nixos/nix-daemon: workaround NixOS/nix#6285

[flokli]

nix-daemon.socket is used to socket-activate nix-daemon.service when
/nix/var/nix/daemon-socket/socket is accessed.

Having a ConditionPathIsReadWrite on the /nix/var/nix/daemon-socket
directory will cause systemd to just skip if it's not present yet.

[ 237.187747] systemd[1]: Nix Daemon Socket was skipped because of a failed condition check (ConditionPathIsReadWrite=/nix/var/nix/daemon-socket).

As it's the nix-daemon itself that creates this directory, we're in a
chicken-and-egg problem - as long as the folder isn't created,
nix-daemon won't start (as it's only socket-activated), and the socket
unit will get skipped, as the directory doesn't exist yet.

I think we don't actually want to skip starting the socket unit when the
directory doesn't exist yet.

This has surfaced in the systemd 250 bump (which probably did apply some
more rigid checks), where tests with containers that bind-mount
/nix/var/nix/daemon-socket started to fail.

Description of changes

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 22.05 Release Notes (or backporting 21.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
  • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
• Fits CONTRIBUTING.md.

[flokli]

Based on the feedback in NixOS/nix#6282 (comment), this has been updated.

[flokli]

I updated this PR. It now targets staging-next, and contains a simple tmpfiles rule addition, instead of patching the Nix package:

commit 8b24f7b5914d6b56b76566d340de89de78d42549
Author: Florian Klink <flokli@flokli.de>
Date:   Fri Mar 18 16:22:38 2022 +0100

    nixos/nix-daemon: workaround NixOS/nix#6285
    
    The Nix-provided `nix-daemon.socket` file has a
    
    > ConditionPathIsReadWrite=/nix/var/nix/daemon-socket/socket
    
    line, to skip that unit if /nix/var/nix/daemon-socket/socket is
    read-only (which is the case in some nixos-containers with that folder
    bind-ro-mounted from the host).
    
    In these cases, the unit was skipped.
    
    Systemd 250 (rightfully) started to also skip in these cases:
    
    > [ 237.187747] systemd[1]: Nix Daemon Socket was skipped because of a failed condition check (ConditionPathIsReadWrite=/nix/var/nix/daemon-socket).

    However, systemd < 250 didn't skip if /nix/var/nix/daemon-socket/socket
    didn't /exist at all/, and we were relying on this bug in the case for
    fresh NixOS systems, to have /nix/var/nix/daemon-socket/socket created
    initially.

    Move the creation of that folder to systemd-tmpfiles, by shipping an
    appropriate file in `${nixPackage}/lib/tmpfiles.d/nix-daemon.conf`
    (NixOS/nix#6285).

    In the meantime, set a systemd tmpfiles rule manually in NixOS.

    This has been tested to still work with read-only bind-mounted
    /nix/var/nix/daemon-socket/socket in containers, it'll keep them
    read-only ;-)

This is ready for another review.

[vcunat]

This did not fix nixosTests.containers-ip for me.

[flokli]

It does build for me:

❯ nix-build -A nixosTests.containers-ip
/nix/store/391vynhri11j8p6fr4736zid3kp6vml4-vm-test-run-containers-ipv4-ipv6

[vcunat]

Ah, I'm sorry, probably mistake of that non-NixOS machine. It does work for me on another one with NixOS.

[vcunat]

The systemd update is not in staging-next yet, so I merged to staging.

[flokli]

@vcunat I checked out staging with this fix (6facca0) and successfully built nixosTests.containers-ip overnight:

❯ nix-build -A nixosTests.containers-ip
/nix/store/r7y65rkmdaz0p1j1lgbi4bq2m5phd8y5-vm-test-run-containers-ipv4-ipv6

[vcunat]

And thanks for fixing this regression promptly.

[flokli]

Thanks! It'd still be nice if this can be properly fixed upstream: NixOS/nix#6285