053a98a7d7
This reverts commit a41c3dedb1.
Reason for revert: I believe its time has come.
Change-Id: I4133dc8a3b57b40b280646d1622ed7a0409c5246
Reviewed-on: https://cl.tvl.fyi/c/depot/+/1941
Tested-by: BuildkiteCI
Reviewed-by: tazjin <mail@tazj.in>
Reviewed-by: kanepyork <rikingcoding@gmail.com>
464 lines
15 KiB
C++
464 lines
15 KiB
C++
#pragma once
|
|
|
|
#include <limits>
|
|
#include <map>
|
|
|
|
#include <sys/types.h>
|
|
|
|
#include "libutil/config.hh"
|
|
#include "libutil/types.hh"
|
|
#include "libutil/util.hh"
|
|
#include "nix_config.h"
|
|
|
|
namespace nix {
|
|
|
|
typedef enum { smEnabled, smRelaxed, smDisabled } SandboxMode;
|
|
|
|
struct MaxBuildJobsSetting : public BaseSetting<unsigned int> {
|
|
MaxBuildJobsSetting(Config* options, unsigned int def,
|
|
const std::string& name, const std::string& description,
|
|
const std::set<std::string>& aliases = {})
|
|
: BaseSetting<unsigned int>(def, name, description, aliases) {
|
|
options->addSetting(this);
|
|
}
|
|
|
|
void set(const std::string& str) override;
|
|
};
|
|
|
|
class Settings : public Config {
|
|
static unsigned int getDefaultCores();
|
|
|
|
static StringSet getDefaultSystemFeatures();
|
|
|
|
public:
|
|
Settings();
|
|
|
|
Path nixPrefix;
|
|
|
|
/* The directory where we store sources and derived files. */
|
|
Path nixStore;
|
|
|
|
Path nixDataDir; /* !!! fix */
|
|
|
|
/* The directory where we log various operations. */
|
|
Path nixLogDir;
|
|
|
|
/* The directory where state is stored. */
|
|
Path nixStateDir;
|
|
|
|
/* The directory where configuration files are stored. */
|
|
Path nixConfDir;
|
|
|
|
/* The directory where internal helper programs are stored. */
|
|
Path nixLibexecDir;
|
|
|
|
/* The directory where the main programs are stored. */
|
|
Path nixBinDir;
|
|
|
|
/* The directory where the man pages are stored. */
|
|
Path nixManDir;
|
|
|
|
/* File name of the socket the daemon listens to. */
|
|
Path nixDaemonSocketFile;
|
|
|
|
Setting<std::string> storeUri{this, getEnv("NIX_REMOTE").value_or("auto"),
|
|
"store", "The default Nix store to use."};
|
|
|
|
Setting<bool> keepFailed{
|
|
this, false, "keep-failed",
|
|
"Whether to keep temporary directories of failed builds."};
|
|
|
|
Setting<bool> keepGoing{
|
|
this, false, "keep-going",
|
|
"Whether to keep building derivations when another build fails."};
|
|
|
|
Setting<bool> tryFallback{
|
|
this,
|
|
false,
|
|
"fallback",
|
|
"Whether to fall back to building when substitution fails.",
|
|
{"build-fallback"}};
|
|
|
|
/* Whether to show build log output in real time. */
|
|
bool verboseBuild = true;
|
|
|
|
Setting<size_t> logLines{
|
|
this, 10, "log-lines",
|
|
"If verbose-build is false, the number of lines of the tail of "
|
|
"the log to show if a build fails."};
|
|
|
|
MaxBuildJobsSetting maxBuildJobs{this,
|
|
1,
|
|
"max-jobs",
|
|
"Maximum number of parallel build jobs. "
|
|
"\"auto\" means use number of cores.",
|
|
{"build-max-jobs"}};
|
|
|
|
Setting<unsigned int> buildCores{
|
|
this,
|
|
getDefaultCores(),
|
|
"cores",
|
|
"Number of CPU cores to utilize in parallel within a build, "
|
|
"i.e. by passing this number to Make via '-j'. 0 means that the "
|
|
"number of actual CPU cores on the local host ought to be "
|
|
"auto-detected.",
|
|
{"build-cores"}};
|
|
|
|
/* Read-only mode. Don't copy stuff to the store, don't change
|
|
the database. */
|
|
bool readOnlyMode = false;
|
|
|
|
Setting<std::string> thisSystem{this, SYSTEM, "system",
|
|
"The canonical Nix system name."};
|
|
|
|
Setting<time_t> maxSilentTime{
|
|
this,
|
|
0,
|
|
"max-silent-time",
|
|
"The maximum time in seconds that a builer can go without "
|
|
"producing any output on stdout/stderr before it is killed. "
|
|
"0 means infinity.",
|
|
{"build-max-silent-time"}};
|
|
|
|
Setting<time_t> buildTimeout{
|
|
this,
|
|
0,
|
|
"timeout",
|
|
"The maximum duration in seconds that a builder can run. "
|
|
"0 means infinity.",
|
|
{"build-timeout"}};
|
|
|
|
PathSetting buildHook{this, true, nixLibexecDir + "/nix/build-remote",
|
|
"build-hook",
|
|
"The path of the helper program that executes builds "
|
|
"to remote machines."};
|
|
|
|
Setting<std::string> builders{this, "@" + nixConfDir + "/machines",
|
|
"builders",
|
|
"A semicolon-separated list of build machines, "
|
|
"in the format of nix.machines."};
|
|
|
|
Setting<bool> buildersUseSubstitutes{
|
|
this, false, "builders-use-substitutes",
|
|
"Whether build machines should use their own substitutes for obtaining "
|
|
"build dependencies if possible, rather than waiting for this host to "
|
|
"upload them."};
|
|
|
|
Setting<off_t> reservedSize{
|
|
this, 8 * 1024 * 1024, "gc-reserved-space",
|
|
"Amount of reserved disk space for the garbage collector."};
|
|
|
|
Setting<bool> fsyncMetadata{this, true, "fsync-metadata",
|
|
"Whether SQLite should use fsync()."};
|
|
|
|
Setting<bool> useSQLiteWAL{this, true, "use-sqlite-wal",
|
|
"Whether SQLite should use WAL mode."};
|
|
|
|
Setting<bool> syncBeforeRegistering{
|
|
this, false, "sync-before-registering",
|
|
"Whether to call sync() before registering a path as valid."};
|
|
|
|
Setting<bool> useSubstitutes{this,
|
|
true,
|
|
"substitute",
|
|
"Whether to use substitutes.",
|
|
{"build-use-substitutes"}};
|
|
|
|
Setting<std::string> buildUsersGroup{
|
|
this, "", "build-users-group",
|
|
"The Unix group that contains the build users."};
|
|
|
|
Setting<bool> impersonateLinux26{
|
|
this,
|
|
false,
|
|
"impersonate-linux-26",
|
|
"Whether to impersonate a Linux 2.6 machine on newer kernels.",
|
|
{"build-impersonate-linux-26"}};
|
|
|
|
Setting<bool> keepLog{this,
|
|
true,
|
|
"keep-build-log",
|
|
"Whether to store build logs.",
|
|
{"build-keep-log"}};
|
|
|
|
Setting<bool> compressLog{this,
|
|
true,
|
|
"compress-build-log",
|
|
"Whether to compress logs.",
|
|
{"build-compress-log"}};
|
|
|
|
Setting<unsigned long> maxLogSize{
|
|
this,
|
|
0,
|
|
"max-build-log-size",
|
|
"Maximum number of bytes a builder can write to stdout/stderr "
|
|
"before being killed (0 means no limit).",
|
|
{"build-max-log-size"}};
|
|
|
|
/* When buildRepeat > 0 and verboseBuild == true, whether to print
|
|
repeated builds (i.e. builds other than the first one) to
|
|
stderr. Hack to prevent Hydra logs from being polluted. */
|
|
bool printRepeatedBuilds = true;
|
|
|
|
Setting<unsigned int> pollInterval{
|
|
this, 5, "build-poll-interval",
|
|
"How often (in seconds) to poll for locks."};
|
|
|
|
Setting<bool> checkRootReachability{
|
|
this, false, "gc-check-reachability",
|
|
"Whether to check if new GC roots can in fact be found by the "
|
|
"garbage collector."};
|
|
|
|
Setting<bool> gcKeepOutputs{
|
|
this,
|
|
false,
|
|
"keep-outputs",
|
|
"Whether the garbage collector should keep outputs of live derivations.",
|
|
{"gc-keep-outputs"}};
|
|
|
|
Setting<bool> gcKeepDerivations{
|
|
this,
|
|
true,
|
|
"keep-derivations",
|
|
"Whether the garbage collector should keep derivers of live paths.",
|
|
{"gc-keep-derivations"}};
|
|
|
|
Setting<bool> autoOptimiseStore{this, false, "auto-optimise-store",
|
|
"Whether to automatically replace files with "
|
|
"identical contents with hard links."};
|
|
|
|
Setting<bool> envKeepDerivations{
|
|
this,
|
|
false,
|
|
"keep-env-derivations",
|
|
"Whether to add derivations as a dependency of user environments "
|
|
"(to prevent them from being GCed).",
|
|
{"env-keep-derivations"}};
|
|
|
|
/* Whether to lock the Nix client and worker to the same CPU. */
|
|
bool lockCPU;
|
|
|
|
/* Whether to show a stack trace if Nix evaluation fails. */
|
|
Setting<bool> showTrace{
|
|
this, false, "show-trace",
|
|
"Whether to show a stack trace on evaluation errors."};
|
|
|
|
Setting<SandboxMode> sandboxMode {
|
|
this,
|
|
#if __linux__
|
|
smEnabled
|
|
#else
|
|
smDisabled
|
|
#endif
|
|
,
|
|
"sandbox",
|
|
"Whether to enable sandboxed builds. Can be \"true\", \"false\" or "
|
|
"\"relaxed\".",
|
|
{
|
|
"build-use-chroot", "build-use-sandbox"
|
|
}
|
|
};
|
|
|
|
Setting<PathSet> sandboxPaths{
|
|
this,
|
|
{},
|
|
"sandbox-paths",
|
|
"The paths to make available inside the build sandbox.",
|
|
{"build-chroot-dirs", "build-sandbox-paths"}};
|
|
|
|
Setting<bool> sandboxFallback{
|
|
this, true, "sandbox-fallback",
|
|
"Whether to disable sandboxing when the kernel doesn't allow it."};
|
|
|
|
Setting<PathSet> extraSandboxPaths{
|
|
this,
|
|
{},
|
|
"extra-sandbox-paths",
|
|
"Additional paths to make available inside the build sandbox.",
|
|
{"build-extra-chroot-dirs", "build-extra-sandbox-paths"}};
|
|
|
|
Setting<size_t> buildRepeat{
|
|
this,
|
|
0,
|
|
"repeat",
|
|
"The number of times to repeat a build in order to verify determinism.",
|
|
{"build-repeat"}};
|
|
|
|
#if __linux__
|
|
Setting<std::string> sandboxShmSize{
|
|
this, "50%", "sandbox-dev-shm-size",
|
|
"The size of /dev/shm in the build sandbox."};
|
|
|
|
Setting<Path> sandboxBuildDir{this, "/build", "sandbox-build-dir",
|
|
"The build directory inside the sandbox."};
|
|
#endif
|
|
|
|
Setting<PathSet> allowedImpureHostPrefixes{
|
|
this,
|
|
{},
|
|
"allowed-impure-host-deps",
|
|
"Which prefixes to allow derivations to ask for access to (primarily for "
|
|
"Darwin)."};
|
|
|
|
Setting<bool> runDiffHook{
|
|
this, false, "run-diff-hook",
|
|
"Whether to run the program specified by the diff-hook setting "
|
|
"repeated builds produce a different result. Typically used to "
|
|
"plug in diffoscope."};
|
|
|
|
PathSetting diffHook{
|
|
this, true, "", "diff-hook",
|
|
"A program that prints out the differences between the two paths "
|
|
"specified on its command line."};
|
|
|
|
Setting<bool> enforceDeterminism{
|
|
this, true, "enforce-determinism",
|
|
"Whether to fail if repeated builds produce different output."};
|
|
|
|
Setting<Strings> trustedPublicKeys{
|
|
this,
|
|
{"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="},
|
|
"trusted-public-keys",
|
|
"Trusted public keys for secure substitution.",
|
|
{"binary-cache-public-keys"}};
|
|
|
|
Setting<Strings> secretKeyFiles{
|
|
this,
|
|
{},
|
|
"secret-key-files",
|
|
"Secret keys with which to sign local builds."};
|
|
|
|
Setting<unsigned int> tarballTtl{
|
|
this, 60 * 60, "tarball-ttl",
|
|
"How long downloaded files are considered up-to-date."};
|
|
|
|
Setting<bool> requireSigs{
|
|
this, true, "require-sigs",
|
|
"Whether to check that any non-content-addressed path added to the "
|
|
"Nix store has a valid signature (that is, one signed using a key "
|
|
"listed in 'trusted-public-keys'."};
|
|
|
|
Setting<StringSet> extraPlatforms{
|
|
this,
|
|
std::string{SYSTEM} == "x86_64-linux" ? StringSet{"i686-linux"}
|
|
: StringSet{},
|
|
"extra-platforms",
|
|
"Additional platforms that can be built on the local system. "
|
|
"These may be supported natively (e.g. armv7 on some aarch64 CPUs "
|
|
"or using hacks like qemu-user."};
|
|
|
|
Setting<StringSet> systemFeatures{
|
|
this, getDefaultSystemFeatures(), "system-features",
|
|
"Optional features that this system implements (like \"kvm\")."};
|
|
|
|
Setting<Strings> substituters{
|
|
this,
|
|
nixStore == "/nix/store" ? Strings{"https://cache.nixos.org/"}
|
|
: Strings(),
|
|
"substituters",
|
|
"The URIs of substituters (such as https://cache.nixos.org/).",
|
|
{"binary-caches"}};
|
|
|
|
// FIXME: provide a way to add to option values.
|
|
Setting<Strings> extraSubstituters{this,
|
|
{},
|
|
"extra-substituters",
|
|
"Additional URIs of substituters.",
|
|
{"extra-binary-caches"}};
|
|
|
|
Setting<StringSet> trustedSubstituters{
|
|
this,
|
|
{},
|
|
"trusted-substituters",
|
|
"Disabled substituters that may be enabled via the substituters option "
|
|
"by untrusted users.",
|
|
{"trusted-binary-caches"}};
|
|
|
|
Setting<Strings> trustedUsers{this,
|
|
{"root"},
|
|
"trusted-users",
|
|
"Which users or groups are trusted to ask the "
|
|
"daemon to do unsafe things."};
|
|
|
|
Setting<unsigned int> ttlNegativeNarInfoCache{
|
|
this, 3600, "narinfo-cache-negative-ttl",
|
|
"The TTL in seconds for negative lookups in the disk cache i.e binary "
|
|
"cache lookups that "
|
|
"return an invalid path result"};
|
|
|
|
Setting<unsigned int> ttlPositiveNarInfoCache{
|
|
this, 30 * 24 * 3600, "narinfo-cache-positive-ttl",
|
|
"The TTL in seconds for positive lookups in the disk cache i.e binary "
|
|
"cache lookups that "
|
|
"return a valid path result."};
|
|
|
|
/* ?Who we trust to use the daemon in safe ways */
|
|
Setting<Strings> allowedUsers{
|
|
this,
|
|
{"*"},
|
|
"allowed-users",
|
|
"Which users or groups are allowed to connect to the daemon."};
|
|
|
|
Setting<bool> printMissing{
|
|
this, true, "print-missing",
|
|
"Whether to print what paths need to be built or downloaded."};
|
|
|
|
Setting<std::string> preBuildHook{
|
|
this, "", "pre-build-hook",
|
|
"A program to run just before a build to set derivation-specific build "
|
|
"settings."};
|
|
|
|
Setting<std::string> postBuildHook{
|
|
this, "", "post-build-hook",
|
|
"A program to run just after each successful build."};
|
|
|
|
Setting<std::string> netrcFile{this, fmt("%s/%s", nixConfDir, "netrc"),
|
|
"netrc-file",
|
|
"Path to the netrc file used to obtain "
|
|
"usernames/passwords for downloads."};
|
|
|
|
/* Path to the SSL CA file used */
|
|
Path caFile;
|
|
|
|
#if __linux__
|
|
Setting<bool> filterSyscalls{
|
|
this, true, "filter-syscalls",
|
|
"Whether to prevent certain dangerous system calls, such as "
|
|
"creation of setuid/setgid files or adding ACLs or extended "
|
|
"attributes. Only disable this if you're aware of the "
|
|
"security implications."};
|
|
|
|
Setting<bool> allowNewPrivileges{
|
|
this, false, "allow-new-privileges",
|
|
"Whether builders can acquire new privileges by calling programs with "
|
|
"setuid/setgid bits or with file capabilities."};
|
|
#endif
|
|
|
|
Setting<Strings> hashedMirrors{
|
|
this,
|
|
{"http://tarballs.nixos.org/"},
|
|
"hashed-mirrors",
|
|
"A list of servers used by builtins.fetchurl to fetch files by hash."};
|
|
|
|
Setting<uint64_t> minFree{this, 0, "min-free",
|
|
"Automatically run the garbage collector when free "
|
|
"disk space drops below the specified amount."};
|
|
|
|
Setting<uint64_t> maxFree{this, std::numeric_limits<uint64_t>::max(),
|
|
"max-free",
|
|
"Stop deleting garbage when free disk space is "
|
|
"above the specified amount."};
|
|
|
|
Setting<uint64_t> minFreeCheckInterval{
|
|
this, 5, "min-free-check-interval",
|
|
"Number of seconds between checking free disk space."};
|
|
};
|
|
|
|
// FIXME: don't use a global variable.
|
|
extern Settings settings;
|
|
|
|
void loadConfFile();
|
|
|
|
extern const std::string nixVersion;
|
|
|
|
} // namespace nix
|