Skip to content

(Draft) NixOS vars - #547171

Draft
prescientmoon wants to merge 129 commits into
NixOS:masterfrom
starlitcanopy:master
Draft

(Draft) NixOS vars#547171
prescientmoon wants to merge 129 commits into
NixOS:masterfrom
starlitcanopy:master

Conversation

@prescientmoon

@prescientmoon prescientmoon commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

I've been working on a re-implementation of NixOS vars as part of the Google Summer of Code project, together with my mentor @Lassulus. For info about the API, check the README included with this PR.

Things done

This PR implements a basic CLI for working with vars, a NixOS module that can be used together with the CLI, and some simple examples. There's also a simple NixOS test.

A bunch of concepts in the API have temporary names. Feel free to suggest better ones!

Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
…igs from Nix

Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
nixos-vars:
nixos-vars: - fix naming inconsistencies (run & script, "backendModule" not being
nixos-vars: clear enough (is it a generator or a prompt backend?) etc)
nixos-vars: - make jsonify idempotent
nixos-vars: - make jsonify accept both target and host nixpkgs instances, reusing
nixos-vars: the one the given NixOS config has been built with in case none has been
nixos-vars: given

Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
nixos-vars:
nixos-vars: It was confusing, since the name doesn't specify whether the override
nixos-vars: applies to the host or target instance. Will add this back once a clear
nixos-vars: usecase appears, as that way I know which one it *should* refer to.

Signed-off-by: prescientmoon <git@moonythm.dev>
nixos-vars:
nixos-vars: Some of the comments were outdated, the flake example had typos, etc

Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
…les exist according to the backend

Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
…error code for the exists script

Signed-off-by: prescientmoon <git@moonythm.dev>
nixos-vars:
nixos-vars: These work by creating a wrapper script, like discussed last meeting.
nixos-vars: This does add a bit of evaluation overhead (as the output store path
nixos-vars: must be computed at evaluation time for every such script!), althouh we
nixos-vars: make sure not to downgrade the existing cases by checking whether what
nixos-vars: we receive is already a derivation or not (if it is, we can move on).

Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
nixos-vars:
nixos-vars: Unfortunately, the test requires disabling the Nix sandbox to run, as
nixos-vars: internet connectivity is currently a prerequisite for running the CLI.
nixos-vars: We'll discuss this in today's meetup.

Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
nixos-vars:
nixos-vars: I forgot I hadn't yet merged generate & regenerate in the commited
nixos-vars: version :p

Signed-off-by: prescientmoon <git@moonythm.dev>
…e-data

nixos-vars:
nixos-vars: This is there in order to copy the static nix files the python code
nixos-vars: needs to be able to reference.

Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
Signed-off-by: prescientmoon <git@moonythm.dev>
- `prompts` are now scoped per-generator
- `generators` -> `store`
- backends / defaults are scoped more nicely in the NixOS module
- prompt.script -> prompt.ask
- secret.script -> secret.generate
- generator scripts are now optional
- a bit more checking of --set and --generate overlaps
- json schema validation for the input JSON
Also fixes `from_jsom` being used instead of `from_json` (typo!)
Also fixes the lack of $prompts when --no-sanbox is used
the tests are failing... will ask for help in today's meetup
This commit adds proper handling of:
- added/removed dependencies
- failed/canceled prior runs
Comment thread pkgs/by-name/ni/nixos-secrets/docs/03-store-backends.md Outdated
Comment thread pkgs/by-name/ni/nixos-secrets/docs/03-store-backends.md Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

6.topic: flakes The experimental Nix feature 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: maintainer-list (update) This PR changes `maintainers/maintainer-list.nix` 8.has: module (update) This PR changes an existing module in `nixos/` 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants