Why does system.nssModules force nscd?

[ilya-fedin]

Describe the bug
I wanted to update my system, I have avahi-daemon enabled, what means that I have nss_mdns module enabled (and I need it!), however I can't update due to this error:

Failed assertions:
- Loading NSS modules from system.nssModules (/nix/store/ryiv1g8q35ymmgjraynj2ayxvvn76j65-systemd-245.6/lib), requires services.nscd.enable being set to true.

But I really don't want nscd (and still need nss_mdns!)! Why is it needed for third-party modules while I can use them without nscd on all other distros? 🤔

To Reproduce
Steps to reproduce the behavior:

1. Have some nss modules enabled
2. Have nscd disabled

Expected behavior
Nix can install nss_mdns module or any other nss module without having nscd enabled.

Notify maintainers
@florianjacob @flokli

Metadata

 - system: `"x86_64-linux"`
 - host os: `Linux 5.6.12, NixOS, 20.09pre-git (Nightingale)`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.3.4`
 - nixpkgs: `/run/nixpkgs`

Maintainer information:

# a list of nixos modules affected by the problem
module:
    - nsswitch
    - avahi-daemon

[flokli]

On non-NixOS systems, applications using nss load nss modules from a shared location. This doesn't work on NixOS, as ${glibc}/lib/... is immutable. We use nscd, and pass LD_LIBRARY_PATH to nscd to have it find other enabled nss modules. Why don't you really want nscd?

[ilya-fedin]

Why don't you really want nscd?

It will double-cache my DNS requests that are already cached by systemd-resolved

[xaverdh]

Why don't you really want nscd?

It will double-cache my DNS requests that are already cached by systemd-resolved

I thought by default nixpkgs's nscd doesn't cache anything anymore these days?
(https://github.com/NixOS/nixpkgs/blob/29062cec8d214013a8e1f944d16e32c36294e0d0/nixos/modules/services/system/nscd.conf) for reference

[flokli]

Yes, and the comment there also mentions why we do things the way we do.

[ilya-fedin]

I thought by default nixpkgs's nscd doesn't cache anything anymore these days?

Oh, this is good news :)

Thanks for everyone for the answers :)