bind-mount attempt

files/scripts/install-lix.sh

@@ -5,7 +5,7 @@ set -euo pipefail
 
 rpm_url="https://nix-community.github.io/nix-installers/lix/x86_64/lix-multi-user-2.91.1.rpm"
 
-install -d /usr/share/nix-store /var/lib/nix-store /var/cache/nix-store /nix /etc/nix
+install -d /usr/share/nix-store /var/lib/nix-store /nix /etc/nix
 
 # Avoid systemd calls during RPM %post in the image build environment.
 export SYSTEMD_OFFLINE=1
@@ -40,8 +40,9 @@ ensure_list_value() {
 ensure_list_value "substituters" "$lix_cache_url"
 ensure_list_value "trusted-public-keys" "$lix_cache_key"
 
-# === MOVE INITIAL NIX STORE TO LOWERDIR ===
+# === SEED STORE FOR FIRST BOOT (copied into /var on boot) ===
 
 if compgen -G "/nix/*" >/dev/null; then
-  mv /nix/* /usr/share/nix-store/
+  rsync -aH --delete /nix/ /usr/share/nix-store/
+  rm -rf /nix/*
 fi

files/system/etc/modules-load.d/overlay.conf

@@ -1 +0,0 @@
-overlay

files/system/usr/bin/mount-nix-overlay.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-mkdir -p /usr/share/nix-store /var/lib/nix-store /var/cache/nix-store /nix
-
-# Skip if already mounted to avoid errors on reload.
-if mountpoint -q /nix; then
-  exit 0
-fi
-
-mount -t overlay overlay \
-  -o lowerdir=/usr/share/nix-store,upperdir=/var/lib/nix-store,workdir=/var/cache/nix-store \
-  /nix

files/system/usr/bin/mount-nix.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Bind-mount /var/lib/nix-store to /nix.
+# If /var/lib/nix-store is empty, seed it from the baked store in /usr/share/nix-store.
+
+mkdir -p /usr/share/nix-store /var/lib/nix-store /nix
+
+copy_seed_store() {
+  if command -v rsync >/dev/null 2>&1; then
+    rsync -aH --delete /usr/share/nix-store/ /var/lib/nix-store/
+  else
+    cp -a /usr/share/nix-store/. /var/lib/nix-store/
+  fi
+}
+
+if ! mountpoint -q /nix; then
+  if [ -z "$(ls -A /var/lib/nix-store 2>/dev/null)" ] && compgen -G "/usr/share/nix-store/*" >/dev/null; then
+    copy_seed_store
+  fi
+
+  mount --bind /var/lib/nix-store /nix
+  mount -o remount,bind,exec /nix
+
+  # Ensure daemon paths exist and labels are sane.
+  if command -v systemd-tmpfiles >/dev/null 2>&1; then
+    systemd-tmpfiles --create /usr/lib/tmpfiles.d/nix-daemon.conf
+  fi
+  if command -v restorecon >/dev/null 2>&1; then
+    restorecon -RF /var/lib/nix-store /nix || true
+  fi
+fi

files/system/usr/lib/systemd/system/nix-overlay.service

@@ -1,14 +1,14 @@
 [Unit]
-Description=Mount OverlayFS for /nix
+Description=Bind-mount /var/lib/nix-store to /nix
 DefaultDependencies=no
 After=local-fs.target
-Before=systemd-tmpfiles-setup.service nix-daemon.service nix-daemon.socket
-ConditionPathExists=/usr/bin/mount-nix-overlay.sh
+RequiresMountsFor=/var /var/lib/nix-store
+Before=nix-daemon.service nix-daemon.socket
+ConditionPathExists=/usr/bin/mount-nix.sh
 
 [Service]
 Type=oneshot
-ExecStart=/usr/bin/mount-nix-overlay.sh
-ExecStartPost=/usr/bin/systemd-tmpfiles --create /usr/lib/tmpfiles.d/nix-daemon.conf
+ExecStart=/usr/bin/mount-nix.sh
 RemainAfterExit=yes
 
 [Install]