitted.

My experience, a while ago I will admit, is that your experience will vary wildly based on what you’re doing with it. Writing Haskell in it was a joy, but Ruby was pure pain. I actually never could get RoR to run (this might have changed), so I gave up and went to OSX for that stuff.

I haven't used Ruby, but Python also was a huge pain and there were many attempts at fixing it, but all had some issues for me. That is until I found poetry2nix.

My understanding is that Python packages are directly installable via nix, at least some of them. This is a completely parallel way of installing packages from the regular way, which sucks, but at least it works in theory. I never personally tried it though.

Stack (Haskell) was awesome because it’s Nix aware, enabling it to create its own env to handle C deps on it’s own.

Re: NixOS 21.05

#148
post #145

Earlier quoted context omitted.

> and a few servers The problem I see with NixOS on a typical personal server is that you have to setup all these things using nix expressions, from which the actual configuration files are generated. That means if you e.g. want to install postfix, instead of learning about main.cf you have to learn the syntax of the nix configuration wrapper for postfix, and postfix having hundreds if not thousands of options, many…

Your best friend is https://search.nixos.org/options From a quick search, it seems you can use `services.postfix.config` and pass key-value pairs as arbitrary options. Not familiar with this service, but usually if a given one has more complex syntax, there is a “pass-through” option that will simply append to the given config file whatever text you provide, as well as as the sister reply says you can create manually…

The thing with a lot of server software (like postfix) is that configuration is usually spread across many files.

And then there is the re-use of things between services, for example DKIM’s generated public key should be made available as a TXT record by the DNS server, the SSL certificate kept up-to-date by the web server should be used by both the smtp and imap servers, though it may need to include the full chain, and services may need to be relaunched, if the certificate is updated, etc.

I was hoping to hear from someone who had managed to get a “full” server running (with SMTP, IMAP, DKIM, DNS, DNSSec, HTTPS via ACME, etc.), because while I know that I can output raw configuration files, it seems like an extremely daunting task to weave all this together in something semantically meaningful.

Right now I have /etc under git control and a Makefile that handles all dependencies between the various pieces (i.e. to ensure proper files are regenerated/indexed as needed, and services relaunched when dependencies are updated).

Re: NixOS 21.05

#149
post #4

I recently moved my laptop, desktop, and a few servers from Arch Linux to NixOS with flakes and home-manager. It is amazing! The complete configuration for all machines is in a single git repository, I can share configuration between them, and a `flake.lock` file guarantees all machines are using the same version of everything. No more trying to remember what command I need to run to install and configure software an…

> and a few servers The problem I see with NixOS on a typical personal server is that you have to setup all these things using nix expressions, from which the actual configuration files are generated. That means if you e.g. want to install postfix, instead of learning about main.cf you have to learn the syntax of the nix configuration wrapper for postfix, and postfix having hundreds if not thousands of options, many…

> I am curious if anyone have experience to share?

With one exception (nginx, because it's very well supported) I always just use raw config files and ignore the options. For TVL[0] we've written a bunch of NixOS modules[1] ourselves where the upstream one was either not flexible enough, or deviated strongly from how we wanted things to work.

Nix is the kind of tool that lends itself well to solutions that are more complicated than the problem, but once you get comfortable with the tool it's easy to sidestep that. Despite these warts it's 100% worth the investment.

[0]: https://code.tvl.fyi/about/

[1]: https://cs.tvl.fyi/depot/-/tree/ops/modules

Re: NixOS 21.05

#150
post #145

Earlier quoted context omitted.

Your best friend is https://search.nixos.org/options From a quick search, it seems you can use `services.postfix.config` and pass key-value pairs as arbitrary options. Not familiar with this service, but usually if a given one has more complex syntax, there is a “pass-through” option that will simply append to the given config file whatever text you provide, as well as as the sister reply says you can create manually…

The thing with a lot of server software (like postfix) is that configuration is usually spread across many files. And then there is the re-use of things between services, for example DKIM’s generated public key should be made available as a TXT record by the DNS server, the SSL certificate kept up-to-date by the web server should be used by both the smtp and imap servers, though it may need to include the full chain,…

I do have all these things (https://github.com/Mic92/dotfiles/blob/master/nixos/eve/modu..., https://github.com/Mic92/dotfiles/blob/master/nixos/eve/modu..., https://github.com/Mic92/dotfiles/blob/master/nixos/eve/modu... ...). Especially things like ACME work a lot better the NixOS-provided curated and unit-tested acme module compared to setting up it yourself. You can also use the Nixos simple mail server setup that already provides sane defaults and puts the individual nixos modules together: https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/
Post reply on HN