tvl-depot/ci/scripts/build-socrates.sh

set -euo pipefail

nix-build '<nixpkgs/nixos>' \
  -I briefcase="$(pwd)" \
  -I nixpkgs=/var/lib/buildkite-agent-socrates/nixpkgs-channels \
  -I nixos-config=nixos/socrates/default.nix \
  -A system \
  --show-trace
Debug build-socrates.sh - using `set -euo pipefail` for setting recommended failure-modes - using `set -x` and `echo "$PATH"` to debug my failing build Sidenote: I find BuildKite's documentation quite helpful! 2020-08-16 18:38:14 +02:00			`set -euo pipefail`

Disable failing goals/default.nix Disabling failing packages until I can get a working CI build. 2020-08-17 11:25:26 +02:00			`nix-build '<nixpkgs/nixos>' \`
Revise previous opinions about absolute paths GT <bracket-notation> Unforeseen problem: `buildkite-agent` runs its builds in a separate directory, so if I want the `nix-build` command to build the newly checked out code, I need to set <briefcase> to the CWD. 2020-08-17 11:08:32 +02:00			`-I briefcase="$(pwd)" \`
Move /home/wpcarro/nixpkgs-channels to /var/lib My builds are still failing. This time with... ``` error: getting status of /home/wpcarro/nixpkgs-channels: Permission denied ``` ...what confused me was the following: ```shell $ sudo -u buildkite-agent-socrates stat /home/wpcarro/nixpkgs-channels permission denied ``` But `ls -al /home/wpcarro \| grep nixpkgs-channels` showed `r-w` for all users... Thankfully @riking on ##tvl told me that I should check the permissions for /home/wpcarro and /home... After running `ls -al /home`, I saw `---` for all user... I then reproduced the error by running: ```shell $ sudo -u buildkite-agent-socrates stat /home permission denied ``` Great! So then I moved nixpkgs-channels to /var/lib/buildkite-agent-socrates. @edef recommended that I read more about DynamicUser= setting for systemd, which looks relevant after I took a cursory glance. I'll also want a more declarative way to manager this, but I'm making small improvements every day. 2020-08-17 22:22:15 +02:00			`-I nixpkgs=/var/lib/buildkite-agent-socrates/nixpkgs-channels \`
Revise previous opinions about absolute paths GT <bracket-notation> Unforeseen problem: `buildkite-agent` runs its builds in a separate directory, so if I want the `nix-build` command to build the newly checked out code, I need to set <briefcase> to the CWD. 2020-08-17 11:08:32 +02:00			`-I nixos-config=nixos/socrates/default.nix \`
Attempt nix-build instead of nixos-rebuild switch I've encountered a few problems with attempting to support nixos-rebuild: - the activation step requires `sudo` privileges - the `buildkite-agent` runs on the same machine, socrates, that is rebuilding itself. This means that when the activation step runs, it will attempt to restart `buildkite-agent` when the agent is still working I'm slowly removing places in my nix code that rely on '<bracket>' notation, so that I no longer depend on NIX_PATH being set. I still have more work to do. {covid-uk,sandbox}/default.nix are breaking when I attempt to run my build-socrates.sh script locally, so I'm temporarily disabling them until I can get CI working as I expect. 2020-08-17 10:48:47 +02:00			`-A system \`
			`--show-trace`