2012-07-09 17:33:38 +02:00
|
|
|
|
<refentry xmlns="http://docbook.org/ns/docbook"
|
|
|
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
|
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
|
|
|
xml:id="sec-conf-file">
|
2006-08-21 18:05:11 +02:00
|
|
|
|
|
2012-07-09 17:33:38 +02:00
|
|
|
|
<refmeta>
|
|
|
|
|
<refentrytitle>nix.conf</refentrytitle>
|
|
|
|
|
<manvolnum>5</manvolnum>
|
|
|
|
|
<refmiscinfo class="source">Nix</refmiscinfo>
|
2014-09-16 14:57:45 +02:00
|
|
|
|
<refmiscinfo class="version"><xi:include href="../version.txt" parse="text"/></refmiscinfo>
|
2012-07-09 17:33:38 +02:00
|
|
|
|
</refmeta>
|
2006-08-21 18:05:11 +02:00
|
|
|
|
|
2012-07-09 17:33:38 +02:00
|
|
|
|
<refnamediv>
|
|
|
|
|
<refname>nix.conf</refname>
|
|
|
|
|
<refpurpose>Nix configuration file</refpurpose>
|
|
|
|
|
</refnamediv>
|
|
|
|
|
|
|
|
|
|
<refsection><title>Description</title>
|
2005-04-08 15:00:38 +02:00
|
|
|
|
|
|
|
|
|
<para>A number of persistent settings of Nix are stored in the file
|
2016-12-16 10:59:07 +01:00
|
|
|
|
<filename><replaceable>sysconfdir</replaceable>/nix/nix.conf</filename> or
|
|
|
|
|
<filename>$NIX_CONF_DIR/nix.conf</filename> if <envar>NIX_CONF_DIR</envar> is set.
|
2005-04-08 15:00:38 +02:00
|
|
|
|
This file is a list of <literal><replaceable>name</replaceable> =
|
|
|
|
|
<replaceable>value</replaceable></literal> pairs, one per line.
|
2012-07-09 17:33:38 +02:00
|
|
|
|
Comments start with a <literal>#</literal> character. Here is an example
|
|
|
|
|
configuration file:</para>
|
2005-04-08 15:00:38 +02:00
|
|
|
|
|
|
|
|
|
<programlisting>
|
|
|
|
|
gc-keep-outputs = true # Nice for developers
|
|
|
|
|
gc-keep-derivations = true # Idem
|
|
|
|
|
env-keep-derivations = false
|
|
|
|
|
</programlisting>
|
|
|
|
|
|
2012-07-30 22:39:31 +02:00
|
|
|
|
<para>You can override settings using the <option>--option</option>
|
|
|
|
|
flag, e.g. <literal>--option gc-keep-outputs false</literal>.</para>
|
|
|
|
|
|
2012-12-29 23:04:02 +01:00
|
|
|
|
<para>The following settings are currently available:
|
2005-04-08 15:00:38 +02:00
|
|
|
|
|
|
|
|
|
<variablelist>
|
|
|
|
|
|
2012-12-29 23:04:02 +01:00
|
|
|
|
|
2006-08-21 18:05:11 +02:00
|
|
|
|
<varlistentry xml:id="conf-gc-keep-outputs"><term><literal>gc-keep-outputs</literal></term>
|
2005-04-08 15:00:38 +02:00
|
|
|
|
|
|
|
|
|
<listitem><para>If <literal>true</literal>, the garbage collector
|
|
|
|
|
will keep the outputs of non-garbage derivations. If
|
|
|
|
|
<literal>false</literal> (default), outputs will be deleted unless
|
|
|
|
|
they are GC roots themselves (or reachable from other roots).</para>
|
2012-12-29 23:04:02 +01:00
|
|
|
|
|
2005-04-08 15:00:38 +02:00
|
|
|
|
<para>In general, outputs must be registered as roots separately.
|
|
|
|
|
However, even if the output of a derivation is registered as a
|
|
|
|
|
root, the collector will still delete store paths that are used
|
|
|
|
|
only at build time (e.g., the C compiler, or source tarballs
|
|
|
|
|
downloaded from the network). To prevent it from doing so, set
|
|
|
|
|
this option to <literal>true</literal>.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
2012-12-29 23:04:02 +01:00
|
|
|
|
|
2005-04-08 15:00:38 +02:00
|
|
|
|
|
2006-08-21 18:05:11 +02:00
|
|
|
|
<varlistentry xml:id="conf-gc-keep-derivations"><term><literal>gc-keep-derivations</literal></term>
|
2005-04-08 15:00:38 +02:00
|
|
|
|
|
|
|
|
|
<listitem><para>If <literal>true</literal> (default), the garbage
|
|
|
|
|
collector will keep the derivations from which non-garbage store
|
|
|
|
|
paths were built. If <literal>false</literal>, they will be
|
|
|
|
|
deleted unless explicitly registered as a root (or reachable from
|
|
|
|
|
other roots).</para>
|
|
|
|
|
|
|
|
|
|
<para>Keeping derivation around is useful for querying and
|
|
|
|
|
traceability (e.g., it allows you to ask with what dependencies or
|
|
|
|
|
options a store path was built), so by default this option is on.
|
2014-11-04 10:15:55 +01:00
|
|
|
|
Turn it off to save a bit of disk space (or a lot if
|
2005-04-08 15:00:38 +02:00
|
|
|
|
<literal>gc-keep-outputs</literal> is also turned on).</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
2012-12-29 23:04:02 +01:00
|
|
|
|
|
2005-04-08 15:00:38 +02:00
|
|
|
|
<varlistentry><term><literal>env-keep-derivations</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>If <literal>false</literal> (default), derivations
|
|
|
|
|
are not stored in Nix user environments. That is, the derivation
|
|
|
|
|
any build-time-only dependencies may be garbage-collected.</para>
|
|
|
|
|
|
|
|
|
|
<para>If <literal>true</literal>, when you add a Nix derivation to
|
|
|
|
|
a user environment, the path of the derivation is stored in the
|
|
|
|
|
user environment. Thus, the derivation will not be
|
|
|
|
|
garbage-collected until the user environment generation is deleted
|
|
|
|
|
(<command>nix-env --delete-generations</command>). To prevent
|
|
|
|
|
build-time-only dependencies from being collected, you should also
|
|
|
|
|
turn on <literal>gc-keep-outputs</literal>.</para>
|
|
|
|
|
|
|
|
|
|
<para>The difference between this option and
|
|
|
|
|
<literal>gc-keep-derivations</literal> is that this one is
|
|
|
|
|
“sticky”: it applies to any user environment created while this
|
|
|
|
|
option was enabled, while <literal>gc-keep-derivations</literal>
|
|
|
|
|
only applies at the moment the garbage collector is
|
|
|
|
|
run.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
2012-12-29 23:04:02 +01:00
|
|
|
|
|
2006-10-02 13:50:55 +02:00
|
|
|
|
<varlistentry xml:id="conf-build-max-jobs"><term><literal>build-max-jobs</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>This option defines the maximum number of jobs
|
|
|
|
|
that Nix will try to build in parallel. The default is
|
2017-02-28 12:54:50 +01:00
|
|
|
|
<literal>1</literal>. The special value <literal>auto</literal>
|
|
|
|
|
causes Nix to use the number of CPUs in your system. It can be
|
|
|
|
|
overridden using the <option
|
2006-10-02 13:50:55 +02:00
|
|
|
|
linkend='opt-max-jobs'>--max-jobs</option> (<option>-j</option>)
|
|
|
|
|
command line switch.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2010-08-17 09:22:05 +02:00
|
|
|
|
<varlistentry xml:id="conf-build-cores"><term><literal>build-cores</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>Sets the value of the
|
|
|
|
|
<envar>NIX_BUILD_CORES</envar> environment variable in the
|
|
|
|
|
invocation of builders. Builders can use this variable at their
|
|
|
|
|
discretion to control the maximum amount of parallelism. For
|
|
|
|
|
instance, in Nixpkgs, if the derivation attribute
|
|
|
|
|
<varname>enableParallelBuilding</varname> is set to
|
|
|
|
|
<literal>true</literal>, the builder passes the
|
|
|
|
|
<option>-j<replaceable>N</replaceable></option> flag to GNU Make.
|
2013-08-10 23:36:16 +02:00
|
|
|
|
It can be overridden using the <option
|
2010-08-17 09:22:05 +02:00
|
|
|
|
linkend='opt-cores'>--cores</option> command line switch and
|
|
|
|
|
defaults to <literal>1</literal>. The value <literal>0</literal>
|
|
|
|
|
means that the builder should use all available CPU cores in the
|
|
|
|
|
system.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2007-10-29 23:16:36 +01:00
|
|
|
|
<varlistentry xml:id="conf-build-max-silent-time"><term><literal>build-max-silent-time</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem>
|
|
|
|
|
|
|
|
|
|
<para>This option defines the maximum number of seconds that a
|
|
|
|
|
builder can go without producing any data on standard output or
|
2013-08-10 23:36:16 +02:00
|
|
|
|
standard error. This is useful (for instance in an automated
|
2007-10-29 23:16:36 +01:00
|
|
|
|
build system) to catch builds that are stuck in an infinite
|
|
|
|
|
loop, or to catch remote builds that are hanging due to network
|
2013-08-10 23:36:16 +02:00
|
|
|
|
problems. It can be overridden using the <option
|
2007-10-29 23:16:36 +01:00
|
|
|
|
linkend="opt-max-silent-time">--max-silent-time</option> command
|
|
|
|
|
line switch.</para>
|
|
|
|
|
|
|
|
|
|
<para>The value <literal>0</literal> means that there is no
|
|
|
|
|
timeout. This is also the default.</para>
|
|
|
|
|
|
|
|
|
|
</listitem>
|
|
|
|
|
|
2011-06-30 17:48:40 +02:00
|
|
|
|
</varlistentry>
|
|
|
|
|
|
2013-09-02 11:58:18 +02:00
|
|
|
|
|
2011-06-30 17:19:13 +02:00
|
|
|
|
<varlistentry xml:id="conf-build-timeout"><term><literal>build-timeout</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem>
|
|
|
|
|
|
|
|
|
|
<para>This option defines the maximum number of seconds that a
|
2013-08-10 23:36:16 +02:00
|
|
|
|
builder can run. This is useful (for instance in an automated
|
2011-06-30 17:19:13 +02:00
|
|
|
|
build system) to catch builds that are stuck in an infinite loop
|
|
|
|
|
but keep writing to their standard output or standard error. It
|
2013-08-10 23:36:16 +02:00
|
|
|
|
can be overridden using the <option
|
2011-06-30 17:19:13 +02:00
|
|
|
|
linkend="opt-timeout">--timeout</option> command line
|
|
|
|
|
switch.</para>
|
|
|
|
|
|
|
|
|
|
<para>The value <literal>0</literal> means that there is no
|
|
|
|
|
timeout. This is also the default.</para>
|
|
|
|
|
|
|
|
|
|
</listitem>
|
|
|
|
|
|
2007-10-29 23:16:36 +01:00
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2013-09-02 11:58:18 +02:00
|
|
|
|
<varlistentry xml:id="conf-build-max-log-size"><term><literal>build-max-log-size</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem>
|
|
|
|
|
|
|
|
|
|
<para>This option defines the maximum number of bytes that a
|
|
|
|
|
builder can write to its stdout/stderr. If the builder exceeds
|
|
|
|
|
this limit, it’s killed. A value of <literal>0</literal> (the
|
|
|
|
|
default) means that there is no limit.</para>
|
|
|
|
|
|
|
|
|
|
</listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2007-10-29 23:16:36 +01:00
|
|
|
|
<varlistentry xml:id="conf-build-users-group"><term><literal>build-users-group</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>This options specifies the Unix group containing
|
|
|
|
|
the Nix build user accounts. In multi-user Nix installations,
|
|
|
|
|
builds should not be performed by the Nix account since that would
|
|
|
|
|
allow users to arbitrarily modify the Nix store and database by
|
|
|
|
|
supplying specially crafted builders; and they cannot be performed
|
|
|
|
|
by the calling user since that would allow him/her to influence
|
|
|
|
|
the build result.</para>
|
|
|
|
|
|
|
|
|
|
<para>Therefore, if this option is non-empty and specifies a valid
|
|
|
|
|
group, builds will be performed under the user accounts that are a
|
|
|
|
|
member of the group specified here (as listed in
|
|
|
|
|
<filename>/etc/group</filename>). Those user accounts should not
|
|
|
|
|
be used for any other purpose!</para>
|
|
|
|
|
|
|
|
|
|
<para>Nix will never run two builds under the same user account at
|
|
|
|
|
the same time. This is to prevent an obvious security hole: a
|
|
|
|
|
malicious user writing a Nix expression that modifies the build
|
|
|
|
|
result of a legitimate Nix expression being built by another user.
|
|
|
|
|
Therefore it is good to have as many Nix build user accounts as
|
|
|
|
|
you can spare. (Remember: uids are cheap.)</para>
|
|
|
|
|
|
|
|
|
|
<para>The build users should have permission to create files in
|
|
|
|
|
the Nix store, but not delete them. Therefore,
|
|
|
|
|
<filename>/nix/store</filename> should be owned by the Nix
|
|
|
|
|
account, its group should be the group specified here, and its
|
|
|
|
|
mode should be <literal>1775</literal>.</para>
|
|
|
|
|
|
|
|
|
|
<para>If the build users group is empty, builds will be performed
|
|
|
|
|
under the uid of the Nix process (that is, the uid of the caller
|
|
|
|
|
if <envar>NIX_REMOTE</envar> is empty, the uid under which the Nix
|
|
|
|
|
daemon runs if <envar>NIX_REMOTE</envar> is
|
2012-10-03 23:30:45 +02:00
|
|
|
|
<literal>daemon</literal>). Obviously, this should not be used in
|
|
|
|
|
multi-user settings with untrusted users.</para>
|
2007-10-29 23:16:36 +01:00
|
|
|
|
|
|
|
|
|
</listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2015-09-29 18:21:10 +02:00
|
|
|
|
<varlistentry><term><literal>build-use-sandbox</literal></term>
|
2007-10-29 23:16:36 +01:00
|
|
|
|
|
|
|
|
|
<listitem><para>If set to <literal>true</literal>, builds will be
|
2015-09-29 18:21:10 +02:00
|
|
|
|
performed in a <emphasis>sandboxed environment</emphasis>, i.e.,
|
2015-02-23 15:41:41 +01:00
|
|
|
|
they’re isolated from the normal file system hierarchy and will
|
|
|
|
|
only see their dependencies in the Nix store, the temporary build
|
|
|
|
|
directory, private versions of <filename>/proc</filename>,
|
2014-08-04 18:00:33 +02:00
|
|
|
|
<filename>/dev</filename>, <filename>/dev/shm</filename> and
|
2015-09-29 18:21:10 +02:00
|
|
|
|
<filename>/dev/pts</filename> (on Linux), and the paths configured with the
|
|
|
|
|
<link linkend='conf-build-sandbox-paths'><literal>build-sandbox-paths</literal>
|
2014-08-04 18:00:33 +02:00
|
|
|
|
option</link>. This is useful to prevent undeclared dependencies
|
2015-02-23 15:41:41 +01:00
|
|
|
|
on files in directories such as <filename>/usr/bin</filename>. In
|
2015-02-23 16:02:50 +01:00
|
|
|
|
addition, on Linux, builds run in private PID, mount, network, IPC
|
2015-02-23 15:41:41 +01:00
|
|
|
|
and UTS namespaces to isolate them from other processes in the
|
|
|
|
|
system (except that fixed-output derivations do not run in private
|
|
|
|
|
network namespace to ensure they can access the network).</para>
|
|
|
|
|
|
2015-09-29 18:21:10 +02:00
|
|
|
|
<para>Currently, sandboxing only work on Linux and Mac OS X. The use
|
|
|
|
|
of a sandbox requires that Nix is run as root (so you should use
|
2015-02-23 15:41:41 +01:00
|
|
|
|
the <link linkend='conf-build-users-group'>“build users”
|
|
|
|
|
feature</link> to perform the actual builds under different users
|
|
|
|
|
than root).</para>
|
|
|
|
|
|
|
|
|
|
<para>If this option is set to <literal>relaxed</literal>, then
|
|
|
|
|
fixed-output derivations and derivations that have the
|
|
|
|
|
<varname>__noChroot</varname> attribute set to
|
2015-09-29 18:21:10 +02:00
|
|
|
|
<literal>true</literal> do not run in sandboxes.</para>
|
2015-02-23 15:41:41 +01:00
|
|
|
|
|
|
|
|
|
<para>The default is <literal>false</literal>.</para>
|
2007-10-29 23:16:36 +01:00
|
|
|
|
|
|
|
|
|
</listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
2012-12-29 23:04:02 +01:00
|
|
|
|
|
2015-09-29 18:21:10 +02:00
|
|
|
|
<varlistentry xml:id="conf-build-sandbox-paths">
|
|
|
|
|
<term><literal>build-sandbox-paths</literal></term>
|
2012-12-29 23:04:02 +01:00
|
|
|
|
|
2015-09-29 18:21:10 +02:00
|
|
|
|
<listitem><para>A list of paths bind-mounted into Nix sandbox
|
|
|
|
|
environments. You can use the syntax
|
2012-12-29 23:04:02 +01:00
|
|
|
|
<literal><replaceable>target</replaceable>=<replaceable>source</replaceable></literal>
|
2015-09-29 18:21:10 +02:00
|
|
|
|
to mount a path in a different location in the sandbox; for
|
2014-08-04 18:00:33 +02:00
|
|
|
|
instance, <literal>/bin=/nix-bin</literal> will mount the path
|
|
|
|
|
<literal>/nix-bin</literal> as <literal>/bin</literal> inside the
|
2016-10-31 17:09:52 +01:00
|
|
|
|
sandbox. If <replaceable>source</replaceable> is followed by
|
|
|
|
|
<literal>?</literal>, then it is not an error if
|
|
|
|
|
<replaceable>source</replaceable> does not exist; for example,
|
|
|
|
|
<literal>/dev/nvidiactl?</literal> specifies that
|
|
|
|
|
<filename>/dev/nvidiactl</filename> will only be mounted in the
|
|
|
|
|
sandbox if it exists in the host filesystem.</para>
|
2014-08-04 18:00:33 +02:00
|
|
|
|
|
|
|
|
|
<para>Depending on how Nix was built, the default value for this option
|
|
|
|
|
may be empty or provide <filename>/bin/sh</filename> as a
|
|
|
|
|
bind-mount of <command>bash</command>.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2015-09-29 18:21:10 +02:00
|
|
|
|
<varlistentry xml:id="conf-build-extra-sandbox-paths">
|
|
|
|
|
<term><literal>build-extra-sandbox-paths</literal></term>
|
2014-08-04 18:00:33 +02:00
|
|
|
|
|
|
|
|
|
<listitem><para>A list of additional paths appended to
|
2015-09-29 18:21:10 +02:00
|
|
|
|
<option>build-sandbox-paths</option>. Useful if you want to extend
|
2014-08-04 18:00:33 +02:00
|
|
|
|
its default value.</para></listitem>
|
2012-12-29 23:04:02 +01:00
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2012-05-01 01:15:34 +02:00
|
|
|
|
<varlistentry><term><literal>build-use-substitutes</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>If set to <literal>true</literal> (default), Nix
|
|
|
|
|
will use binary substitutes if available. This option can be
|
|
|
|
|
disabled to force building from source.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
2012-12-29 23:04:02 +01:00
|
|
|
|
|
2012-07-31 23:56:02 +02:00
|
|
|
|
<varlistentry><term><literal>build-fallback</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>If set to <literal>true</literal>, Nix will fall
|
|
|
|
|
back to building from source if a binary substitute fails. This
|
|
|
|
|
is equivalent to the <option>--fallback</option> flag. The
|
|
|
|
|
default is <literal>false</literal>.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
2007-10-29 23:16:36 +01:00
|
|
|
|
|
2012-05-29 22:42:05 +02:00
|
|
|
|
<varlistentry><term><literal>build-keep-log</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>If set to <literal>true</literal> (the default),
|
|
|
|
|
Nix will write the build log of a derivation (i.e. the standard
|
|
|
|
|
output and error of its builder) to the directory
|
|
|
|
|
<filename>/nix/var/log/nix/drvs</filename>. The build log can be
|
|
|
|
|
retrieved using the command <command>nix-store -l
|
|
|
|
|
<replaceable>path</replaceable></command>.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2012-07-17 15:40:12 +02:00
|
|
|
|
<varlistentry><term><literal>build-compress-log</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>If set to <literal>true</literal> (the default),
|
|
|
|
|
build logs written to <filename>/nix/var/log/nix/drvs</filename>
|
|
|
|
|
will be compressed on the fly using bzip2. Otherwise, they will
|
|
|
|
|
not be compressed.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2017-04-20 13:39:01 +02:00
|
|
|
|
<varlistentry><term><literal>substituters</literal></term>
|
2012-07-09 16:57:28 +02:00
|
|
|
|
|
2017-04-20 13:39:01 +02:00
|
|
|
|
<listitem><para>A list of URLs of substituters, separated by
|
2013-01-02 22:16:37 +01:00
|
|
|
|
whitespace. The default is
|
2014-12-09 11:50:46 +01:00
|
|
|
|
<literal>https://cache.nixos.org</literal>.</para></listitem>
|
2012-07-09 16:57:28 +02:00
|
|
|
|
|
|
|
|
|
</varlistentry>
|
2012-07-18 16:47:59 +02:00
|
|
|
|
|
2012-07-09 16:57:28 +02:00
|
|
|
|
|
2017-04-20 13:39:01 +02:00
|
|
|
|
<!--
|
2012-08-01 23:56:11 +02:00
|
|
|
|
<varlistentry><term><literal>binary-caches-files</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>A list of names of files that will be read to
|
|
|
|
|
obtain additional binary cache URLs. The default is
|
2012-12-21 15:00:07 +01:00
|
|
|
|
<literal>/nix/var/nix/profiles/per-user/<replaceable>username</replaceable>/channels/binary-caches/*</literal>.
|
|
|
|
|
Note that when you’re using the Nix daemon,
|
|
|
|
|
<replaceable>username</replaceable> is always equal to
|
|
|
|
|
<literal>root</literal>, so Nix will only use the binary caches
|
|
|
|
|
provided by the channels installed by root. Do not set this
|
|
|
|
|
option to read files created by untrusted users!</para></listitem>
|
2012-08-01 23:56:11 +02:00
|
|
|
|
|
|
|
|
|
</varlistentry>
|
2017-04-20 13:39:01 +02:00
|
|
|
|
-->
|
2012-08-01 23:56:11 +02:00
|
|
|
|
|
|
|
|
|
|
2017-04-20 13:39:01 +02:00
|
|
|
|
<varlistentry><term><literal>trusted-substituters</literal></term>
|
2012-08-01 00:56:22 +02:00
|
|
|
|
|
2017-04-20 13:39:01 +02:00
|
|
|
|
<listitem><para>A list of URLs of substituters, separated by
|
2012-08-01 00:56:22 +02:00
|
|
|
|
whitespace. These are not used by default, but can be enabled by
|
|
|
|
|
users of the Nix daemon by specifying <literal>--option
|
2017-04-20 13:39:01 +02:00
|
|
|
|
substituters <replaceable>urls</replaceable></literal> on the
|
2013-05-07 15:37:28 +02:00
|
|
|
|
command line. Unprivileged users are only allowed to pass a
|
2017-04-20 13:39:01 +02:00
|
|
|
|
subset of the URLs listed in <literal>substituters</literal> and
|
|
|
|
|
<literal>trusted-substituters</literal>.</para></listitem>
|
2012-08-01 00:56:22 +02:00
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2017-04-20 13:39:01 +02:00
|
|
|
|
<varlistentry><term><literal>extra-substituters</literal></term>
|
2013-05-07 15:37:28 +02:00
|
|
|
|
|
|
|
|
|
<listitem><para>Additional binary caches appended to those
|
2017-04-20 13:39:01 +02:00
|
|
|
|
specified in <option>substituters</option>. When used by
|
|
|
|
|
unprivileged users, untrusted substituters (i.e. those not listed
|
|
|
|
|
in <option>trusted-substituters</option>) are silently
|
2013-05-07 15:37:28 +02:00
|
|
|
|
ignored.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2015-06-01 17:14:16 +02:00
|
|
|
|
<varlistentry><term><literal>signed-binary-caches</literal></term>
|
|
|
|
|
|
2017-03-21 18:06:13 +01:00
|
|
|
|
<listitem><para>If set to <literal>*</literal> (the default), Nix
|
|
|
|
|
will only download binaries if they are signed using one of the
|
|
|
|
|
keys listed in <option>binary-cache-public-keys</option>. Set to
|
|
|
|
|
the empty string to disable signature checking.</para></listitem>
|
2015-06-01 17:14:16 +02:00
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<varlistentry><term><literal>binary-cache-public-keys</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>A whitespace-separated list of public keys
|
|
|
|
|
corresponding to the secret keys trusted to sign binary
|
|
|
|
|
caches. For example:
|
|
|
|
|
<literal>cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
|
|
|
|
|
hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs=</literal>.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2012-07-09 16:57:28 +02:00
|
|
|
|
<varlistentry><term><literal>binary-caches-parallel-connections</literal></term>
|
|
|
|
|
|
2016-09-14 16:34:37 +02:00
|
|
|
|
<listitem><para>The maximum number of parallel TCP connections
|
|
|
|
|
used to fetch files from binary caches and by other downloads. It
|
|
|
|
|
defaults to 25. 0 means no limit.</para></listitem>
|
2012-07-09 16:57:28 +02:00
|
|
|
|
|
|
|
|
|
</varlistentry>
|
2012-07-18 16:47:59 +02:00
|
|
|
|
|
2012-07-09 16:57:28 +02:00
|
|
|
|
|
2017-02-01 13:37:34 +01:00
|
|
|
|
<varlistentry><term><literal>netrc-file</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>If set to an absolute path to a <filename>netrc</filename>
|
|
|
|
|
file, Nix will use the HTTP authentication credentials in this file when
|
|
|
|
|
trying to download from a remote host through HTTP or HTTPS. Defaults to
|
|
|
|
|
<filename>$NIX_CONF_DIR/netrc</filename>.</para>
|
|
|
|
|
|
2017-02-16 14:23:30 +01:00
|
|
|
|
<para>The <filename>netrc</filename> file consists of a list of
|
|
|
|
|
accounts in the following format:
|
|
|
|
|
|
|
|
|
|
<screen>
|
|
|
|
|
machine <replaceable>my-machine</replaceable>
|
|
|
|
|
login <replaceable>my-username</replaceable>
|
|
|
|
|
password <replaceable>my-password</replaceable>
|
|
|
|
|
</screen>
|
|
|
|
|
|
|
|
|
|
For the exact syntax, see <link
|
|
|
|
|
xlink:href="https://ec.haxx.se/usingcurl-netrc.html">the
|
|
|
|
|
<literal>curl</literal> documentation.</link></para></listitem>
|
2017-02-01 13:37:34 +01:00
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2006-10-05 10:21:52 +02:00
|
|
|
|
<varlistentry><term><literal>system</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>This option specifies the canonical Nix system
|
|
|
|
|
name of the current installation, such as
|
|
|
|
|
<literal>i686-linux</literal> or
|
2016-08-10 18:41:51 +02:00
|
|
|
|
<literal>x86_64-darwin</literal>. Nix can only build derivations
|
2006-10-05 10:21:52 +02:00
|
|
|
|
whose <literal>system</literal> attribute equals the value
|
|
|
|
|
specified here. In general, it never makes sense to modify this
|
|
|
|
|
value from its default, since you can use it to ‘lie’ about the
|
|
|
|
|
platform you are building on (e.g., perform a Mac OS build on a
|
|
|
|
|
Linux machine; the result would obviously be wrong). It only
|
|
|
|
|
makes sense if the Nix binaries can run on multiple platforms,
|
2016-08-10 18:41:51 +02:00
|
|
|
|
e.g., ‘universal binaries’ that run on <literal>x86_64-linux</literal> and
|
|
|
|
|
<literal>i686-linux</literal>.</para>
|
2006-10-05 10:21:52 +02:00
|
|
|
|
|
|
|
|
|
<para>It defaults to the canonical Nix system name detected by
|
|
|
|
|
<filename>configure</filename> at build time.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
2010-01-29 13:22:58 +01:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<varlistentry><term><literal>fsync-metadata</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>If set to <literal>true</literal>, changes to the
|
|
|
|
|
Nix store metadata (in <filename>/nix/var/nix/db</filename>) are
|
|
|
|
|
synchronously flushed to disk. This improves robustness in case
|
|
|
|
|
of system crashes, but reduces performance. The default is
|
2010-02-24 14:12:57 +01:00
|
|
|
|
<literal>true</literal>.</para></listitem>
|
2010-01-29 13:22:58 +01:00
|
|
|
|
|
|
|
|
|
</varlistentry>
|
2012-07-23 21:02:52 +02:00
|
|
|
|
|
2012-12-29 23:04:02 +01:00
|
|
|
|
|
2012-07-23 21:02:52 +02:00
|
|
|
|
<varlistentry><term><literal>auto-optimise-store</literal></term>
|
|
|
|
|
|
2013-07-03 18:35:59 +02:00
|
|
|
|
<listitem><para>If set to <literal>true</literal>, Nix
|
|
|
|
|
automatically detects files in the store that have identical
|
2012-07-23 21:02:52 +02:00
|
|
|
|
contents, and replaces them with hard links to a single copy.
|
2013-07-03 18:35:59 +02:00
|
|
|
|
This saves disk space. If set to <literal>false</literal> (the
|
|
|
|
|
default), you can still run <command>nix-store
|
|
|
|
|
--optimise</command> to get rid of duplicate
|
|
|
|
|
files.</para></listitem>
|
2012-07-23 21:02:52 +02:00
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2014-02-26 16:07:43 +01:00
|
|
|
|
<varlistentry xml:id="conf-connect-timeout"><term><literal>connect-timeout</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem>
|
|
|
|
|
|
|
|
|
|
<para>The timeout (in seconds) for establishing connections in
|
|
|
|
|
the binary cache substituter. It corresponds to
|
|
|
|
|
<command>curl</command>’s <option>--connect-timeout</option>
|
|
|
|
|
option.</para>
|
|
|
|
|
|
|
|
|
|
</listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2014-07-17 16:57:07 +02:00
|
|
|
|
<varlistentry xml:id="conf-trusted-users"><term><literal>trusted-users</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem>
|
|
|
|
|
|
|
|
|
|
<para>A list of names of users (separated by whitespace) that
|
|
|
|
|
have additional rights when connecting to the Nix daemon, such
|
|
|
|
|
as the ability to specify additional binary caches, or to import
|
|
|
|
|
unsigned NARs. You can also specify groups by prefixing them
|
|
|
|
|
with <literal>@</literal>; for instance,
|
|
|
|
|
<literal>@wheel</literal> means all users in the
|
|
|
|
|
<literal>wheel</literal> group. The default is
|
|
|
|
|
<literal>root</literal>.</para>
|
|
|
|
|
|
|
|
|
|
<warning><para>The users listed here have the ability to
|
|
|
|
|
compromise the security of a multi-user Nix store. For instance,
|
|
|
|
|
they could install Trojan horses subsequently executed by other
|
|
|
|
|
users. So you should consider carefully whether to add users to
|
|
|
|
|
this list.</para></warning>
|
|
|
|
|
|
|
|
|
|
</listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<varlistentry xml:id="conf-allowed-users"><term><literal>allowed-users</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem>
|
|
|
|
|
|
|
|
|
|
<para>A list of names of users (separated by whitespace) that
|
|
|
|
|
are allowed to connect to the Nix daemon. As with the
|
|
|
|
|
<option>trusted-users</option> option, you can specify groups by
|
|
|
|
|
prefixing them with <literal>@</literal>. Also, you can allow
|
|
|
|
|
all users by specifying <literal>*</literal>. The default is
|
|
|
|
|
<literal>*</literal>.</para>
|
|
|
|
|
|
|
|
|
|
<para>Note that trusted users are always allowed to connect.</para>
|
|
|
|
|
|
|
|
|
|
</listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2015-02-23 14:41:53 +01:00
|
|
|
|
<varlistentry xml:id="conf-restrict-eval"><term><literal>restrict-eval</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem>
|
|
|
|
|
|
|
|
|
|
<para>If set to <literal>true</literal>, the Nix evaluator will
|
|
|
|
|
not allow access to any files outside of the Nix search path (as
|
|
|
|
|
set via the <envar>NIX_PATH</envar> environment variable or the
|
|
|
|
|
<option>-I</option> option). The default is
|
|
|
|
|
<literal>false</literal>.</para>
|
|
|
|
|
|
|
|
|
|
</listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2015-04-18 22:56:02 +02:00
|
|
|
|
<varlistentry xml:id="conf-pre-build-hook"><term><literal>pre-build-hook</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<para>If set, the path to a program that can set extra
|
|
|
|
|
derivation-specific settings for this system. This is used for settings
|
|
|
|
|
that can't be captured by the derivation model itself and are too variable
|
|
|
|
|
between different versions of the same system to be hard-coded into nix.
|
|
|
|
|
</para>
|
|
|
|
|
|
2015-09-29 18:21:10 +02:00
|
|
|
|
<para>The hook is passed the derivation path and, if sandboxes are enabled,
|
|
|
|
|
the sandbox directory. It can then modify the sandbox and send a series of
|
2015-04-18 22:56:02 +02:00
|
|
|
|
commands to modify various settings to stdout. The currently recognized
|
|
|
|
|
commands are:</para>
|
|
|
|
|
|
|
|
|
|
<variablelist>
|
2015-09-29 18:21:10 +02:00
|
|
|
|
<varlistentry xml:id="extra-sandbox-paths">
|
|
|
|
|
<term><literal>extra-sandbox-paths</literal></term>
|
2015-04-18 22:56:02 +02:00
|
|
|
|
|
|
|
|
|
<listitem>
|
|
|
|
|
|
|
|
|
|
<para>Pass a list of files and directories to be included in the
|
2015-09-29 18:21:10 +02:00
|
|
|
|
sandbox for this build. One entry per line, terminated by an empty
|
|
|
|
|
line. Entries have the same format as
|
|
|
|
|
<literal>build-sandbox-paths</literal>.</para>
|
2015-04-18 22:56:02 +02:00
|
|
|
|
|
|
|
|
|
</listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
</variablelist>
|
|
|
|
|
</listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2015-11-09 23:16:24 +01:00
|
|
|
|
<varlistentry xml:id="conf-build-repeat"><term><literal>build-repeat</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>How many times to repeat builds to check whether
|
|
|
|
|
they are deterministic. The default value is 0. If the value is
|
|
|
|
|
non-zero, every build is repeated the specified number of
|
|
|
|
|
times. If the contents of any of the runs differs from the
|
|
|
|
|
previous ones, the build is rejected and the resulting store paths
|
|
|
|
|
are not registered as “valid” in Nix’s database.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2016-09-21 16:53:41 +02:00
|
|
|
|
<varlistentry xml:id="conf-sandbox-dev-shm-size"><term><literal>sandbox-dev-shm-size</literal></term>
|
|
|
|
|
|
|
|
|
|
<listitem><para>This option determines the maximum size of the
|
|
|
|
|
<literal>tmpfs</literal> filesystem mounted on
|
|
|
|
|
<filename>/dev/shm</filename> in Linux sandboxes. For the format,
|
|
|
|
|
see the description of the <option>size</option> option of
|
|
|
|
|
<literal>tmpfs</literal> in
|
|
|
|
|
<citerefentry><refentrytitle>mount</refentrytitle><manvolnum>8</manvolnum></citerefentry>. The
|
|
|
|
|
default is <literal>50%</literal>.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2017-03-08 15:12:03 +01:00
|
|
|
|
<varlistentry xml:id="conf-allow-import-from-derivation"><term><literal>allow-import-from-derivation</literal></term>
|
|
|
|
|
|
2017-03-09 13:36:56 +01:00
|
|
|
|
<listitem><para>By default, Nix allows you to <function>import</function> from a derivation,
|
|
|
|
|
allowing building at evaluation time. With this option set to false, Nix will throw an error
|
2017-03-08 15:12:03 +01:00
|
|
|
|
when evaluating an expression that uses this feature, allowing users to ensure their evaluation
|
|
|
|
|
will not require any builds to take place.</para></listitem>
|
|
|
|
|
|
|
|
|
|
</varlistentry>
|
|
|
|
|
|
|
|
|
|
|
2005-04-08 15:00:38 +02:00
|
|
|
|
</variablelist>
|
|
|
|
|
|
|
|
|
|
</para>
|
|
|
|
|
|
2012-07-09 17:33:38 +02:00
|
|
|
|
</refsection>
|
2006-08-21 18:05:11 +02:00
|
|
|
|
|
2012-07-09 17:33:38 +02:00
|
|
|
|
</refentry>
|