1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
|
= Running Guix on NixOS
:install-step: https://www.gnu.org/software/guix/manual/en/html_node/Binary-Installation.html#Binary-Installation
I wanted to run Guix on a NixOS machine. Even though the Guix manual explains
how to do it {install-step}[step by step], I needed a few extra ones to make it
work properly.
I couldn't just install GuixSD because my wireless network card doesn't have any
free drivers (yet).
== Creating `guixbuilder` users
:manual: https://www.gnu.org/software/guix/manual/en/html_node/Build-Environment-Setup.html#Build-Environment-Setup
Guix requires you to create non-root users that will be used to perform the
builds in the isolated environments.
The {manual}[manual] already provides you with a ready to run (as root) command
for creating the build users:
[source,bash]
----
groupadd --system guixbuild
for i in `seq -w 1 10`;
do
useradd -g guixbuild -G guixbuild \
-d /var/empty -s `which nologin` \
-c "Guix build user $i" --system \
guixbuilder$i;
done
----
:mutable-users: https://nixos.org/nixos/manual/index.html#sec-user-management
However, In my personal NixOS I have disabled
{mutable-users}[`users.mutableUsers`], which means that even if I run the above
command it means that they'll be removed once I rebuild my OS:
[source,shell]
----
$ sudo nixos-rebuild switch
(...)
removing user ‘guixbuilder7’
removing user ‘guixbuilder3’
removing user ‘guixbuilder10’
removing user ‘guixbuilder1’
removing user ‘guixbuilder6’
removing user ‘guixbuilder9’
removing user ‘guixbuilder4’
removing user ‘guixbuilder2’
removing user ‘guixbuilder8’
removing user ‘guixbuilder5’
(...)
----
Instead of enabling `users.mutableUsers` I could add the Guix users by adding
them to my system configuration:
[source,nix]
----
{ config, pkgs, ...}:
{
# ... NixOS usual config ellided ...
users = {
mutableUsers = false;
extraUsers =
let
andrehUser = {
andreh = {
# my custom user config
};
};
buildUser = (i:
{
"guixbuilder${i}" = { # guixbuilder$i
group = "guixbuild"; # -g guixbuild
extraGroups = ["guixbuild"]; # -G guixbuild
home = "/var/empty"; # -d /var/empty
shell = pkgs.nologin; # -s `which nologin`
description = "Guix build user ${i}"; # -c "Guix buid user $i"
isSystemUser = true; # --system
};
}
);
in
# merge all users
pkgs.lib.fold (str: acc: acc // buildUser str)
andrehUser
# for i in `seq -w 1 10`
(map (pkgs.lib.fixedWidthNumber 2) (builtins.genList (n: n+1) 10));
extraGroups.guixbuild = {
name = "guixbuild";
};
};
}
----
Here I used `fold` and the `//` operator to merge all of the configuration sets
into a single `extraUsers` value.
== Creating the `systemd` service
:service-file: https://git.savannah.gnu.org/cgit/guix.git/tree/etc/guix-daemon.service.in?id=00c86a888488b16ce30634d3a3a9d871ed6734a2
One other thing missing was the `systemd` service.
First I couldn't just copy the `.service` file to `/etc` since in NixOS that
folder isn't writable. But also I wanted the service to be better integrated
with the OS.
That was a little easier than creating the users, all I had to do was translate
the provided {service-file}[`guix-daemon.service.in`] configuration to an
equivalent Nix expression:
[source,ini]
----
# This is a "service unit file" for the systemd init system to launch
# 'guix-daemon'. Drop it in /etc/systemd/system or similar to have
# 'guix-daemon' automatically started.
[Unit]
Description=Build daemon for GNU Guix
[Service]
ExecStart=/var/guix/profiles/per-user/root/guix-profile/bin/guix-daemon --build-users-group=guixbuild
Environment=GUIX_LOCPATH=/root/.guix-profile/lib/locale
RemainAfterExit=yes
StandardOutput=syslog
StandardError=syslog
# See <https://lists.gnu.org/archive/html/guix-devel/2016-04/msg00608.html>.
# Some package builds (for example, go@1.8.1) may require even more than
# 1024 tasks.
TasksMax=8192
[Install]
WantedBy=multi-user.target
----
This sample `systemd` configuration file became:
[source,nix]
----
guix-daemon = {
enable = true;
description = "Build daemon for GNU Guix";
serviceConfig = {
ExecStart = "/var/guix/profiles/per-user/root/guix-profile/bin/guix-daemon --build-users-group=guixbuild";
Environment="GUIX_LOCPATH=/root/.guix-profile/lib/locale";
RemainAfterExit="yes";
StandardOutput="syslog";
StandardError="syslog";
TaskMax= "8192";
};
wantedBy = [ "multi-user.target" ];
};
----
There you go! After running `sudo nixos-rebuild switch` I could get Guix up and
running:
[source,bash]
----
$ guix package -i hello
The following package will be installed:
hello 2.10 /gnu/store/bihfrh609gkxb9dp7n96wlpigiv3krfy-hello-2.10
substitute: updating substitutes from 'https://mirror.hydra.gnu.org'... 100.0%
The following derivations will be built:
/gnu/store/nznmdn6inpwxnlkrasydmda4s2vsp9hg-profile.drv
/gnu/store/vibqrvw4c8lacxjrkqyzqsdrmckv77kq-fonts-dir.drv
/gnu/store/hi8alg7wi0wgfdi3rn8cpp37zhx8ykf3-info-dir.drv
/gnu/store/cvkbp378cvfjikz7mjymhrimv7j12p0i-ca-certificate-bundle.drv
/gnu/store/d62fvxymnp95rzahhmhf456bsf0xg1c6-manual-database.drv
Creating manual page database...
1 entries processed in 0.0 s
2 packages in profile
$ hello
Hello, world!
----
:nixos-modules: https://nixos.org/nixos/manual/index.html#sec-writing-modules
:req: https://www.gnu.org/software/guix/manual/en/html_node/Requirements.html#Requirements
Some improvements to this approach are:
. looking into {nixos-modules}[NixOS modules] and trying to bundle everything
together into a single logical unit;
. {req}[build Guix from source] and share the Nix store and daemon with Guix.
Happy Guix/Nix hacking!
|
