nixos: Add dry activation for users/groups

[dasJ]

Motivation for this change

This can be extended to any degree with activation scripts offering dry-activation modes.
The users-groups activation script seemed like a good place to start because the removal of users/groups is something that's nice to know before it actually happens.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• 21.11 Release Notes (or backporting 21.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[dasJ]

@GrahamcOfBorg test simple

[Mic92]

I think this is a useful feature but could this be implemented without introducing another option?
system.activationScripts is a module, where we could add a .dryActivate option or so.
Than I would set an environment variable i.e. DRY_ACTIVATE instead of a flag to mark an activation script as dry-able. Does this make sense? I think this way we would duplicate less code.

[dasJ]

This idea sounds better than mine, thank you for the suggestion. Going to force-push soon-ish

[Mic92]

in the original system.activationScripts this function could be moved out and take the also a set parameter.
Then this function could be applied twice for script and dryScript, where the latter one would receive the filtered set.

[stigtsp]

Diff LGTM

Got some minor suggestions.

[oxij]

Diff LGTM. This is pretty cool.

[dasJ]

@grahamc since you know a bit of Perl ;)

[grahamc]

It looks okay to me. It looks like it could be a bit cleaner by taking the is_dry checks from the parse functions, and before any of those lines print output lines like "The plan is:" vs. "Applying:" and then changing the call sites to only call updateFile if we're not in dry run. What would you think about that?

EDIT: I think about this because it looks like it is sort of doing a "plan" phase already, so adding a dry run, I think, would not be so tricky. If I'm missing something that makes this hard ... understood :).

[dasJ]

Should all be done now. I also enabled runtime warnings

[dasJ]

@GrahamcOfBorg test mutableUsers

[asymmetric]

Should this be added to the (future) release notes?

[dasJ]

@asymmetric The option or the fact that users/groups uses the feature?

[ryantm]

Re: ryantm/agenix#55

@dasJ it seems to me like this is maybe a bug with this that it considers an activation script to support dry-activation when one of its deps does not support it.

[dasJ]

Oh I'm so sorry, it didn't strike me that third-party repos might add dependencies to existing activation scripts.
Do you have an idea how to work around that problem? I can come up with something myself (that's not "just add dry activation to agenix") but I'm not sure I'll have enough time this week

[ryantm]

@dasJ We're working on adding it. We also need to add it for specialfs in nixpkgs too:

https://github.com/ryantm/agenix/pull/56/files#diff-4d1123b4dc58254162148eaa8c5f7b32deaca05d636527a9f2f50b6566d85af3R128

[ryantm]

@dasJ I pushed a workaround to agenix that just disables dry activation on users and groups for now. So no worries!

[Mic92]

This would be also relevant for: https://github.com/Mic92/sops-nix/blob/3e4ebc851c91d1ce5c65da23436726c555a0d7e8/modules/sops/default.nix#L171

[dasJ]

@Mic92 It's not relevant since the problem only occurs when adding dependencies to an activation script that does support dry mode to depend on scripts that don't.

Last night I had an idea how to properly fix this and I'll try to implement it now.