Port the flags of nix-daemon to nix daemon

[bryanhonof]

Motivation

The new nix daemon command doesn't accept the same flags that nix-daemon does.

Context

Ref #8785
Fixes #7128

Checklist for maintainers

Maintainers: tick if completed or explain if not relevant

• agreed on idea
• agreed on implementation strategy
• tests, as appropriate
  • functional tests - tests/**.sh
  • unit tests - src/*/tests
  • integration tests - tests/nixos/*
• documentation in the manual
• documentation in the internal API docs
• code and comments are self-explanatory
• commit message explains why the change was made
• new feature or incompatible change: updated release notes

Priorities

Add 👍 to pull requests you find important.

[Ericson2314]

We can declaratively mark flags as experimental with the new CLI

[bryanhonof]

We can declaratively mark flags as experimental with the new CLI

@Ericson2314 I'm getting the following warning, which, I believe, is just fixed by switching .handler and .experimentalFeature.

src/nix/daemon.cc:518:13: warning: ISO C++ requires field designators to be specified in declaration order; field 'experimentalFeature' will be initialized after field 'handler' [-Wreorder-init-list]
            .handler = {[&]() {
            ^~~~~~~~~~~~~~~~~~~
src/nix/daemon.cc:517:36: note: previous initialization for field 'experimentalFeature' is here
            .experimentalFeature = Xp::DaemonTrustOverride,
                                   ^~~~~~~~~~~~~~~~~~~~~~~

However, what I find more concerning, when I now run the nix daemon command with --force-untrusted it just seems to work without enabling the experimental feature. Whilst before, it did error out.

Before:

$ ./outputs/out/bin/nix --extra-experimental-features nix-command daemon --force-untrusted --stdio
error: experimental Nix feature 'daemon-trust-override' is disabled; use '--extra-experimental-features daemon-trust-override' to override

After:

$ # Simply waits for input it seems like
$ ./outputs/out/bin/nix --extra-experimental-features nix-command daemon --force-untrusted --stdio

[edolstra]

Does this actually forward the connection? I assume that depends on nix daemon's own --store parameter: If it's "local", then it won't forward to another daemon.

[Ericson2314]

That is true. Forcing untrusted does make not force in the --stdio case when --store is a RemoteStore subclass, but forcing trusted (if I am reading the code above right) doesn't seem to affect when forwarding happens.

[bryanhonof]

So, just "Forces the daemon to trust connecting clients." would be enough as a description in this case?

[Ericson2314]

Yes I think that is good

[tomberek]

Suggested change

	.description = "Forces the daemon to not trust connecting clients, the connection will be processed by the receiving daemon before forwarding commands.",
	.description = "Force the daemon to not trust connecting clients. The connection will be processed by the receiving daemon before forwarding commands.",

[fricklerhandwerk]

Reviewed in Nix team meeting for stabilisation effort:

• agreed on the change
• the new command is not tested, but runs the exact same code as the old one
  • @bryanhonof if you have time, could you contribute something towards testing the daemon at the component level rather through the CLI?
• fixed up documentation
• merging

[bryanhonof]

• @bryanhonof if you have time, could you contribute something towards testing the daemon at the component level rather through the CLI?

@fricklerhandwerk Wouldn't mind giving it a shot. Where can I find examples/docs of this?

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/2023-08-28-nix-team-meeting-minutes-83/32290/1