From 5afecd67c5cdda4c0e5dda5847d042d53d3284c1 Mon Sep 17 00:00:00 2001 From: randogoth Date: Tue, 30 Dec 2025 11:08:13 +0200 Subject: [PATCH 1/3] lix rpm from nix-community --- README.md | 8 ++++---- files/scripts/install-nix.sh | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index dd5f231..8ad098e 100644 --- a/README.md +++ b/README.md @@ -1,11 +1,11 @@ # Deinonyxus   [![bluebuild build badge](https://github.com/randogoth/deinonyxus/actions/workflows/build.yml/badge.svg)](https://github.com/randogoth/deinonyxus/actions/workflows/build.yml) -*Deinonyxus* is a personal spin of the UBlue Bluefin DX image with experimental Nix package manager baked in (borrowed from the great [Daemonix](https://github.com/DXC-0/daemonix/) image) and a first-login bootstrap for `nix/home-manager`-like declarative package management using [curator](https://codeberg.org/randogoth/curator). +*Deinonyxus* is a personal spin of the UBlue Bluefin DX image with the 🍦[Lix](https://lix.systems/) flavored Nix package manager baked in and a first-login bootstrap for simple declarative package management using [curator](https://codeberg.org/randogoth/curator). ## What’s inside - Base: `ghcr.io/ublue-os/bluefin-dx:latest` without Cockpit, Docker, Firefox, VS Code -- Nix: multi-user install baked in; `nix-overlay.service` and `nix-daemon.service` enabled. -(D) - First-login bootstrap: installs nix packages `devbox`, `mc`,and `micro` via `curator` +- Lix: multi-user install baked in with persistence at `/var/home/nix`; `nix-daemon.service` enabled. +(D) - First-login bootstrap: installs Lix/nix packages `devbox`, `mc`, and `micro` via `curator` - System packages added: `syncthing`, `uv`, `vscodium`, `waydroid`; - System flatpaks added: Telegram Desktop, Waterfox @@ -37,4 +37,4 @@ bluebuild build --recipe recipes/recipe.yml Images are signed with Sigstore/cosign. Verify with the repo's `cosign.pub`: ```bash cosign verify --key cosign.pub ghcr.io/randogoth/deinonyxus -``` \ No newline at end of file +``` diff --git a/files/scripts/install-nix.sh b/files/scripts/install-nix.sh index 05e0457..9c51a18 100755 --- a/files/scripts/install-nix.sh +++ b/files/scripts/install-nix.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash set -euo pipefail -rpm_url="https://nix-community.github.io/nix-installers/nix/x86_64/nix-multi-user-2.24.10.rpm" +rpm_url="https://nix-community.github.io/nix-installers/lix/x86_64/lix-multi-user-2.91.1.rpm" install -d /usr/share/nix-store /var/lib/nix-store /var/cache/nix-store /nix From 4274d2db555fadb1337b02073b7c92a98254340b Mon Sep 17 00:00:00 2001 From: randogoth Date: Tue, 30 Dec 2025 12:56:58 +0200 Subject: [PATCH 2/3] lix key fix --- README.md | 2 +- files/scripts/install-nix.sh | 30 ++++++++++++++++++- .../system/usr/libexec/deinonyxus/curator.sh | 4 ++- recipes/recipe.yml | 2 +- 4 files changed, 34 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 8ad098e..1a12cdc 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ - Lix: multi-user install baked in with persistence at `/var/home/nix`; `nix-daemon.service` enabled. (D) - First-login bootstrap: installs Lix/nix packages `devbox`, `mc`, and `micro` via `curator` - System packages added: `syncthing`, `uv`, `vscodium`, `waydroid`; -- System flatpaks added: Telegram Desktop, Waterfox +- System flatpaks added: Telegram Desktop, Zen Browser ## First login behavior - Triggers for each non-root user on their first session. diff --git a/files/scripts/install-nix.sh b/files/scripts/install-nix.sh index 9c51a18..14fdf75 100755 --- a/files/scripts/install-nix.sh +++ b/files/scripts/install-nix.sh @@ -3,7 +3,7 @@ set -euo pipefail rpm_url="https://nix-community.github.io/nix-installers/lix/x86_64/lix-multi-user-2.91.1.rpm" -install -d /usr/share/nix-store /var/lib/nix-store /var/cache/nix-store /nix +install -d /usr/share/nix-store /var/lib/nix-store /var/cache/nix-store /nix /etc/nix # Avoid systemd calls during RPM %post in the image build environment. export SYSTEMD_OFFLINE=1 @@ -11,6 +11,34 @@ export SYSTEMD_OFFLINE=1 # Install the RPM; allow missing GPG key since we fetch directly by URL. dnf install -y --nogpgcheck "$rpm_url" +nix_conf=/etc/nix/nix.conf +lix_cache_url="https://cache.lix.systems/" +lix_cache_key="cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=" + +ensure_list_value() { + local key="$1" value="$2" escaped_value + escaped_value=$(printf '%s' "$value" | sed 's/[\\&]/\\&/g') + + touch "$nix_conf" + + if grep -Eq "^${key}[[:space:]]*=.*${escaped_value}" "$nix_conf"; then + return + fi + + if grep -Eq "^${key}[[:space:]]*=" "$nix_conf"; then + sed -i "s|^${key}[[:space:]]*= *\\(.*\\)|${key} = \\1 ${escaped_value}|" "$nix_conf" + else + echo "${key} = ${value}" >>"$nix_conf" + fi +} + +ensure_list_value "substituters" "$lix_cache_url" +ensure_list_value "trusted-public-keys" "$lix_cache_key" + +# # Ensure the overlay mount service is enabled so /nix is populated on boot. +# mkdir -p /etc/systemd/system/multi-user.target.wants +# ln -sf /usr/lib/systemd/system/nix-overlay.service /etc/systemd/system/multi-user.target.wants/nix-overlay.service + # Move the pre-populated store out of /nix so it can serve as the immutable lowerdir. if compgen -G "/nix/*" >/dev/null; then mv /nix/* /usr/share/nix-store/ diff --git a/files/system/usr/libexec/deinonyxus/curator.sh b/files/system/usr/libexec/deinonyxus/curator.sh index 4fc2b1c..84dcc6c 100755 --- a/files/system/usr/libexec/deinonyxus/curator.sh +++ b/files/system/usr/libexec/deinonyxus/curator.sh @@ -6,4 +6,6 @@ curator_git="--from git+https://codeberg.org/randogoth/curator/" uvx $curator_git curator init uvx $curator_git curator add nix:mc nix:micro nix:devbox uvx $curator_git curator switch -uv tool install $curator_git curator \ No newline at end of file +uv tool install $curator_git curator + +nix upgrade-nix \ No newline at end of file diff --git a/recipes/recipe.yml b/recipes/recipe.yml index b6d98d1..a16ff15 100644 --- a/recipes/recipe.yml +++ b/recipes/recipe.yml @@ -66,7 +66,7 @@ modules: scope: system # If no repo information is specified, Flathub will be used by default install: # system flatpaks we want all users to have and not remove - - net.waterfox.waterfox + - app.zen_browser.zen - org.telegram.desktop remove: # replace default Firefox with Waterfox - org.mozilla.firefox From 67a413bce897cdbb729ef50972f3f259b57324b4 Mon Sep 17 00:00:00 2001 From: randogoth Date: Tue, 30 Dec 2025 16:19:24 +0200 Subject: [PATCH 3/3] finalized Lix setup --- README.md | 8 ++++++-- files/justfiles/nixpkgs.just | 7 +++++++ files/scripts/{install-nix.sh => install-lix.sh} | 13 ++++++------- files/system/usr/libexec/deinonyxus/curator.sh | 4 +--- recipes/recipe.yml | 8 ++++++-- 5 files changed, 26 insertions(+), 14 deletions(-) create mode 100644 files/justfiles/nixpkgs.just rename files/scripts/{install-nix.sh => install-lix.sh} (71%) diff --git a/README.md b/README.md index 1a12cdc..c7fba93 100644 --- a/README.md +++ b/README.md @@ -9,11 +9,15 @@ - System packages added: `syncthing`, `uv`, `vscodium`, `waydroid`; - System flatpaks added: Telegram Desktop, Zen Browser -## First login behavior +## First login - Triggers for each non-root user on their first session. - Writes state to `~/.local/state/deinonyxus/curator-init.done`; delete it to rerun. - Bootstraps `~/.config/curator/inventory.toml` and runs `curator switch` with the packages set above. +## Just Recipes +- `upgrade-nix`: upgrades to the latest version of Lix via the user profile. Replaces `nix upgrade-nix` which does not work with an immutable lowerdir `/nix/store` folder +- `install-nix-software-center`: installs a graphical app store for Nix packages + ## Install / Rebase ```bash @@ -30,7 +34,7 @@ The `latest` tag always tracks the latest build for the Fedora base set in `reci ## Building locally ```bash -bluebuild build --recipe recipes/recipe.yml +bluebuild build ``` ## Signature verification diff --git a/files/justfiles/nixpkgs.just b/files/justfiles/nixpkgs.just new file mode 100644 index 0000000..9ba6977 --- /dev/null +++ b/files/justfiles/nixpkgs.just @@ -0,0 +1,7 @@ +upgrade-nix: + echo 'Installing latest Lix package' + nix profile install nixpkgs#lix && nix upgrade-nix + +install-nix-software-center: + echo 'Installing Nix Software Center' + nix profile install github:snowfallorg/nix-software-center \ No newline at end of file diff --git a/files/scripts/install-nix.sh b/files/scripts/install-lix.sh similarity index 71% rename from files/scripts/install-nix.sh rename to files/scripts/install-lix.sh index 14fdf75..59ba7dc 100755 --- a/files/scripts/install-nix.sh +++ b/files/scripts/install-lix.sh @@ -1,6 +1,8 @@ #!/usr/bin/env bash set -euo pipefail +# === INSTALL LIX FROM RPM === + rpm_url="https://nix-community.github.io/nix-installers/lix/x86_64/lix-multi-user-2.91.1.rpm" install -d /usr/share/nix-store /var/lib/nix-store /var/cache/nix-store /nix /etc/nix @@ -11,6 +13,9 @@ export SYSTEMD_OFFLINE=1 # Install the RPM; allow missing GPG key since we fetch directly by URL. dnf install -y --nogpgcheck "$rpm_url" + +# === ADD MISSING LIX CACHE ACCESS PUBKEY === + nix_conf=/etc/nix/nix.conf lix_cache_url="https://cache.lix.systems/" lix_cache_key="cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=" @@ -35,14 +40,8 @@ ensure_list_value() { ensure_list_value "substituters" "$lix_cache_url" ensure_list_value "trusted-public-keys" "$lix_cache_key" -# # Ensure the overlay mount service is enabled so /nix is populated on boot. -# mkdir -p /etc/systemd/system/multi-user.target.wants -# ln -sf /usr/lib/systemd/system/nix-overlay.service /etc/systemd/system/multi-user.target.wants/nix-overlay.service +# === MOVE INITIAL NIX STORE TO LOWERDIR === -# Move the pre-populated store out of /nix so it can serve as the immutable lowerdir. if compgen -G "/nix/*" >/dev/null; then mv /nix/* /usr/share/nix-store/ fi - -# The RPM %post handles sysusers/tmpfiles; if we ran with SYSTEMD_OFFLINE the -# post scripts are still executed, so no extra calls are needed here. diff --git a/files/system/usr/libexec/deinonyxus/curator.sh b/files/system/usr/libexec/deinonyxus/curator.sh index 84dcc6c..4fc2b1c 100755 --- a/files/system/usr/libexec/deinonyxus/curator.sh +++ b/files/system/usr/libexec/deinonyxus/curator.sh @@ -6,6 +6,4 @@ curator_git="--from git+https://codeberg.org/randogoth/curator/" uvx $curator_git curator init uvx $curator_git curator add nix:mc nix:micro nix:devbox uvx $curator_git curator switch -uv tool install $curator_git curator - -nix upgrade-nix \ No newline at end of file +uv tool install $curator_git curator \ No newline at end of file diff --git a/recipes/recipe.yml b/recipes/recipe.yml index a16ff15..4d5ccf6 100644 --- a/recipes/recipe.yml +++ b/recipes/recipe.yml @@ -3,7 +3,7 @@ # image will be published to ghcr.io// name: deinonyxus # description will be included in the image's metadata -description: This is my personal spin based on the latest bluefin image. +description: Bluefin DX with Nix and sprinkles. # the base image to build on top of (FROM) and the version tag to use base-image: ghcr.io/ublue-os/bluefin-dx @@ -20,7 +20,7 @@ modules: - type: script scripts: - - install-nix.sh + - install-lix.sh - type: systemd system: @@ -60,6 +60,10 @@ modules: - containerd - moby-engine + - type: justfiles + include: + - nixpkgs.just + - type: default-flatpaks configurations: - notify: true # Send notification after install/uninstall is finished (true/false)