kevinveenbirkenbachandClaude Opus 5
fc0881ff33
The package-cache frontend terminates TLS for package traffic and signs with its own CA: probed from inside the test container, pypi.org arrives as subject CN=pypi.org issued by CN=Infinito Package-Cache Frontend CA. package-frontend-ca.sh installs that CA into the OS store, which is why apt, pip, curl and urllib work — but requests reads certifi, which has never heard of it, so test-external failed its reachability precondition with CERTIFICATE_VERIFY_FAILED. Upgrading certifi does not help; the issuer is not a public root. load.sh is where the runner puts the venv on PATH, so it is also where the interpreter carrying the pip certifi is chosen; pointing REQUESTS_CA_BUNDLE and SSL_CERT_FILE at the store the stack deliberately fills keeps one trust decision instead of two. A caller-set value still wins. The bundle location was about to become a fourth copy: dev-nix and the network diagnose CLI each carried their own candidate list, and the two had already drifted apart in their fourth entry. All of them now read group_vars CA_BUNDLE_CANDIDATES — Ansible directly, the shell through a generated env key, python through read_group_paths. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
dev-nix
This role installs the Nix package manager in a secure, reproducible, and idempotent way across multiple Linux distributions.
Description
The role installs Nix using either the native package manager (where supported and reliable) or the official installer with SHA256 verification.
On platforms where distro packages are known to be problematic (e.g. Arch Linux ARM), the role deliberately avoids the system package and falls back to the official installer to ensure a working and up-to-date Nix installation.
Overview
This role installs the Nix package manager via pacman on Arch x86_64 or via the official installer with SHA256 verification.
Cosmos
The diagram places dev-nix in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).
flowchart LR
subgraph role [dev-nix 💻]
svc_nix["nix"]
end
Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.
Installation Strategy
The role automatically selects the appropriate installation method:
-
Arch Linux (x86_64)
Installsnixvia the system package manager (pacman). -
All other platforms (including Arch Linux ARM, Debian, Ubuntu, Fedora, EL, Generic Linux)
Uses the official Nix installer in multi-user (daemon) mode.
This avoids ABI and SONAME mismatches on rolling or less frequently rebuilt distributions.
Security Model
The official installer is downloaded at runtime and verified before execution:
- The installer script is fetched from the official release location
- Its SHA256 checksum is fetched from the same release
- The checksum is validated before execution
- Installation aborts immediately if verification fails
No unverified code is executed on the target system.
Features
- Automatic platform detection (Arch x86_64 vs others)
- Verified official installer with SHA256 checksum validation
- Multi-user (daemon) installation mode
- Optional shell integration via
/etc/profile.d - Optional activation of experimental features (
nix-command,flakes) - Fully idempotent (safe to run multiple times)
- Distro-agnostic fallback logic
Configuration Options
Key variables (see defaults/main.yml):
-
dev_nix_installer_version
Nix version to install via the official installer. -
dev_nix_enable_experimental_features
Enable experimental features such asnix-commandandflakes. -
dev_nix_enable_shell_snippet
Whether to install a profile snippet for automatic environment loading.
Notes on Offline Usage
This role does not ship the installer script and therefore requires network access during installation.
If a fully offline or air-gapped setup is required, the role can be extended to use a locally vendored installer script with a pinned checksum.
Further Resources
- Nix project: https://nixos.org
- Nix releases: https://releases.nixos.org
- Infinito.Nexus License: https://s.infinito.nexus/license
Credits
Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).