search

nix-community / impermanence

Modules to help you handle persistent state on systems with ephemeral root storage [maintainer=@talyz]
MIT License
1.14k stars 85 forks source link

Default config causes user to be unable to access the nix registry #131

Closed crazyminecuber closed 3 months ago

crazyminecuber commented 1 year ago

First of all, good job with the project! It was easy to get working, some feedback however.

The following line in the example config in the readme

´´´ { file = "/etc/nix/id_rsa"; parentDirectory = { mode = "u=rwx,g=,o="; }; }

´´´

causes a user running nix flake update to get the error 

error: getting status of /etc/nix/registry.json: Permission denied

So I suggest changing the default config to not cause this issue? Or is there a good reason for making /nix private which I am missing?

nixos-discourse commented 1 year ago

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/nix-does-not-use-etc-nix-nix-conf-anymore/29505/11

talyz commented 1 year ago

This is not supposed to be a default config, just an example of what's possible to do. It would be good to have a better example, though. Suggestions are welcome!

crazyminecuber commented 1 year ago

I think the other examples are good, but since the example with /etc/nix/id_rsa seems to break multiple subtle things, I think it should be changed/removed. The other examples show how to set permissions, so I think changing it to just /etc/nix/id_rsa would be fine. I personally have not configured any special permissions for the files field, so I do not have any good examples on hand.

talyz commented 1 year ago

The thing is that it's the only example showing how to use parentDirectory, so I wouldn't want to just remove it without a replacement. I suppose it could just be a made up secret file, though - that's pretty much what the current one is anyway. Also see #106.

C0D3-M4513R commented 3 months ago

I just stumbled across this. I think the nixos wiki for this should be changed and then this can be closed, since the readme in this repo has already been changed.

talyz commented 3 months ago

Fixed by #151.

@C0D3-M4513R Since the wiki entry isn't official or affiliated with the project, I'm going to close this issue now. Feel free to copy the fix to the wiki or whatever is necessary, though.