Enterprise: Difference between revisions

Revision as of 23:10, 22 May 2018

When trying to use Nix and NixOS in corporations there are a number of issues one will run into. This page tries to provide a solution to each of these issues.

Private resources

Building internal projects will require fetching of internal (private) source code and other resources. These resources usually are protected by some form of credentials.

fetchurl

fetchurl is used to retrieve HTTP resources, but is also used by fetchFromGithub. For private resources this will usually result in an error like the following:

curl: (22) The requested URL returned error: 401 Unauthorized

Nix will not know about your credentials in your home directory, as the builders have no access to those files. However, Nix has a few options borrowed from curl that will help in this situation. A netrc file can be used that holds the credentials for all domains that require authorisation. More information on netrc can be found in the GNU manual. For our example, we will create the file in /etc/nix/netrc. The contents will look similar to the following:

machine DOMAINNAME
    login USERNAME
    password SECRET

Next the netrc file needs to be accessible in the builds. We will configure Nix to allow access to this file directly from the build sandboxes. Edit your /etc/nix/nix.conf file so that it includes the following lines:

netrc-file = /etc/nix/netrc

Lastly, the default way of fetching urls is using curl inside a build sandbox. This is a powerful command, but it will not use (and cannot use) a netrc file that is outside of the build sandbox. Note that we do not want to place the netrc file inside the sandbox, because that could leak private credentials into builds. The Nix package manager itself can also fetch HTTP(S) resources. It can do so using fetchurlBoot. This is usually used to bootstrap some of the more basic packages like curl itself, but it can also be very useful for fetching files outside of the sandbox.

Since ```fetchurlBoot``` is mostly compatible with ```fetchurl``` we can override ```fetchurl``` where needed:

mypackage = callPackage <mypackage.nix> {
  fetchurl = fetchurlBoot;
};

Now the package is built exactly the same way as before, but resources will be fetched using fetchurlBoot. fetchurlBoot will in turn download the resources within Nix itself, which will use the netrc-file and use the right credentials for the domain names that you have defined.

TLS Intercepting Proxy

As of right now there currently does not seem to be a way to install nix packages via an intercepting proxy which replaces the original TLS certificate with the certificate created by the intercepting proxy, see nix issue #1896.

The proxy itself can be set via the environment variables HTTP_PROXY and HTTPS_PROXY.

@@ Line 20: / Line 20: @@
 Next the netrc file needs to be accessible in the builds. We will configure Nix to allow access to this file directly from the build sandboxes. Edit your <code>/etc/nix/nix.conf</code> file so that it includes the following lines:
-  build-sandbox-paths = /etc/nix/netrc
+  netrc-file = /etc/nix/netrc
-Lastly, the builds need to know that they need to use the netrc file in <code>fetchurl</code>. We will override the definition of <code>fetchurl</code> to include <code>--netrc-file /etc/nix/netrc</code> in the curl options used by <code>fetchurl</code>. The following shows how this might look in your Nix file:
+Lastly, the default way of fetching urls is using curl inside a build sandbox. This is a powerful command, but it will not use (and cannot use) a netrc file that is outside of the build sandbox. Note that we do not want to place the netrc file inside the sandbox, because that could leak private credentials into builds. The Nix package manager itself can also fetch HTTP(S) resources. It can do so using '''fetchurlBoot'''. This is usually used to bootstrap some of the more basic packages like '''curl''' itself, but it can also be very useful for fetching files outside of the sandbox.
+Since ```fetchurlBoot``` is mostly compatible with ```fetchurl``` we can override ```fetchurl``` where needed:
 <syntaxHighlight lang=nix>
- let pkgs = import <nixpkgs> {
+mypackage = callPackage <mypackage.nix> {
-   config = {
+  fetchurl = fetchurlBoot;
-     packageOverrides = pkgs: rec {
+};
-       fetchurlPrivate = opts: pkgs.fetchurl (opts // {
-         curlOpts = "${pkgs.lib.optionalString (opts ? curlOpts) "${opts.curlOpts}"} --netrc-file /etc/nix/netrc";
-       });
-   };
- }
- in
-   ...
 </syntaxHighlight>
-Now '''fetchurlPrivate''' can be used just like '''fetchurl''', but will use the netrc file that includes the credentials of your choice for specific domainnames.
+Now the package is built exactly the same way as before, but resources will be fetched using '''fetchurlBoot'''. '''fetchurlBoot''' will in turn download the resources within Nix itself, which will use the netrc-file and use the right credentials for the domain names that you have defined.
 == TLS Intercepting Proxy ==