feat(fw): channel → nixos-26.05 [upgrade 3/6 · bump] #105
Labels
No labels
bug
enhancement
in-progress
needs-info
needs-triage
p0
ready-for-agent
ready-for-human
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Cloonar/nixos#105
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
▶ Hold until [2/6 · verify] is closed. Then arm: relabel
ready-for-agent.Task: bump
hosts/fw/channeltonixos-26.05; open PR.26.05 specifics for fw (keystone):
microvmhas no 26.05 breaking change flagged.nixpkgs.config.permittedInsecurePackages— confirm the pinned package names still resolve on 26.05 (eval will flag a stale name).22.05.Acceptance: pre-commit eval green for fw and its guests against 26.05.
Agent Brief
Category: enhancement (channel upgrade)
Summary: Bump fw and its 5 guest microVMs to
nixos-26.05-- flip the hostchannel, drop the now-removed promtail module and the now-redundant docker_29 pin, and fix whatever else 26.05 surfaces. Leave eval green for fw AND every guest, and a real build clean.Current behavior:
fw tracks
nixos-25.11and is the keystone: 5 microVM guests (dev, web/web-02, forgejo-runner, openclaw) track its nixpkgs, plus routing/DNS (dnsmasq), Forgejo (the deploy substrate), home-assistant, foundry, podman/oci containers.system.stateVersion= 22.05.promtailmodule (journald->loki shipping).virtualisation.docker.package = pkgs.docker_29as a temporary 25.11 workaround (docker comes fromutils/modules/development; the 25.11 default docker_28 is EOL/insecure).permittedInsecurePackages = ["openssl-1.1.1w"]on the host; the web guest pins its own["olm-3.2.16"](matrix bridges).boot.kernelPackagespinslinuxPackages_6_18behindversionOlder ... "6.18.22".Desired behavior:
fw and all 5 guests evaluate and BUILD cleanly on
nixos-26.05, services unchanged. Diff = channel flip + the forced 26.05 fixes below.Known 26.05 specifics for fw:
services.promtail(EOL), so the./utils/modules/promtailimport must go or eval fails on an unknown option. Mirror nas: replace the import with a short comment noting central shipping is paused pending the SEPARATE promtail->grafana-alloy migration (#118; sops scaffolding already exists underutils/modules/alloy/, inert until #121). Do NOT set up alloy here -- that is #118's scope.virtualisation.docker.package = pkgs.docker_29workaround on the dev guest is redundant on 26.05 (default docker is maintained). Remove it.openssl-1.1.1w(host) andolm-3.2.16(web guest) still resolve and are still needed on 26.05; eval flags stale names. Prefer fixing over carrying a dead pin.matrix-synapse+matrix-authentication-service(+ mautrix/olm),invidious(+companion), andpiped-- the likeliest sources of 26.05 option renames.linuxPackages_6_18self-disables (default >= 6.18.22) or still resolves. NIC-driver reboot risk is verified at #106, not here.Acceptance criteria:
hosts/fw/channel->nixos-26.05.udevadm verify, broken pkgs); the nb udev-%regression only surfaced post-merge.utils/modules/alloyyet.system.stateVersionstays 22.05; diff limited to channel flip + required fixes.Out of scope:
linuxPackages_6_18pin (separate cleanup).Agent Brief (REVISED — supersedes the brief above)
Revised after the promtail→alloy migration (#118/#124/#125) landed and after re-checking fw against 26.05. Net change vs the earlier brief: the promtail/alloy work is already done (removed), and the one genuinely-forced 26.05 fix is the insecure-packages predicate migration (added).
Category: enhancement (channel upgrade)
Summary: Bump fw and its 5 guest microVMs to nixos-26.05 — flip the host channel, drop the now-redundant docker_29 pin, migrate the host and guests from
permittedInsecurePackagestoallowInsecurePredicate(26.05 forces this), and fix anything else 26.05 surfaces. Minimal diff: channel flip + forced fixes only.Current behavior:
fw tracks nixos-25.11 and is the keystone. 5 microVM guests track its nixpkgs —
dev,web(web-02),fj-runner-1,fj-runner-2(forgejo-runner declares two viamapAttrs),openclaw— plus routing/DNS (dnsmasq), Forgejo (the deploy substrate), home-assistant, foundry, podman/oci.system.stateVersion = 22.05.nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1w" ].webguest is its own nixpkgs instance (import pkgs.path { config.permittedInsecurePackages = [ "olm-3.2.16" ]; … }) for the matrix bridges (mautrix/olm).devguest pinsvirtualisation.docker.package = pkgs.docker_29(temporary 25.11 workaround; the 25.11 default docker_28 is EOL/insecure). docker is enabled via sharedutils/modules/development.utils/overlays/packages.nix.boot.kernelPackagespinslinuxPackages_6_18behindlib.versionOlder pkgs.linux.version "6.18.22".Desired behavior: fw and all 5 guests evaluate and BUILD cleanly on nixos-26.05, services unchanged. Diff = channel flip + the forced fixes below.
Known 26.05 specifics for fw:
Insecure packages →
allowInsecurePredicate(the real forced change). On 26.05 themakePythonWriterinterpreter guard force-evaluates the wholepypy2Packagesset whenever any Rust package's cargo-vendor derivation is evaluated (pulled in via the users-groups shell-program-check). Its insecure members never enter the closure, but the check trips the insecure gate. Both hosts already on 26.05 (nb, nas) hit this and permit the family by prefix. Because definingallowInsecurePredicatedisables thepermittedInsecurePackageslist, every existing list entry must move into the predicate, per nixpkgs instance:lib.hasPrefix "pypy2.7-"andopenssl-1.1.1w.pypy2.7-andolm-3.2.16(it buildsmatrix-authentication-service, which is Rust → trips the same guard).pypy2.7-predicate to whichever instances eval/build flags (they carry no insecure list today). Use the predicate shape nb/nas use (readpkg.namewith apname-versionfallback).Prefer the predicate over re-adding a static list — the list silently stops working once a predicate is defined.
Drop the docker_29 pin. On 26.05 the default docker is maintained (proven: nb runs 26.05 with docker via the development module and no pin). Remove the
devguest'svirtualisation.docker.package = pkgs.docker_29and let the default apply.Do NOT touch pyload. fw's pyload module is disabled (import commented out) and nothing forces
pkgs.pyload-ng, so — unlike nas — fw needs no pyload-ng vendoring. The sharedutils/overlays/packages.nixstill wraps the (26.05-removed)super.pyload-ng, but it's lazy and never forced on fw; leave it alone. Editing the shared overlay would drag every host through the pre-commit dry-build.Kernel pin is fine.
linuxPackages_6_18is guarded byversionOlder … "6.18.22"; nas runs the identical pin on 26.05. Confirm it resolves/self-disables; don't remove it (separate cleanup).Acceptance criteria:
hosts/fw/channel→ nixos-26.05.dev,web,fj-runner-1,fj-runner-2,openclaw) on 26.05.webguest's matrix stack (matrix-synapse,matrix-authentication-service, mautrix/olm),docker, and anything pulling a Rust cargo-vendor derivation — and reports any closure it could not build locally. Full host+guests build on fw is the maintainer's pre-merge gate (the dev VM can't hold the full keystone closure). eval-only pre-commit misses 26.05 build-gates: udevadm verify, newly-broken pkgs.allowInsecurePredicate(pypy2.7-+ the instance's existing entries); no leftoverpermittedInsecurePackagesthat the predicate silently disables.utils/modules/alloyimports untouched.utils/overlays/packages.nixuntouched.system.stateVersionstays 22.05; diff limited to channel flip + the fixes above.Out of scope:
ready-for-human).linuxPackages_6_18pin (separate cleanup).What changed vs the brief above: ① removed the entire "drop promtail / set up alloy / no host imports alloy yet" workstream (done); ② added the
allowInsecurePredicate+pypy2.7-migration with per-instance fold-in ofopenssl-1.1.1w/olm-3.2.16; ③ flipped pyload from "mirror nas" to "do NOT vendor"; ④ named all 5 guests (two runners); ⑤ made build-verify concrete.Recovered crashed AFK run → PR #128.
The AFK run for this bump crashed mid-flight. Its work was intact (uncommitted, staged + unstaged) in the
afk/105worktree — no commit had landed. Recovered it: backed up the diff, rebased onto currentmain(so it now includes #126), and committed.Status — acceptance met:
utils/modules/legocredentialsFile→environmentFilechange is backward-compatible); nas/nb/amzebs-01 unaffected.%-escaping gate from nb #116 can't fire) and noallowBrokenmasking.Residual: fw's pre-existing custom pins (invidious/Crystal, n8n/pnpm, mautrix-mattermost/Go, ai-mailer/Go) compile against the 26.05 toolchain for the first time at deploy — surfaced by the keystone reboot at the paired verify #106 (atomic switch protects runtime). A full local realize was skipped (eval-only bump convention; also this box has only ~15 GB free vs ~13 GB needed).
Ready for human land of #128.
Delivered via PR #128 (merged): channel → nixos-26.05 for fw + its nixpkgs-tracking guests,
permittedInsecurePackages → allowInsecurePredicate(host + web-02),docker_29pin dropped, microvm/nix/storefsType set,cmp-spellunfree allowance, andlegocredentialsFile → environmentFile. Paired verify #106 confirmed (fw rebooted onto 26.05). Closing the bump.