Merge pull request #6 from randogoth/nix-bind-mount

Nix bind mount

README.md

@@ -1,20 +1,11 @@
 # Deinonyxus   [![bluebuild build badge](https://github.com/randogoth/deinonyxus/actions/workflows/build.yml/badge.svg)](https://github.com/randogoth/deinonyxus/actions/workflows/build.yml)
 
-*Deinonyxus* is a personal spin of the UBlue Bluefin DX image with the 🍦[Lix](https://lix.systems/) flavored Nix package manager baked in and a first-login bootstrap for simple declarative package management using [curator](https://codeberg.org/randogoth/curator).
+*Deinonyxus* is a personal spin of the UBlue Bluefin DX image with the 🍦[Lix](https://lix.systems/) flavored Nix package manager baked in.
-
-The overlay mount approach was directly borrowed from the [Daemonix](https://github.com/DXC-0/daemonix/) Silverblue/Nix image.
 
 ## What’s inside
 - Base: `ghcr.io/ublue-os/bluefin-dx:latest` without Cockpit, Docker, Firefox, VS Code
-- Lix: multi-user install baked in with persistence at `/var/home/nix`; `nix-daemon.service` enabled.
-(D) - First-login bootstrap: installs Lix/nix packages `devbox`, `mc`, and `micro` via `curator`
 - System packages added: `syncthing`, `uv`, `vscodium`, `waydroid`;
-- System flatpaks added: Telegram Desktop, Zen Browser
+- System flatpaks added: Telegram Desktop, Waterfox browser
-
-## First login
-- Triggers for each non-root user on their first session.
-- Writes state to `~/.local/state/deinonyxus/curator-init.done`; delete it to rerun.
-- Bootstraps `~/.config/curator/inventory.toml` and runs `curator switch` with the packages set above.
 
 ## Just Recipes
 - `upgrade-nix`: upgrades to the latest version of Lix via the user profile. Replaces `nix upgrade-nix` which does not work with an immutable lowerdir `/nix/store` folder

files/scripts/install-lix.sh

@@ -5,7 +5,7 @@ set -euo pipefail
 
 rpm_url="https://nix-community.github.io/nix-installers/lix/x86_64/lix-multi-user-2.91.1.rpm"
 
-install -d /usr/share/nix-store /var/lib/nix-store /var/cache/nix-store /nix /etc/nix
+install -d /usr/share/nix-store /var/lib/nix-store /nix /etc/nix
 
 # Avoid systemd calls during RPM %post in the image build environment.
 export SYSTEMD_OFFLINE=1
@@ -40,8 +40,9 @@ ensure_list_value() {
 ensure_list_value "substituters" "$lix_cache_url"
 ensure_list_value "trusted-public-keys" "$lix_cache_key"
 
-# === MOVE INITIAL NIX STORE TO LOWERDIR ===
+# === SEED STORE FOR FIRST BOOT (copied into /var on boot) ===
 
 if compgen -G "/nix/*" >/dev/null; then
-  mv /nix/* /usr/share/nix-store/
+  rsync -aH --delete /nix/ /usr/share/nix-store/
+  rm -rf /nix/*
 fi

files/system/etc/modules-load.d/overlay.conf

@@ -1 +0,0 @@
-overlay

files/system/etc/selinux/targeted/contexts/files/file_contexts.local

@@ -0,0 +1,2 @@
+/nix(/.*)?                           system_u:object_r:bin_t:s0
+/var/lib/nix-store(/.*)?             system_u:object_r:bin_t:s0

files/system/etc/systemd/system/nix-daemon.service.d/selinux.conf

@@ -0,0 +1,5 @@
+[Service]
+# Run the daemon unconfined to avoid SELinux denials on the Nix store binaries.
+SELinuxContext=system_u:system_r:unconfined_service_t:s0
+ExecStart=
+ExecStart=/usr/bin/nix-daemon-wrapper.sh --daemon

files/system/usr/bin/mount-nix-overlay.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-mkdir -p /usr/share/nix-store /var/lib/nix-store /var/cache/nix-store /nix
-
-# Skip if already mounted to avoid errors on reload.
-if mountpoint -q /nix; then
-  exit 0
-fi
-
-mount -t overlay overlay \
-  -o lowerdir=/usr/share/nix-store,upperdir=/var/lib/nix-store,workdir=/var/cache/nix-store \
-  /nix

files/system/usr/bin/mount-nix.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Bind-mount /var/lib/nix-store to /nix.
+# If /var/lib/nix-store is empty, seed it from the baked store in /usr/share/nix-store.
+
+mkdir -p /usr/share/nix-store /var/lib/nix-store /nix
+
+copy_seed_store() {
+  if command -v rsync >/dev/null 2>&1; then
+    rsync -aH --delete /usr/share/nix-store/ /var/lib/nix-store/
+  else
+    cp -a /usr/share/nix-store/. /var/lib/nix-store/
+  fi
+}
+
+sync_missing_store() {
+  # Ensure any baked store paths exist in /var without clobbering user additions.
+  if command -v rsync >/dev/null 2>&1; then
+    rsync -aH --ignore-existing /usr/share/nix-store/store/ /var/lib/nix-store/store/
+  fi
+}
+
+ensure_system_profile() {
+  local seed_profile="/usr/share/nix-store/var/nix/profiles/system"
+  local target_profile="/var/lib/nix-store/var/nix/profiles/system"
+
+  mkdir -p /var/lib/nix-store/var/nix/profiles
+
+  if { [ ! -e "$target_profile" ] || [ -L "$target_profile" ] && [ ! -e "$(readlink -f "$target_profile")" ]; } \
+     && { [ -e "$seed_profile" ] || [ -L "$seed_profile" ]; }; then
+    cp -a "$seed_profile" "$target_profile"
+  fi
+}
+
+if ! mountpoint -q /nix; then
+  if [ -z "$(ls -A /var/lib/nix-store 2>/dev/null)" ] && compgen -G "/usr/share/nix-store/*" >/dev/null; then
+    copy_seed_store
+  fi
+
+  ensure_system_profile
+  sync_missing_store
+
+  mount --bind /var/lib/nix-store /nix
+  # Force an executable SELinux context on the bind mount so systemd can exec nix-daemon.
+  # Use a permissive fallback if the label option is rejected.
+  if ! mount -o remount,bind,exec,context=system_u:object_r:bin_t:s0 /nix 2>/dev/null; then
+    mount -o remount,bind,exec /nix
+  fi
+
+  # Ensure daemon paths exist and labels are sane.
+  if command -v systemd-tmpfiles >/dev/null 2>&1; then
+    systemd-tmpfiles --create /usr/lib/tmpfiles.d/nix-daemon.conf
+  fi
+  if command -v restorecon >/dev/null 2>&1; then
+    restorecon -RF /var/lib/nix-store /nix || true
+  fi
+fi

files/system/usr/bin/nix-daemon-wrapper.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+exec /nix/var/nix/profiles/system/bin/nix-daemon "$@"

files/system/usr/lib/systemd/system/nix-overlay.service

@@ -1,14 +1,14 @@
 [Unit]
-Description=Mount OverlayFS for /nix
+Description=Bind-mount /var/lib/nix-store to /nix
 DefaultDependencies=no
 After=local-fs.target
-Before=systemd-tmpfiles-setup.service nix-daemon.service nix-daemon.socket
+RequiresMountsFor=/var /var/lib/nix-store
-ConditionPathExists=/usr/bin/mount-nix-overlay.sh
+Before=nix-daemon.service nix-daemon.socket
+ConditionPathExists=/usr/bin/mount-nix.sh
 
 [Service]
 Type=oneshot
-ExecStart=/usr/bin/mount-nix-overlay.sh
+ExecStart=/usr/bin/mount-nix.sh
-ExecStartPost=/usr/bin/systemd-tmpfiles --create /usr/lib/tmpfiles.d/nix-daemon.conf
 RemainAfterExit=yes
 
 [Install]

files/system/usr/lib/systemd/user/default.target.wants/deinonyxus-curator-init.service

@@ -1 +0,0 @@
-/var/home/randogoth/Projects/code/randofin-os/files/system/usr/lib/systemd/user/deinonyxus-curator-init.service

files/system/usr/lib/systemd/user/deinonyxus-curator-init.service

@@ -1,13 +0,0 @@
-[Unit]
-Description=Install Nix Home Manager and packages on first login
-ConditionUser=!root
-ConditionPathExists=!%h/.local/state/deinonyxus/curator-init.done
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/deinonyxus/curator.sh
-ExecStartPost=/usr/bin/mkdir -p %h/.local/state/deinonyxus
-ExecStartPost=/usr/bin/touch %h/.local/state/deinonyxus/curator-init.done
-
-[Install]
-WantedBy=default.target

files/system/usr/libexec/deinonyxus/curator.sh

@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-set -oue pipefail
-
-curator_pkg="git+https://codeberg.org/randogoth/curator/"
-
-uvx --from "$curator_pkg" curator init
-uvx --from "$curator_pkg" curator add nix:mc nix:micro nix:devbox
-uvx --from "$curator_pkg" curator switch
-uv tool install "$curator_pkg"

recipes/recipe.yml

@@ -80,7 +80,7 @@ modules:
         scope: system
         # If no repo information is specified, Flathub will be used by default
         install: # system flatpaks we want all users to have and not remove
-          - app.zen_browser.zen
+          - net.waterfox.waterfox
           - org.telegram.desktop
         remove: # replace default Firefox with Waterfox
           - org.mozilla.firefox