mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-12-13 20:54:16 +00:00
Kevin Veen-Birkenbach
486a98af3e
This commit introduces the new 'dev-nix' Ansible role, which installs the Nix package manager in a secure and reproducible way using a locally stored, SHA256-verified installer script. Key features: - Local pinned installer (no network download during execution) - SHA256 checksum validation to prevent execution of modified installers - Multi-user (daemon) installation mode - Optional shell integration via /etc/profile.d - Fully idempotent, distro-agnostic design This role matches the structure and conventions of existing dev-* roles in the Infinito.Nexus ecosystem. https://chatgpt.com/share/69387c73-bf3c-800f-abcd-c5e7d3717059
45 lines
1.5 KiB
YAML
45 lines
1.5 KiB
YAML
---
|
|
# Install Nix using a locally stored installer script with SHA256 verification.
|
|
|
|
- name: Ensure Nix installer script is present on target
|
|
ansible.builtin.copy:
|
|
src: "{{ dev_nix_installer_source }}"
|
|
dest: "{{ dev_nix_installer_dest }}"
|
|
mode: "0755"
|
|
become: true
|
|
|
|
- name: Verify Nix installer SHA256 checksum
|
|
ansible.builtin.command: >
|
|
sh -c "sha256sum '{{ dev_nix_installer_dest }}' | awk '{print $1}'"
|
|
register: dev_nix_checksum_result
|
|
changed_when: false
|
|
become: true
|
|
|
|
- name: Fail if Nix installer checksum does not match
|
|
ansible.builtin.fail:
|
|
msg: >-
|
|
Nix installer checksum mismatch.
|
|
Expected '{{ dev_nix_installer_sha256 }}', got '{{ dev_nix_checksum_result.stdout }}'.
|
|
Refusing to execute the installer.
|
|
when: dev_nix_checksum_result.stdout != dev_nix_installer_sha256
|
|
|
|
# Nix multi-user (daemon) mode: creates /nix/store when successful.
|
|
- name: Run Nix installer in daemon (multi-user) mode if Nix is not installed
|
|
ansible.builtin.shell: >
|
|
"{{ dev_nix_installer_dest }}" --daemon
|
|
args:
|
|
creates: "/nix/store"
|
|
become: true
|
|
|
|
- name: Optionally drop shell snippet for Nix
|
|
ansible.builtin.copy:
|
|
dest: "{{ dev_nix_shell_snippet_path }}"
|
|
mode: "0644"
|
|
content: |
|
|
# Added by dev-nix Ansible role
|
|
if [ -e /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]; then
|
|
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
fi
|
|
when: dev_nix_enable_shell_snippet | bool
|
|
become: true
|