From d98529651ebcbe442d5cc689d70b81390a940cc8 Mon Sep 17 00:00:00 2001
From: Jean-Paul Calderone <exarkun@twistedmatrix.com>
Date: Mon, 19 Jul 2021 10:08:05 -0400
Subject: [PATCH] Use nixpkgs-2105 from out checkout instead of passing a path
around
This is what we wanted and much more directly. It also avoids the gradual
lengthening of the path by always setting the path to nixpkgs-2105 instead of
some derivative of whatever the path was last time.
---
nixos/modules/deployment.nix | 12 +-----------
nixos/modules/update-deployment | 8 ++------
2 files changed, 3 insertions(+), 17 deletions(-)
diff --git a/nixos/modules/deployment.nix b/nixos/modules/deployment.nix
index 4c3a9dd0..b0a5e3c4 100755
--- a/nixos/modules/deployment.nix
+++ b/nixos/modules/deployment.nix
@@ -11,13 +11,7 @@ let
# `restrict` means "disable all the things" then `command` means "but
# enable running this one command" (the client does not have to supply the
# command; if they authenticate, this is the command that will run).
- # environment lets us pass an environment variable into the process
- # started by the given command. It only works because we configured our
- # sshd to allow this particular variable through. By passing this value,
- # we can pin nixpkgs in the executed command to the same version
- # configured for use here. It might be better if we just had a channel
- # the system could be configured with ... but we don't at the moment.
- "restrict,environment=\"NIXPKGS_FOR_MORPH=${pkgs.path}\",command=\"${command} ${gridName}\" ${authorizedKey}";
+ "restrict,command=\"${command} ${gridName}\" ${authorizedKey}";
in {
options = {
services.private-storage.deployment.authorizedKey = lib.mkOption {
@@ -50,10 +44,6 @@ in {
];
};
- services.openssh.extraConfig = ''
- PermitUserEnvironment=NIXPKGS_FOR_MORPH
- '';
-
# Create a one-time service that will set up an ssh key that allows the
# deployment user to authorize as root to perform the system update with
# `morph deploy`.
diff --git a/nixos/modules/update-deployment b/nixos/modules/update-deployment
index 19599a4a..cc8dd996 100755
--- a/nixos/modules/update-deployment
+++ b/nixos/modules/update-deployment
@@ -75,12 +75,8 @@ EOF
# Make sure known_hosts has the host key in it.
ssh -o StrictHostKeyChecking=no "$(hostname).$(domainname)" ":"
-# Set nixpkgs to our preferred version for the morph build. The NIX_PATH
-# environment variable itself receives special treatment by some parts of the
-# system (especially those parts leading up to the execution of this script)
-# so we pass the desired information through a different variable and then
-# shuffle it into the right place here, just before it is needed.
-export NIX_PATH="nixpkgs=$NIXPKGS_FOR_MORPH"
+# Set nixpkgs to our preferred version for the morph build.
+export NIX_PATH="nixpkgs=${CHECKOUT}/nixpkgs-2105.nix"
# Attempt to update just this host. Choose the morph grid definition matching
# the grid we belong to and limit the morph deployment update to the host
--
GitLab