Draft: nix-darwin module #558
Conversation
This is somewhat but not entirely duplicative with the home manager support. The difference is primarily for MacOS servers, for which there is no LaunchAgent support (as launch agents are tied to user sessions). This PR adds a nix-darwin module (configured similarly to the home manager module) which is suitable for e.g. other launchd daemons.
| description = '' | ||
| Path where secrets are symlinked to. | ||
| If the default is kept no other symlink is created. | ||
| `%r` is replaced by $XDG_RUNTIME_DIR on linux or `getconf |
There was a problem hiding this comment.
This does not exist on macos, right?
|
|
||
| defaultSecretsMountPoint = lib.mkOption { | ||
| type = lib.types.str; | ||
| default = "%r/secrets.d"; |
| options.sops = { | ||
| logFile = lib.mkOption { | ||
| type = lib.types.path; | ||
| default = "/var/log/sops.log"; |
There was a problem hiding this comment.
Do applications need to log themselves to files?
Automatic tests in the CI would be great, but I don't know how this is done on macOS. I do have a macos builder in buildbot, if that helps.
I don't think we need to butcher the nixos options to share them between platforms.
Yes, would be. I assume it's not that different from other platforms?
|
| ''; | ||
| }; | ||
|
|
||
| mode = lib.mkOption { |
There was a problem hiding this comment.
Is there more than these two options (juspay@8580716) that need to be done here in this PR? Because, the installed secrets are still root owned:
-sh-3.2# ls -l /var/root/sops-nix/secrets/
total 16
-r-------- 1 root wheel 13 Jun 19 02:36 example_key
-r-------- 1 root wheel 5 Jun 19 02:36 hello
|
I've tried out this PR. It sort of works (except for setting right permissions, per my comment above), but when activation fails there's no indication on the nix-darwin run side. You have to catch those silently ignored errors by tailing |
|
I can now also finally properly review macOS: https://github.com/Mic92/dotfiles/tree/main/darwin |
|
Hi, I'm really looking forward using the nix-darwin module, because I want to use some sensitive information in my darwin configuration and assume without this module there is no way to do that currently. I would be very happy if you could share something on the current status of this :) |
|
Talked with @Mic92, on thing that could help is to add darwin-test |
|
Not needed for merging but nice for - maintenance. Also this is the up-to-date branch: #647 |
|
This is now merged. |
Fixes #409.
The home manager module covers most cases on Darwin, but does not cover headless devices as agents don't run unless a user session exists. This is a (draft) small copy-paste job of the home-manager integration which is enough to get nix-darwin working.
I'd like feedback on:
and honestly anything else.