From e1ccbe9abd5042e5622379bcae35a81bfd242330 Mon Sep 17 00:00:00 2001 From: Emily Date: Fri, 27 Jun 2025 13:24:59 +0100 Subject: [PATCH] daemon: prefer daemon stores for `nix-daemon --stdio` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Using `AllowDaemon::Disallow` here broke `ssh-ng://` remote builds in multi‐user setups where the remote builder user does not have write access to the store, now that the automatic store selection logic has changed. Switch to the default behaviour for this path to fix that. This causes `ssh-ng://` builds to use the daemon by default on the remote end, even as `root`. I think this is desirable, as the previous change already made `ssh://` behave this way, and the pitfalls of local stores apply to remote builds too. For instance, there were persistent `ulimit` issues on the NixOS Hydra macOS builders that were resolved by forcing use of the daemon, and I believe the Linux builders also go through the daemon these days due to using non‐`root` SSH users. I believe that the `root` vs. non‐`root` difference is just as confusing for remote builds as it is for local ones. `ssh-ng://root@builder?remote-store=local` can be used to revert back to the previous default if necessary. Closes: #884 Fixes: 9a59106c172b7d5963e3dc2cf07ff5b19f8119d6 Change-Id: I6a6a696410f46cd3f2f5a94073ea924ad45dc99c --- lix/nix/daemon.cc | 6 +++--- tests/nixos/default.nix | 2 -- tests/nixos/remote-builds-ssh-ng.nix | 11 +---------- 3 files changed, 4 insertions(+), 15 deletions(-) diff --git a/lix/nix/daemon.cc b/lix/nix/daemon.cc index 41cd23f9a..cb5be6784 100644 --- a/lix/nix/daemon.cc +++ b/lix/nix/daemon.cc @@ -225,12 +225,12 @@ static PeerInfo getPeerInfo(int remote) /** * Open a store without a path info cache. */ -static kj::Promise>> openUncachedStore() +static kj::Promise>> openUncachedStore(AllowDaemon allowDaemon = AllowDaemon::Allow) try { StoreConfig::Params params; // FIXME: get params from somewhere // Disable caching since the client already does that. params["path-info-cache-size"] = "0"; - co_return TRY_AWAIT(openStore(settings.storeUri, params, AllowDaemon::Disallow)); + co_return TRY_AWAIT(openStore(settings.storeUri, params, allowDaemon)); } catch (...) { co_return result::current_exception(); } @@ -369,7 +369,7 @@ static void daemonLoopImpl(std::optional forceTrustClientOpt) FdSource from(remote.get()); FdSink to(remote.get()); processConnection( - aio, aio.blockOn(openUncachedStore()), from, to, trusted + aio, aio.blockOn(openUncachedStore(AllowDaemon::Disallow)), from, to, trusted ); exit(0); diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix index 9539249b5..6c40531bf 100644 --- a/tests/nixos/default.nix +++ b/tests/nixos/default.nix @@ -122,8 +122,6 @@ in }; }; sshUser = "test-user"; - # FIXME: - expectSuccess = false; }; # Test our Nix as a client against remotes that are older diff --git a/tests/nixos/remote-builds-ssh-ng.nix b/tests/nixos/remote-builds-ssh-ng.nix index e2a40b5d0..d60446c7f 100644 --- a/tests/nixos/remote-builds-ssh-ng.nix +++ b/tests/nixos/remote-builds-ssh-ng.nix @@ -44,14 +44,6 @@ in ''; default = "root"; }; - - expectSuccess = lib.mkOption { - type = lib.types.bool; - description = '' - Whether to expect the remote build to succeed or not. - ''; - default = true; - }; }; config = { @@ -123,9 +115,8 @@ in client.succeed(f"ssh -o StrictHostKeyChecking=no {ssh_user}@{builder.name} 'echo hello world' >&2") # Perform a build - out = client.${if test.config.expectSuccess then "succeed" else "fail"}("nix-build ${expr nodes.client 1} 2> build-output") + out = client.succeed("nix-build ${expr nodes.client 1} 2> build-output") - '' + lib.optionalString test.config.expectSuccess '' # Verify that the build was done on the builder builder.succeed(f"test -e {out.strip()}")