Support targeting installs to Determinate Nix Enterprise Edition. #905

grahamc · 2024-04-01T16:40:42Z

Description

Passing --enterprise will disable the upstream launchd daemons and use ours. Requires the user separately coordinate the installation of Determinate Nix for macOS ahead of time.

Checklist

Formatted with cargo fmt
Built with nix build
Ran flake checks with nix flake check
Added or updated relevant tests (leave unchecked if not applicable)
Added or updated relevant documentation (leave unchecked if not applicable)
Linked to related issues (leave unchecked if not applicable)

Validating with `install.determinate.systems`

If a maintainer has added the upload to s3 label to this PR, it will become available for installation via install.determinate.systems:

curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix/pr/$PR_NUMBER | sh -s -- install

flexiondotorg

LGTM: I've seen the run-through, this is a great step forward to deliver custom Nix on macOS for enterprise customers 👍

flexiondotorg · 2024-04-02T13:27:59Z

When the public Nix installer for macOS is run with --nix-enterprise, it will fail as the public version doesn't know how to activate an enterprise install. In this event, it should sign-post the appropriate page on https://determinate.systems as a potential sales funnel.

src/action/common/configure_init_service.rs

src/action/macos/create_nix_volume.rs

src/planner/macos.rs

src/action/common/configure_init_service.rs

src/planner/macos.rs

tests/fixtures/macos/macos.json

cole-h · 2024-04-05T16:45:18Z

src/action/common/configure_enterprise_edition_init_service.rs

+    }
+
+    #[tracing::instrument(level = "debug", skip_all)]
+    async fn execute(&mut self) -> Result<(), ActionError> {


It would be nice to share more code with configure_init_service, but we can do that in a follow-up PR.

cole-h · 2024-04-05T16:47:14Z

src/action/macos/encrypt_apfs_volume.rs

@@ -57,7 +59,11 @@ impl EncryptApfsVolume {
            // The user has a password matching what we would create.
            if planned_create_apfs_volume.state == ActionState::Completed {


I wonder if this is still true in the case of this "enterprise edition" -- since we add specific access to another binary, isn't it possible that if we take the current volume as-is, we'll not have that access and things will break?

(I think all of these completed branches need to be audited to ensure that this is OK)

All the other branches look good to me ... one option is to unconditionally add our program to the access list. I don't know how else we can detect a fault here.

cole-h · 2024-04-09T15:14:50Z

src/action/common/configure_enterprise_edition_init_service.rs

+impl ConfigureEnterpriseEditionInitService {
+    #[tracing::instrument(level = "debug", skip_all)]
+    pub async fn plan(start_daemon: bool) -> Result<StatefulAction<Self>, ActionError> {
+        Ok(Self { start_daemon }.into())


These EE-specific steps should probably ensure that the "enablement" binary is present, or otherwise mark it as Skipped (or error). Additionally, this seems to be causing some issues in CI where it just.... hangs at some point (why is the CI test trying to enable EE mode? surely that's wrong). That hang will probably rear its ugly head outside of CI too.

I had accidentally inverted the bool in the planner: 045f388

The root macos planner does make the check that the binary is present. I'm not sure we should duplicate the behavior in the actions ... what do you think?

…ur planning requires no changes on other targets at the moment.

…t across tools and products.

…otherwise no-op enterprise_editition encryption case

resolved

grahamc added the upload to s3 The labeled PR is allowed to upload its artifacts to S3 for easy testing label Apr 1, 2024

flexiondotorg approved these changes Apr 2, 2024

View reviewed changes

cole-h previously requested changes Apr 2, 2024

View reviewed changes

grahamc changed the title ~~Support targeting installs to Determinate's enterprise offering via Determinate Nix for macOS.~~ Support targeting installs to Determinate Nix Enterprise Edition. Apr 4, 2024

cole-h reviewed Apr 4, 2024

View reviewed changes

src/planner/macos.rs Outdated Show resolved Hide resolved

src/action/common/configure_init_service.rs Outdated Show resolved Hide resolved

cole-h reviewed Apr 5, 2024

View reviewed changes

src/planner/macos.rs Show resolved Hide resolved

cole-h reviewed Apr 5, 2024

View reviewed changes

cole-h reviewed Apr 9, 2024

View reviewed changes

grahamc added 21 commits April 11, 2024 09:24

Drop riff support

04529ab

Relocate the darwin diskutil structs to make room for keychain

0ef8eb7

Clean up a few warnings

ede41b6

Initial support for Determinate Nix Enterprise

318bced

Don't create the org.nixos.darwin-store service under enterprise nix.

624b9f3

Only write out systems.determinate.nix-daemon under nix enterprise

06a8e7e

Bump the nix crate from 0.27.0 to 0.28.0 for nix-rust/nix#2304

f93f0bd

Fixup the test fixture for macos

45bb56e

Correct ConfigureInitService on Linux

b3c1ed4

Fixup fixtures for linux

14f3e12

Use Determinate Nix for macOS to perform the mount during installation.

978f8a6

Force-enable encryption for Nix Enterprise on macOS

2ef4ed3

fixup

6da3660

drop extraneous comment

bf67b0e

Create a separate CreateNixEnterpriseVolume to simplify CreateNixVolume.

04f1c8b

fixup

00e8dea

Relocate the nix-enterprise flag down into the macOS planner, since o…

98c2f79

…ur planning requires no changes on other targets at the moment.

Fail the install if --nix-enterprise is passed but isn't available

e40159c

fixup nix_enterprise bits

44a688c

I hate this.

2e4c85b

Rename to be Determinate Nix Enterprise Edition, to be more consisten…

128ba24

…t across tools and products.

grahamc added 8 commits April 11, 2024 09:24

Note why we match on enterprise edition in the macos planner for the …

00a5be1

…otherwise no-op enterprise_editition encryption case

fixup

450c746

Factor out the enterprise init service setup into its own module

a89995d

Conditionally import / use EE init service

20c8eac

nit

d76ee1c

derp

5d2e912

fixup: too many args to plan

271b9d6

...derp...

045f388

grahamc force-pushed the ee branch from efc91c6 to 045f388 Compare April 11, 2024 13:27

grahamc requested a review from cole-h April 15, 2024 15:13

cole-h merged commit 1c4976a into main Apr 15, 2024
13 checks passed

cole-h deleted the ee branch April 15, 2024 16:06

This was referenced May 23, 2024

Test installer on aarch64-linux runner #972

Merged

Test installer on aarch64-darwin runner #973

Merged

Document installer configs #975

Merged

Set always-allow-substitutes to true in nix.conf #977

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support targeting installs to Determinate Nix Enterprise Edition. #905

Support targeting installs to Determinate Nix Enterprise Edition. #905

grahamc commented Apr 1, 2024 •

edited

flexiondotorg left a comment

flexiondotorg commented Apr 2, 2024

cole-h Apr 5, 2024

cole-h Apr 5, 2024

grahamc Apr 5, 2024

cole-h Apr 9, 2024

grahamc Apr 11, 2024

		@@ -57,7 +59,11 @@ impl EncryptApfsVolume {
		// The user has a password matching what we would create.
		if planned_create_apfs_volume.state == ActionState::Completed {

Support targeting installs to Determinate Nix Enterprise Edition. #905

Support targeting installs to Determinate Nix Enterprise Edition. #905

Conversation

grahamc commented Apr 1, 2024 • edited

Description

Checklist

Validating with install.determinate.systems

flexiondotorg left a comment

Choose a reason for hiding this comment

flexiondotorg commented Apr 2, 2024

cole-h Apr 5, 2024

Choose a reason for hiding this comment

cole-h Apr 5, 2024

Choose a reason for hiding this comment

grahamc Apr 5, 2024

Choose a reason for hiding this comment

cole-h Apr 9, 2024

Choose a reason for hiding this comment

grahamc Apr 11, 2024

Choose a reason for hiding this comment

grahamc commented Apr 1, 2024 •

edited

Validating with `install.determinate.systems`