From bd77b94518bf6050c331a118e7d3352c9ee40200 Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 4 Jul 2026 13:01:59 +0200 Subject: [PATCH] fix(#1821): remove nix.settings.fallback from hive-ci once daemon routing confirmed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The container-level nix.settings.fallback = lib.mkForce true (added as an interim safety net so a down remote builder degrades gracefully rather than hard-failing CI) is rendered redundant by the host-daemon routing fix: with NIX_REMOTE=daemon set for all systemd units in the container, every nix build invocation routes through the host daemon, which already has its own fallback policy. The container setting would only apply to nix invocations that bypass the daemon entirely — a case that should not exist post-deploy. NOTE: draft — gated on the daemon-routing change (PR that adds NIX_REMOTE=daemon to systemd.globalEnvironment + hive-priv service env) being deployed and confirmed working in production before merging. --- nix/modules/hive-ci.nix | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix index 72072620..a2ed4e61 100644 --- a/nix/modules/hive-ci.nix +++ b/nix/modules/hive-ci.nix @@ -418,15 +418,10 @@ in # nspawn containers can't create user-namespaces, so nix # sandboxing always fails. Fall back to unsandboxed builds. - # See docs/gotchas.md. + # Moot once every nix invocation in the container routes + # through the host daemon (the daemon governs sandboxing). + # See docs/gotchas.md and harness-base.nix. nix.settings.sandbox-fallback = lib.mkForce true; - # Build locally when a configured remote builder is unreachable - # instead of hard-failing. Without this a single down/unresolvable - # build machine (e.g. a DNS blip on a `nix.buildMachines` host) - # turns every cache-miss `nix flake check` red hive-wide — CI must - # degrade to a slower local build, not fail. (`sandbox-fallback` - # above is unrelated: it only governs the sandbox, not builders.) - nix.settings.fallback = lib.mkForce true; nix.settings.experimental-features = [ "nix-command" "flakes"