0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 02:54:26 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5 c55f508e05 feat(readme): draw mandatory and disabled service relations

The cosmos generator linked a consumer to its provider only through an
'<role>' in group_names reference or an explicit provides: name. A hard
dependency has neither -- pinning the provider on unconditionally is
exactly what removes the Jinja reference the generator was reading -- so
web-svc-asset's bond to web-svc-file vanished from the diagram the moment
it became binding. Match a service key against the provider's own primary
key from the registry, in both directions.

Services the role turns off drew a solid 1:1 edge, claiming a mandatory
relationship for something that carries nothing at deploy time. They now
render as a red 0..0 edge; edge merging gained a real precedence so a
provider consumed through two keys stays live when only one is off.

Named colour, not hex: a '#' opens an entity code in the mermaid lexer and
turns the whole diagram into a parse error on GitHub.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-17 18:02:31 +02:00

3.6 KiB

Raw Permalink Blame History

dev-nix

This role installs the Nix package manager in a secure, reproducible, and idempotent way across multiple Linux distributions.

Description

The role installs Nix using either the native package manager (where supported and reliable) or the official installer with SHA256 verification.

On platforms where distro packages are known to be problematic (e.g. Arch Linux ARM), the role deliberately avoids the system package and falls back to the official installer to ensure a working and up-to-date Nix installation.

Overview

This role installs the Nix package manager via pacman on Arch x86_64 or via the official installer with SHA256 verification.

Cosmos

The diagram places dev-nix in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).

flowchart LR
    subgraph role [dev-nix 💻]
        svc_nix["nix"]
    end

Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.

Installation Strategy

The role automatically selects the appropriate installation method:

Arch Linux (x86_64)
Installs nix via the system package manager (pacman).
All other platforms (including Arch Linux ARM, Debian, Ubuntu, Fedora, EL, Generic Linux)
Uses the official Nix installer in multi-user (daemon) mode.

This avoids ABI and SONAME mismatches on rolling or less frequently rebuilt distributions.

Security Model

The official installer is downloaded at runtime and verified before execution:

The installer script is fetched from the official release location
Its SHA256 checksum is fetched from the same release
The checksum is validated before execution
Installation aborts immediately if verification fails

No unverified code is executed on the target system.

Features

Automatic platform detection (Arch x86_64 vs others)
Verified official installer with SHA256 checksum validation
Multi-user (daemon) installation mode
Optional shell integration via /etc/profile.d
Optional activation of experimental features (nix-command, flakes)
Fully idempotent (safe to run multiple times)
Distro-agnostic fallback logic

Configuration Options

Key variables (see defaults/main.yml):

dev_nix_installer_version
Nix version to install via the official installer.
dev_nix_enable_experimental_features
Enable experimental features such as nix-command and flakes.
dev_nix_enable_shell_snippet
Whether to install a profile snippet for automatic environment loading.

Notes on Offline Usage

This role does not ship the installer script and therefore requires network access during installation.

If a fully offline or air-gapped setup is required, the role can be extended to use a locally vendored installer script with a pinned checksum.

Further Resources

Nix project: https://nixos.org
Nix releases: https://releases.nixos.org
Infinito.Nexus License: https://s.infinito.nexus/license

Credits

Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).

3.6 KiB Raw Permalink Blame History