Open PhDyellow opened 3 weeks ago
As I wrote that up, it occured to me that expecting NixOS to put a symlink to sshd_config
into a persistent directory is not a great plan, as I will end up with a meaningless symlink in persistent storage.
Finally, a practical question, can I just force all the persistent directories to be mounted during stage-1-init, or will that cause problems?
I'm still digging around, and I don't know why my syncthing config is working at all, but the main question still stands.
I've been wondering the same thing. Here's what I've found so far.
The stage-1-init mounts are because of the pathsNeededForBoot
list in Nixpkgs.
I haven't been able to find any special logic for machine-id in Nixpkgs.
The other paths can be mounted in arbitrary order, but always before local-fs.target for both files and directories (built-in systemd logic, see man systemd.special
). systemd is pretty aggressive in parallelising unit start, so if a unit file doesn't mention a path (eg. via RequiresMountsFor) then there's no guarantee that any particular filesystems will be mounted before that unit starts. I don't know of a general way to fix this; I'm planning on just adding RequiresMountsFor= to specific services if I run into this issue.
/etc
is populated by the activation script which is executed in stage-2-init. Setting neededForBoot
on the mount unit for /etc/ssh
could work, but as you noted you'll end up with symlinks in your persistent directory. You can instead mount specific files into /etc/ssh
.
I am moving my configuration to impermanence, using btrfs subvolumes to erase root on each boot. The persistent directory is on another subvolume in the same btrfs partition, and
/nix
is inside the persisted subvolI have hit a number of issues with programs not having the needed files, and did a bit of digging into the system logs.
Given the following impermanence config:
The systemd logs show that
/nix
,/var/lib/nixos
and/var/log
are mounted very early in the boot sequence, near the end of stage-1-init.Then
/etc/machine-id
is bound after just stage-2-init, while systemd is running but before journalling is started.Finally,
/etc/secureboot
,/var/lib/systemd
,/secrets
and/etc/ssh
are mounted after a number of other services have started up, includinglocal-fs-pre.target
.The home manager files are mounted even later, and a number of services have started by the time they are mounted.
Programs that were caught out were
syncthing
, which started before thesyncthing
config directory had been mounted in my home directory, andsshd
, which did start after/etc/ssh
was mounted, but because NixOS had already created and configured/etc/ssh
, the nixos-configuredsshd_config
file was hidden by the bind mount.I was able to fix syncthing by modifying it's systemd service with the following nixos module:
I find the order directories are mounted during the boot process confusing and unexpected. I want all the persistent directories and files bound or symlinked before system services start trying to read config files. I expected NixOS to write
sshd_config
into/etc/ssh
beside the persisted machine keys.I think this could be resolved with a good understanding of when persistent entries are mounted. Could someone explain the logic to me?