amazon
- result/master/amazon:{out}
+ result/new/amazon:{out}
• The set of input derivation names do not match:
- nixos-system-unnamed-25.05pre-git
+ nixos-system-unnamed-amazon-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/rxq6h3642phmdrqima42g14ivfn84q3g-closure-info.drv:{out}
+ /nix/store/7ai91qpy4q8ps2dsa46rj9pjy4395z37-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-unnamed-25.05pre-git
+ nixos-system-unnamed-amazon-25.05pre-git
• The input derivation named `nixos-25.05pre-git` differs
- /nix/store/icnva3w4w72x72d7rj2yjkllamh8s67q-nixos-25.05pre-git.drv:{out}
+ /nix/store/brlzsqwvlkzbw3apqncqbf70m9ndrbnd-nixos-25.05pre-git.drv:{out}
• The input source named `source` differs
• The environments do not match:
buildCommand=''
mkdir -p $out
cp -prd ←/nix/store/pavyzp5xf2mrzh98l3xnpz3g9b7z4zxy-source←→/nix/store/r82zv817z34g7zasq20iwdrx630jzqsv-source→ $out/nixos
chmod -R u+w $out/nixos
if [ ! -e $out/nixos/nixpkgs ]; then
ln -s . $out/nixos/nixpkgs
fi
rm -rf $out/nixos/.git
echo -n pre-git > $out/nixos/.version-suffix
''
• Skipping environment comparison
• The input derivation named `nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
azure
- result/master/azure:{out}
+ result/new/azure:{out}
• The set of input derivation names do not match:
- nixos-system-unnamed-25.05pre-git
+ nixos-system-unnamed-azure-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/5fydq1m37b572r1jqiq3ccsg3cvrhq12-closure-info.drv:{out}
+ /nix/store/pc6y564alja617g8kvz7smvcjzkgsk2c-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-unnamed-25.05pre-git
+ nixos-system-unnamed-azure-25.05pre-git
• The input derivation named `nixos-25.05pre-git` differs
- /nix/store/icnva3w4w72x72d7rj2yjkllamh8s67q-nixos-25.05pre-git.drv:{out}
+ /nix/store/brlzsqwvlkzbw3apqncqbf70m9ndrbnd-nixos-25.05pre-git.drv:{out}
• The input source named `source` differs
• The environments do not match:
buildCommand=''
mkdir -p $out
cp -prd ←/nix/store/pavyzp5xf2mrzh98l3xnpz3g9b7z4zxy-source←→/nix/store/r82zv817z34g7zasq20iwdrx630jzqsv-source→ $out/nixos
chmod -R u+w $out/nixos
if [ ! -e $out/nixos/nixpkgs ]; then
ln -s . $out/nixos/nixpkgs
fi
rm -rf $out/nixos/.git
echo -n pre-git > $out/nixos/.version-suffix
''
• Skipping environment comparison
• The input derivation named `nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
digital-ocean
- result/master/digital-ocean:{out}
+ result/new/digital-ocean:{out}
• The set of input derivation names do not match:
- nixos-system-unnamed-25.05pre-git
+ nixos-system-unnamed-digital-ocean-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/asd2n534dwqzc12n4sjrng7fldas50ws-closure-info.drv:{out}
+ /nix/store/1allqxb52i2yw0yw1s5rzr2kkfrr03w6-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-unnamed-25.05pre-git
+ nixos-system-unnamed-digital-ocean-25.05pre-git
• The input derivation named `nixos-25.05pre-git` differs
- /nix/store/icnva3w4w72x72d7rj2yjkllamh8s67q-nixos-25.05pre-git.drv:{out}
+ /nix/store/brlzsqwvlkzbw3apqncqbf70m9ndrbnd-nixos-25.05pre-git.drv:{out}
• The input source named `source` differs
• The environments do not match:
buildCommand=''
mkdir -p $out
cp -prd ←/nix/store/pavyzp5xf2mrzh98l3xnpz3g9b7z4zxy-source←→/nix/store/r82zv817z34g7zasq20iwdrx630jzqsv-source→ $out/nixos
chmod -R u+w $out/nixos
if [ ! -e $out/nixos/nixpkgs ]; then
ln -s . $out/nixos/nixpkgs
fi
rm -rf $out/nixos/.git
echo -n pre-git > $out/nixos/.version-suffix
''
• Skipping environment comparison
• The input derivation named `nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
google-compute
- result/master/google-compute:{out}
+ result/new/google-compute:{out}
• The set of input derivation names do not match:
- nixos-system-unnamed-25.05pre-git
+ nixos-system-unnamed-google-compute-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/aklxwldymri5bjshk7rf8yqzcqqqzd1d-closure-info.drv:{out}
+ /nix/store/d3y0v5kvz358dy3rav94jbp1drgsqh4l-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-unnamed-25.05pre-git
+ nixos-system-unnamed-google-compute-25.05pre-git
• The input derivation named `nixos-25.05pre-git` differs
- /nix/store/icnva3w4w72x72d7rj2yjkllamh8s67q-nixos-25.05pre-git.drv:{out}
+ /nix/store/brlzsqwvlkzbw3apqncqbf70m9ndrbnd-nixos-25.05pre-git.drv:{out}
• The input source named `source` differs
• The environments do not match:
buildCommand=''
mkdir -p $out
cp -prd ←/nix/store/pavyzp5xf2mrzh98l3xnpz3g9b7z4zxy-source←→/nix/store/r82zv817z34g7zasq20iwdrx630jzqsv-source→ $out/nixos
chmod -R u+w $out/nixos
if [ ! -e $out/nixos/nixpkgs ]; then
ln -s . $out/nixos/nixpkgs
fi
rm -rf $out/nixos/.git
echo -n pre-git > $out/nixos/.version-suffix
''
• Skipping environment comparison
• The input derivation named `nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
hyperv
- result/master/hyperv:{out}
+ result/new/hyperv:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-hyperv-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/cx11gz66q9haxi59s6all4m5qirclfwa-closure-info.drv:{out}
+ /nix/store/4xvrh2cz6lrz8bp73j50n9gcy44xbjvw-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-hyperv-25.05pre-git
• The input derivation named `nixos-25.05pre-git` differs
- /nix/store/icnva3w4w72x72d7rj2yjkllamh8s67q-nixos-25.05pre-git.drv:{out}
+ /nix/store/brlzsqwvlkzbw3apqncqbf70m9ndrbnd-nixos-25.05pre-git.drv:{out}
• The input source named `source` differs
• The environments do not match:
buildCommand=''
mkdir -p $out
cp -prd ←/nix/store/pavyzp5xf2mrzh98l3xnpz3g9b7z4zxy-source←→/nix/store/r82zv817z34g7zasq20iwdrx630jzqsv-source→ $out/nixos
chmod -R u+w $out/nixos
if [ ! -e $out/nixos/nixpkgs ]; then
ln -s . $out/nixos/nixpkgs
fi
rm -rf $out/nixos/.git
echo -n pre-git > $out/nixos/.version-suffix
''
• Skipping environment comparison
• The input derivation named `nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
iso
- result/master/iso:{out}
+ result/new/iso:{out}
• The input derivation named `closure-info` differs
- /nix/store/30n06z1nwvskl89dybcyc037gml85shs-closure-info.drv:{out}
+ /nix/store/cba2qg6iavv4f3f3dmg75ri5rrk33fnv-closure-info.drv:{out}
• The input derivation named `nixos-system-nixos-25.05pre-git` differs
- /nix/store/4ny69w03hv606cnf4hl8ss21n7372f8w-nixos-system-nixos-25.05pre-git.drv:{out}
+ /nix/store/r799hhwxjv9bd2f7i5l42g79gcsr9lnm-nixos-system-nixos-25.05pre-git.drv:{out}
• The input derivation named `etc` differs
- /nix/store/yl8mxd5f5gh2n0bnhp9nnc4y197n0ggf-etc.drv:{out}
+ /nix/store/yym1jdsnw90l6xmryw8ff93n692mmzm1-etc.drv:{out}
• The input derivation named `dbus-1` differs
- /nix/store/n186h5g82lrlwlx9y2rgkl369ac1rhyp-dbus-1.drv:{out}
+ /nix/store/sy57bhpfma7vslqbf1936ns2m7z75nbi-dbus-1.drv:{out}
• The input derivation named `system-path` differs
- /nix/store/hh0g878wi3nmxp5vvyx9721p7lzmlw35-system-path.drv:{out}
+ /nix/store/p9j7sj3w6w233q6g0n3bl95sdp42c3c0-system-path.drv:{out}
• The input derivation named `nixos-rebuild` differs
- /nix/store/x8w3s72v1nd6r830pkcnai0vrllrzwjx-nixos-rebuild.drv:{out}
+ /nix/store/yb5jb0wpglskm5kfwzv5nfjbhnqwxz18-nixos-rebuild.drv:{out}
• The input source named `nixos-rebuild.8` differs
''
.Dd January 1, 1980
.Dt nixos-rebuild 8
.Os
.Sh NAME
.Nm nixos-rebuild
.Nd reconfigure a NixOS machine
.
.
.
.Sh SYNOPSIS
.Nm
.Bro
.Cm switch | boot | test | build | dry-build | dry-activate | edit | repl | build-vm | build-vm-with-bootloader | →build-image→→ →→|→→ →list-generations Op Fl -json
.Brc
.br
.Op Fl -upgrade | -upgrade-all
.Op Fl -install-bootloader
.Op Fl -no-build-nix
.Op Fl -fast
.Op Fl -rollback
.br
.Op Fl -file | f Ar path
.Op Fl -attr | A Ar attrPath
.Op Fl -flake Ar flake-uri
.Op Fl -no-flake
.Op Fl -recreate-lock-file
.Op Fl -no-update-lock-file
.Op Fl -no-write-lock-file
.Op Fl -no-registries
.Op Fl -commit-lock-file
.Op Fl -update-input Ar input-path
.Op Fl -override-input Ar input-path flake-url
.br
.Op Fl -profile-name | p Ar name
.Op Fl -specialisation | c Ar name
.br
.Op Fl →-image-variant→→ →→Ar→→ →→variant→→
→→.br→→
→→.Op→→ →→Fl→→ →-build-host Va host
.Op Fl -target-host Va host
.Op Fl -use-remote-sudo
.Op Fl -no-ssh-tty
.br
.Op Fl -verbose | v
.Op Fl -quiet
.Op Fl -log-format Ar format
.Op Fl -no-build-output | Q
.Op Fl -max-jobs | j Va number
.Op Fl -cores Va number
.Op Fl -keep-going | k
.Op Fl -keep-failed | K
.Op Fl -fallback
.Op Fl I Va NIX_PATH
.Op Fl -option Ar name value
.Op Fl -repair
.Op Fl -builders Va builder-spec
.Op Fl -accept-flake-config
.Op Fl -print-build-logs | L
.Op Fl -show-trace
.Op Fl -refresh
.Op Fl -impure
.Op Fl -offline
.Op Fl -no-net
.
.
.
.Sh DESCRIPTION
This command updates the system so that it corresponds to the
configuration specified in
.Pa /etc/nixos/configuration.nix Ns
,
.Pa /etc/nixos/flake.nix
or the file and attribute specified by the
.Fl -file
and/or
.Fl -attr
options. Thus, every time you modify the configuration or any other NixOS
module, you must run
.Nm
to make the changes take effect. It builds the new system in
.Pa /nix/store Ns
, runs its activation script, and stop and (re)starts any system services if
needed. Please note that user services need to be started manually as they
aren't detected by the activation script at the moment.
.
.Pp
This command has one required argument, which specifies the desired
operation. It must be one of the following:
.Bl -tag -width indent
.It Cm switch
Build and activate the new configuration, and make it the boot default. That
is, the configuration is added to the GRUB boot menu as the default
menu entry, so that subsequent reboots will boot the system into the new
configuration. Previous configurations activated with
.Ic nixos-rebuild switch
or
.Ic nixos-rebuild boot
remain available in the GRUB menu.
.Pp
Note that if you are using specializations, running just
.Ic nixos-rebuild switch
will switch you back to the unspecialized, base system \(em in that case, you
might want to use this instead:
.Bd -literal -offset indent
$ nixos-rebuild switch --specialisation your-specialisation-name
.Ed
.Pp
This command will build all specialisations and make them bootable just
like regular
.Ic nixos-rebuild switch
does \(em the only thing different is that it will switch to given
specialisation instead of the base system; it can be also used to switch from
the base system into a specialised one, or to switch between specialisations.
.
.It Cm boot
Build the new configuration and make it the boot default (as with
.Ic nixos-rebuild switch Ns
), but do not activate it. That is, the system continues to run the previous
configuration until the next reboot.
.
.It Cm test
Build and activate the new configuration, but do not add it to the GRUB
boot menu. Thus, if you reboot the system (or if it crashes), you will
automatically revert to the default configuration (i.e. the
configuration resulting from the last call to
.Ic nixos-rebuild switch
or
.Ic nixos-rebuild boot Ns
).
.Pp
Note that if you are using specialisations, running just
.Ic nixos-rebuild test
will activate the unspecialised, base system \(em in that case, you might want
to use this instead:
.Bd -literal -offset indent
$ nixos-rebuild test --specialisation your-specialisation-name
.Ed
.Pp
This command can be also used to switch from the base system into a
specialised one, or to switch between specialisations.
.
.It Cm build
Build the new configuration, but neither activate it nor add it to the
GRUB boot menu. It leaves a symlink named
.Pa result
in the current directory, which points to the output of the top-level
.Dq system
derivation. This is essentially the same as doing
.Bd -literal -offset indent
$ nix-build /path/to/nixpkgs/nixos -A system
.Ed
.Pp
Note that you do not need to be root to run
.Ic nixos-rebuild build Ns
\&.
.
.It Cm dry-build
Show what store paths would be built or downloaded by any of the
operations above, but otherwise do nothing.
.
.It Cm dry-activate
Build the new configuration, but instead of activating it, show what
changes would be performed by the activation (i.e. by
.Ic nixos-rebuild test Ns
). For instance, this command will print which systemd units would be restarted.
The list of changes is not guaranteed to be complete.
.
.It Cm edit
Opens
.Pa configuration.nix
in the default editor.
.
.It Cm repl
Opens the configuration in
.Ic nix repl Ns .
.
.It Cm build-vm
Build a script that starts a NixOS virtual machine with the desired
configuration. It leaves a symlink
.Pa result
in the current directory that points (under
.Ql result/bin/run\- Ns Va hostname Ns \-vm Ns
)
at the script that starts the VM. Thus, to test a NixOS configuration in
a virtual machine, you should do the following:
.Bd -literal -offset indent
$ nixos-rebuild build-vm
$ ./result/bin/run-*-vm
.Ed
.Pp
The VM is implemented using the
.Ql qemu
package. For best performance, you should load the
.Ql kvm-intel
or
.Ql kvm-amd
kernel modules to get hardware virtualisation.
.Pp
The VM mounts the Nix store of the host through the 9P file system. The
host Nix store is read-only, so Nix commands that modify the Nix store
will not work in the VM. This includes commands such as
.Nm Ns
; to change the VM’s configuration, you must halt the VM and re-run the commands
above.
.Pp
The VM has its own ext3 root file system, which is automatically created when
the VM is first started, and is persistent across reboots of the VM. It is
stored in
.Ql ./ Ns Va hostname Ns .qcow2 Ns
\&.
.\" The entire file system hierarchy of the host is available in
.\" the VM under
.\" .Pa /hostfs Ns
.\" .
.
.It Cm build-vm-with-bootloader
Like
.Cm build-vm Ns
, but boots using the regular boot loader of your configuration (e.g. GRUB 1 or
2), rather than booting directly into the kernel and initial ramdisk of the
system. This allows you to test whether the boot loader works correctly. \
However, it does not guarantee that your NixOS configuration will boot
successfully on the host hardware (i.e., after running
.Ic nixos-rebuild switch Ns
), because the hardware and boot loader configuration in the VM are different.
The boot loader is installed on an automatically generated virtual disk
containing a
.Pa /boot
partition.
.
.It Cm →build-image→→
→→Build→→ →→a→→ →→disk-image→→ →→variant,→→ →→pre-configured→→ →→for→→ →→the→→ →→given→→ →→platform/provider.→→
→→Select→→ →→a→→ →→variant→→ →→with→→ →→the→→
→→.Fl→→ →→--image-variant→→
→→option→→ →→or→→ →→run→→ →→without→→ →→any→→ →→options→→ →→to→→ →→get→→ →→a→→ →→list→→ →→of→→ →→available→→ →→variants.→→
→→.Bd→→ →→-literal→→ →→-offset→→ →→indent→→
→→$→→ →→nixos-rebuild→→ →→build-image→→ →→--image-variant→→ →→proxmox→→
→→.Ed→→
→→.→→
→→.It→→ →→Cm→→ →list-generations Op Fl -json
List the available generations in a similar manner to the boot loader
menu. It shows the generation number, build date and time, NixOS version,
kernel version and the configuration revision.
There is also a json version of output available.
.El
.
.
.
.Sh OPTIONS
.Bl -tag -width indent
.It Fl -upgrade , -upgrade-all
Update the root user's channel named
.Ql nixos
before rebuilding the system.
.Pp
In addition to the
.Ql nixos
channel, the root user's channels which have a file named
.Ql .update-on-nixos-rebuild
in their base directory will also be updated.
.Pp
Passing
.Fl -upgrade-all
updates all of the root user's channels.
.
.It Fl -install-bootloader
Causes the boot loader to be (re)installed on the device specified by the
relevant configuration options.
.
.It Fl -no-build-nix
Normally,
.Nm
first builds the
.Ql nixUnstable
attribute in Nixpkgs, and uses the resulting instance of the Nix package manager
to build the new system configuration. This is necessary if the NixOS modules
use features not provided by the currently installed version of Nix. This option
disables building a new Nix.
.
.It Fl -fast
Equivalent to
.Fl -no-build-nix Ns
\&. This option is useful if you call
.Nm
frequently (e.g. if you’re hacking on a NixOS module).
.
.It Fl -rollback
Instead of building a new configuration as specified by
.Pa /etc/nixos/configuration.nix Ns
, roll back to the previous configuration. (The previous configuration is
defined as the one before the “current” generation of the Nix profile
.Pa /nix/var/nix/profiles/system Ns
\&.)
.
.It Fl -builders Ar builder-spec
Allow ad-hoc remote builders for building the new system. This requires
the user executing
.Nm
(usually root) to be configured as a trusted user in the Nix daemon. This can be
achieved by using the
.Va nix.settings.trusted-users
NixOS option. Examples values for that option are described in the
.Dq Remote builds
chapter in the Nix manual, (i.e.
.Ql --builders \(dqssh://bigbrother x86_64-linux\(dq Ns
). By specifying an empty string existing builders specified in
.Pa /etc/nix/machines
can be ignored:
.Ql --builders \(dq\(dq
for example when they are not reachable due to network connectivity.
.
.It Fl -profile-name Ar name , Fl p Ar name
Instead of using the Nix profile
.Pa /nix/var/nix/profiles/system
to keep track of the current and previous system configurations, use
.Pa /nix/var/nix/profiles/system-profiles/ Ns Va name Ns
\&. When you use GRUB 2, for every system profile created with this flag, NixOS
will create a submenu named
.Dq NixOS - Profile Va name
in GRUB’s boot menu, containing the current and previous configurations of this profile.
.Pp
For instance, if you want to test a configuration file named
.Pa test.nix
without affecting the default system profile, you would do:
.Bd -literal -offset indent
$ nixos-rebuild switch -p test -I nixos-config=./test.nix
.Ed
.Pp
The new configuration will appear in the GRUB 2 submenu
.Dq NixOS - Profile 'test' Ns
\&.
.
.It Fl -specialisation Ar name , Fl c Ar name
Activates given specialisation; when not specified, switching and testing
will activate the base, unspecialised system.→
→→.→→
→→.It→→ →→Fl→→ →→-image-variant→→ →→Ar→→ →→variant→→
→→Selects→→ →→an→→ →→image→→ →→variant→→ →→to→→ →→build→→ →→from→→
→→the→→
→→.Va→→ →→config.system.build.images→→
→→attribute→→ →→of→→ →→the→→ →→given→→ →→configuration.→→ →→A→→ →→list→→ →→of→→ →→variants→→ →→is→→ →→printed→→ →→if→→ →→this→→ →→option→→ →→remains→→ →→unset.→
.
.It Fl -build-host Ar host
Instead of building the new configuration locally, use the specified host
to perform the build. The host needs to be accessible with
.Ic ssh Ns ,
and must be able to perform Nix builds. If the option
.Fl -target-host
is not set, the build will be copied back to the local machine when done.
.Pp
Note that, if
.Fl -no-build-nix
is not specified, Nix will be built both locally and remotely. This is because
the configuration will always be evaluated locally even though the building
might be performed remotely.
.Pp
You can include a remote user name in the host name
.Ns ( Va user@host Ns
). You can also set ssh options by defining the
.Ev NIX_SSHOPTS
environment variable.
.
.It Fl -target-host Ar host
Specifies the NixOS target host. By setting this to something other than an
empty string, the system activation will happen on the remote host instead of
the local machine. The remote host needs to be accessible over
.Ic ssh Ns ,
and for the commands
.Cm switch Ns
,
.Cm boot
and
.Cm test
you need root access.
.Pp
If
.Fl -build-host
is not explicitly specified or empty, building will take place locally.
.Pp
You can include a remote user name in the host name
.Ns ( Va user@host Ns
). You can also set ssh options by defining the
.Ev NIX_SSHOPTS
environment variable.
.Pp
Note that
.Nm
honors the
.Va nixpkgs.crossSystem
setting of the given configuration but disregards the true architecture of the
target host. Hence the
.Va nixpkgs.crossSystem
setting has to match the target platform or else activation will fail.
.
.It Fl -use-substitutes
When set, nixos-rebuild will add
.Fl -use-substitutes
to each invocation of nix-copy-closure. This will only affect the behavior of
nixos-rebuild if
.Fl -target-host
or
.Fl -build-host
is also set. This is useful when the target-host connection to cache.nixos.org
is faster than the connection between hosts.
.
.It Fl -use-remote-sudo
When set, nixos-rebuild prefixes activation commands that run on the
.Fl -target-host
system with
.Ic sudo Ns
\&. Setting this option allows deploying as a non-root user.
.
.It Fl -no-ssh-tty
When set, nixos-rebuild will not request a tty when executing commands on the
.Fl -target-host
system with
.Ic ssh Ns
\&. This may help avoid corrupted terminal output when running multiple
nixos-rebuild commands in parallel, but may also prevent the remote
.Ic sudo
from working properly.
.
.It Fl -file Ar path , Fl f Ar path
Enable and build the NixOS system from the specified file. The file must
evaluate to an attribute set, and it must contain a valid NixOS configuration
at attribute
.Va attrPath Ns
\&. This is useful for building a NixOS system from a nix file that is not
a flake or a NixOS configuration module. Attribute set a with valid NixOS
configuration can be made using
.Va nixos
function in nixpkgs or importing and calling
.Pa nixos/lib/eval-config.nix
from nixpkgs. If specified without
.Fl -attr
option, builds the configuration from the top-level
attribute of the file.
.
.It Fl -attr Ar attrPath , Fl A Ar attrPath
Enable and build the NixOS system from nix file and use the specified attribute
path from file specified by the
.Fl -file
option. If specified without
.Fl -file
option, uses
.Pa default.nix
in current directory.
.
.It Fl -flake Va flake-uri Ns Op Va #name
Build the NixOS system from the specified flake. It defaults to the directory
containing the target of the symlink
.Pa /etc/nixos/flake.nix Ns
, if it exists. The flake must contain an output named
.Ql nixosConfigurations. Ns Va name Ns
\&. If
.Va name
is omitted, it default to the current host name.
.
.It Fl -no-flake
Do not imply
.Fl -flake
if
.Pa /etc/nixos/flake.nix
exists. With this option, it is possible to build non-flake NixOS configurations
even if the current NixOS systems uses flakes.
.El
.Pp
In addition,
.Nm
accepts following options from nix commands that the tool calls:
.
.Pp
flake-related options:
.Bd -offset indent
.Fl -recreate-lock-file Ns ,
.Fl -no-update-lock-file Ns ,
.Fl -no-write-lock-file Ns ,
.Fl -no-registries Ns ,
.Fl -commit-lock-file Ns ,
.Fl -update-input Ar input-path Ns ,
.Fl -override-input Ar input-path flake-url Ns
.Ed
.
.Pp
Builder options:
.Bd -offset indent
.Fl -verbose Ns ,
.Fl v Ns ,
.Fl -quiet Ns ,
.Fl -log-format Ns ,
.Fl -no-build-output Ns ,
.Fl Q Ns ,
.Fl -max-jobs Ns ,
.Fl j Ns ,
.Fl -cores Ns ,
.Fl -keep-going Ns ,
.Fl k Ns ,
.Fl -keep-failed Ns ,
.Fl K Ns ,
.Fl -fallback Ns ,
.Fl I Ns ,
.Fl -option Ns
.Fl -repair Ns ,
.Fl -builders Ns ,
.Fl -accept-flake-config Ns ,
.Fl -print-build-logs Ns ,
.Fl L Ns ,
.Fl -show-trace Ns ,
.Fl -refresh Ns ,
.Fl -impure Ns ,
.Fl -offline Ns ,
.Fl -no-net Ns
.Ed
.
.Pp
See the Nix manual,
.Ic nix flake lock --help
or
.Ic nix-build --help
for details.
.
.
.
.Sh ENVIRONMENT
.Bl -tag -width indent
.It Ev NIXOS_CONFIG
Path to the main NixOS configuration module. Defaults to
.Pa /etc/nixos/configuration.nix Ns
\&.
.
.It Ev NIX_PATH
A colon-separated list of directories used to look up Nix expressions enclosed
in angle brackets (e.g. <nixpkgs>). Example:
.Bd -literal -offset indent
nixpkgs=./my-nixpkgs
.Ed
.
.It Ev NIX_SSHOPTS
Additional options to be passed to
.Ic ssh
on the command line.
.Ed
.
.It Ev NIXOS_SWITCH_USE_DIRTY_ENV
Expose the the current environment variables to post activation scripts. Will
skip usage of
.Ic systemd-run
during system activation. Possibly dangerous, specially in remote environments
(e.g.: via SSH). Will be removed in the future.
.El
.
.
.
.Sh FILES
.Bl -tag -width indent
.It Pa /etc/nixos/flake.nix
If this file exists, then
.Nm
will use it as if the
.Fl -flake
option was given. This file may be a symlink to a
.Pa flake.nix
in an actual flake; thus
.Pa /etc/nixos
need not be a flake.
.
.It Pa /run/current-system
A symlink to the currently active system configuration in the Nix store.
.
.It Pa /nix/var/nix/profiles/system
The Nix profile that contains the current and previous system
configurations. Used to generate the GRUB boot menu.
.El
.
.
.
.Sh BUGS
This command should be renamed to something more descriptive.
.
.
.
.Sh AUTHORS
.An -nosplit
.An Eelco Dolstra
and
.An the Nixpkgs/NixOS contributors
''
• The input source named `nixos-rebuild.sh` differs
''
#! @runtimeShell@
# shellcheck shell=bash
if [ -x "@runtimeShell@" ]; then export SHELL="@runtimeShell@"; fi;
set -e
set -o pipefail
shopt -s inherit_errexit
export PATH=@path@:$PATH
showSyntax() {
exec man nixos-rebuild
exit 1
}
# Parse the command line.
origArgs=("$@")
copyFlags=()
extraBuildFlags=()
lockFlags=()
flakeFlags=(--extra-experimental-features 'nix-command flakes')
action=
buildNix=1
fast=
rollback=
upgrade=
upgrade_all=
profile=/nix/var/nix/profiles/system
specialisation=
→imageVariant=→→
→buildHost=
targetHost=
remoteSudo=
noSSHTTY=
verboseScript=
noFlake=
attr=
buildFile=default.nix
buildingAttribute=1
installBootloader=
json=
# log the given argument to stderr
log() {
echo "$@" >&2
}
while [ "$#" -gt 0 ]; do
i="$1"; shift 1
case "$i" in
--help)
showSyntax
;;
←switch|boot|test|build|edit|repl|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader|list-generations)←→switch|boot|test|build|edit|repl|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader|build-image|list-generations)→
if [ "$i" = dry-run ]; then i=dry-build; fi
if [ "$i" = list-generations ]; then
buildNix=
fast=1
fi
# exactly one action mandatory, bail out if multiple are given
if [ -n "$action" ]; then showSyntax; fi
action="$i"
;;
--file|-f)
if [ -z "$1" ]; then
log "$0: '$i' requires an argument"
exit 1
fi
buildFile="$1"
buildingAttribute=
shift 1
;;
--attr|-A)
if [ -z "$1" ]; then
log "$0: '$i' requires an argument"
exit 1
fi
attr="$1"
buildingAttribute=
shift 1
;;
--install-grub)
log "$0: --install-grub deprecated, use --install-bootloader instead"
installBootloader=1
;;
--install-bootloader)
installBootloader=1
;;
--no-build-nix)
buildNix=
;;
--rollback)
rollback=1
;;
--upgrade)
upgrade=1
;;
--upgrade-all)
upgrade=1
upgrade_all=1
;;
--use-substitutes|--substitute-on-destination|-s)
copyFlags+=("-s")
;;
-I|--builders)
j="$1"; shift 1
extraBuildFlags+=("$i" "$j")
;;
--max-jobs|-j|--cores|--log-format)
j="$1"; shift 1
extraBuildFlags+=("$i" "$j")
copyFlags+=("$i" "$j")
;;
--accept-flake-config|-j*|--quiet|--print-build-logs|-L|--no-build-output|-Q|--show-trace|--refresh|--impure|--offline|--no-net)
extraBuildFlags+=("$i")
;;
--keep-going|-k|--keep-failed|-K|--fallback|--repair)
extraBuildFlags+=("$i")
copyFlags+=("$i")
;;
--verbose|-v|-vv|-vvv|-vvvv|-vvvvv)
verboseScript="true"
extraBuildFlags+=("$i")
copyFlags+=("$i")
;;
--option)
j="$1"; shift 1
k="$1"; shift 1
extraBuildFlags+=("$i" "$j" "$k")
copyFlags+=("$i" "$j" "$k")
;;
--fast)
buildNix=
fast=1
;;
--profile-name|-p)
if [ -z "$1" ]; then
log "$0: ‘--profile-name’ requires an argument"
exit 1
fi
if [ "$1" != system ]; then
profile="/nix/var/nix/profiles/system-profiles/$1"
mkdir -p -m 0755 "$(dirname "$profile")"
fi
shift 1
;;
--specialisation|-c)
if [ -z "$1" ]; then
log "$0: ‘--specialisation’ requires an argument"
exit 1
fi
specialisation="$1"
shift 1
;;
→--image-variant)→→
→→if→→ →→[→→ →→-z→→ →→"$1"→→ →→];→→ →→then→→
→→log→→ →→"$0:→→ →→‘--image-variant’→→ →→requires→→ →→an→→ →→argument"→→
→→exit→→ →→1→→
→→fi→→
→→imageVariant="$1"→→
→→shift→→ →→1→→
→→;;→→
→--build-host)
buildHost="$1"
shift 1
;;
--target-host)
targetHost="$1"
shift 1
;;
--use-remote-sudo)
remoteSudo=1
;;
--no-ssh-tty)
noSSHTTY=1
;;
--flake)
flake="$1"
shift 1
;;
--no-flake)
noFlake=1
;;
--recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file)
lockFlags+=("$i")
;;
--update-input)
j="$1"; shift 1
lockFlags+=("$i" "$j")
;;
--override-input)
j="$1"; shift 1
k="$1"; shift 1
lockFlags+=("$i" "$j" "$k")
;;
--json)
json=1
;;
*)
log "$0: unknown option \`$i'"
exit 1
;;
esac
done
# log the given argument to stderr if verbose mode is on
logVerbose() {
if [ -n "$verboseScript" ]; then
echo "$@" >&2
fi
}
# Run a command, logging it first if verbose mode is on
runCmd() {
logVerbose "$" "$@"
"$@"
}
buildHostCmd() {
local c
if [[ "${useSudo:-x}" = 1 ]]; then
c=("sudo")
else
c=()
fi
if [ -z "$buildHost" ]; then
runCmd "$@"
elif [ -n "$remoteNix" ]; then
runCmd ssh $SSHOPTS "$buildHost" "${c[@]}" env PATH="$remoteNix":'$PATH' "$@"
else
runCmd ssh $SSHOPTS "$buildHost" "${c[@]}" "$@"
fi
}
targetHostCmd() {
local c
if [[ "${useSudo:-x}" = 1 ]]; then
c=("sudo")
else
c=()
fi
if [ -z "$targetHost" ]; then
runCmd "${c[@]}" "$@"
else
runCmd ssh $SSHOPTS "$targetHost" "${c[@]}" "$@"
fi
}
targetHostSudoCmd() {
local t=
if [[ ! "${noSSHTTY:-x}" = 1 ]]; then
t="-t"
fi
if [ -n "$remoteSudo" ]; then
useSudo=1 SSHOPTS="$SSHOPTS $t" targetHostCmd "$@"
else
# While a tty might not be necessary, we apply it to be consistent with
# sudo usage, and an experience that is more consistent with local deployment.
# But if the user really doesn't want it, don't do it.
SSHOPTS="$SSHOPTS $t" targetHostCmd "$@"
fi
}
copyToTarget() {
if ! [ "$targetHost" = "$buildHost" ]; then
if [ -z "$targetHost" ]; then
logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --from "$buildHost" "$1"
elif [ -z "$buildHost" ]; then
logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1"
else
buildHostCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1"
fi
fi
}
nixBuild() {
logVerbose "Building in legacy (non-flake) mode."
if [ -z "$buildHost" ]; then
logVerbose "No --build-host given, running nix-build locally"
runCmd nix-build "$@"
else
logVerbose "buildHost set to \"$buildHost\", running nix-build remotely"
local instArgs=()
local buildArgs=()
local drv=
while [ "$#" -gt 0 ]; do
local i="$1"; shift 1
case "$i" in
-o)
local out="$1"; shift 1
buildArgs+=("--add-root" "$out" "--indirect")
;;
-A)
local j="$1"; shift 1
instArgs+=("$i" "$j")
;;
-I) # We don't want this in buildArgs
shift 1
;;
--no-out-link) # We don't want this in buildArgs
;;
"<"*) # nix paths
instArgs+=("$i")
;;
*)
buildArgs+=("$i")
;;
esac
done
if [[ -z $buildingAttribute ]]; then
instArgs+=("$buildFile")
fi
drv="$(runCmd nix-instantiate "${instArgs[@]}" "${extraBuildFlags[@]}")"
if [ -a "$drv" ]; then
logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure --to "$buildHost" "$drv"
buildHostCmd nix-store -r "$drv" "${buildArgs[@]}"
else
log "nix-instantiate failed"
exit 1
fi
fi
}
nixFlakeBuild() {
logVerbose "Building in flake mode."
if [[ -z "$buildHost" && -z "$targetHost" && "$action" != switch && "$action" != boot && "$action" != test && "$action" != dry-activate ]]
then
runCmd nix "${flakeFlags[@]}" build "$@"
readlink -f ./result
elif [ -z "$buildHost" ]; then
runCmd nix "${flakeFlags[@]}" build "$@" --out-link "${tmpDir}/result"
readlink -f "${tmpDir}/result"
else
local attr="$1"
shift 1
local evalArgs=()
local buildArgs=()
local drv=
while [ "$#" -gt 0 ]; do
local i="$1"; shift 1
case "$i" in
--recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file)
evalArgs+=("$i")
;;
--update-input)
local j="$1"; shift 1
evalArgs+=("$i" "$j")
;;
--override-input)
local j="$1"; shift 1
local k="$1"; shift 1
evalArgs+=("$i" "$j" "$k")
;;
--impure) # We don't want this in buildArgs, it's only needed at evaluation time, and unsupported during realisation
;;
*)
buildArgs+=("$i")
;;
esac
done
drv="$(runCmd nix "${flakeFlags[@]}" eval --raw "${attr}.drvPath" "${evalArgs[@]}" "${extraBuildFlags[@]}")"
if [ -a "$drv" ]; then
logVerbose "Running nix with these NIX_SSHOPTS: $SSHOPTS"
NIX_SSHOPTS=$SSHOPTS runCmd nix "${flakeFlags[@]}" copy "${copyFlags[@]}" --derivation --to "ssh://$buildHost" "$drv"
buildHostCmd nix-store -r "$drv" "${buildArgs[@]}"
else
log "nix eval failed"
exit 1
fi
fi
}
if [ -z "$action" ]; then showSyntax; fi
# Only run shell scripts from the Nixpkgs tree if the action is
# "switch", "boot", or "test". With other actions (such as "build"),
# the user may reasonably expect that no code from the Nixpkgs tree is
# executed, so it's safe to run nixos-rebuild against a potentially
# untrusted tree.
canRun=
if [[ "$action" = switch || "$action" = boot || "$action" = test ]]; then
canRun=1
fi
# Verify that user is not trying to use attribute building and flake
# at the same time
if [[ -z $buildingAttribute && -n $flake ]]; then
log "error: '--flake' cannot be used with '--file' or '--attr'"
exit 1
fi
# If ‘--upgrade’ or `--upgrade-all` is given,
# run ‘nix-channel --update nixos’.
if [[ -n $upgrade && -z $_NIXOS_REBUILD_REEXEC && -z $flake ]]; then
# If --upgrade-all is passed, or there are other channels that
# contain a file called ".update-on-nixos-rebuild", update them as
# well. Also upgrade the nixos channel.
for channelpath in /nix/var/nix/profiles/per-user/root/channels/*; do
channel_name=$(basename "$channelpath")
if [[ "$channel_name" == "nixos" ]]; then
runCmd nix-channel --update "$channel_name"
elif [ -e "$channelpath/.update-on-nixos-rebuild" ]; then
runCmd nix-channel --update "$channel_name"
elif [[ -n $upgrade_all ]] ; then
runCmd nix-channel --update "$channel_name"
fi
done
fi
# Make sure that we use the Nix package we depend on, not something
# else from the PATH for nix-{env,instantiate,build}. This is
# important, because NixOS defaults the architecture of the rebuilt
# system to the architecture of the nix-* binaries used. So if on an
# amd64 system the user has an i686 Nix package in her PATH, then we
# would silently downgrade the whole system to be i686 NixOS on the
# next reboot.
if [ -z "$_NIXOS_REBUILD_REEXEC" ]; then
export PATH=@nix@/bin:$PATH
fi
# Use /etc/nixos/flake.nix if it exists. It can be a symlink to the
# actual flake.
if [[ -z $flake && -e /etc/nixos/flake.nix && -z $noFlake ]]; then
flake="$(dirname "$(readlink -f /etc/nixos/flake.nix)")"
fi
tmpDir=$(mktemp -t -d nixos-rebuild.XXXXXX)
if [[ ${#tmpDir} -ge 60 ]]; then
# Very long tmp dirs lead to "too long for Unix domain socket"
# SSH ControlPath errors. Especially macOS sets long TMPDIR paths.
rmdir "$tmpDir"
tmpDir=$(TMPDIR= mktemp -t -d nixos-rebuild.XXXXXX)
fi
cleanup() {
for ctrl in "$tmpDir"/ssh-*; do
ssh -o ControlPath="$ctrl" -O exit dummyhost 2>/dev/null || true
done
rm -rf "$tmpDir"
}
trap cleanup EXIT
SSHOPTS="$NIX_SSHOPTS -o ControlMaster=auto -o ControlPath=$tmpDir/ssh-%n -o ControlPersist=60"
# For convenience, use the hostname as the default configuration to
# build from the flake.
if [[ -n $flake ]]; then
if [[ $flake =~ ^(.*)\#([^\#\"]*)$ ]]; then
flake="${BASH_REMATCH[1]}"
flakeAttr="${BASH_REMATCH[2]}"
fi
if [[ -z $flakeAttr ]]; then
hostname="$(targetHostCmd cat /proc/sys/kernel/hostname)"
if [[ -z $hostname ]]; then
hostname=default
fi
flakeAttr="nixosConfigurations.\"$hostname\""
else
flakeAttr="nixosConfigurations.\"$flakeAttr\""
fi
fi
if [[ ! -z "$specialisation" && ! "$action" = switch && ! "$action" = test ]]; then
log "error: ‘--specialisation’ can only be used with ‘switch’ and ‘test’"
exit 1
fi
# Re-execute nixos-rebuild from the Nixpkgs tree.
if [[ -z $_NIXOS_REBUILD_REEXEC && -n $canRun && -z $fast ]]; then
if [[ -z $buildingAttribute ]]; then
p=$(runCmd nix-build --no-out-link $buildFile -A "${attr:+$attr.}config.system.build.nixos-rebuild" "${extraBuildFlags[@]}")
SHOULD_REEXEC=1
elif [[ -z $flake ]]; then
if p=$(runCmd nix-build --no-out-link --expr 'with import <nixpkgs/nixos> {}; config.system.build.nixos-rebuild' "${extraBuildFlags[@]}"); then
SHOULD_REEXEC=1
fi
else
runCmd nix "${flakeFlags[@]}" build --out-link "${tmpDir}/nixos-rebuild" "$flake#$flakeAttr.config.system.build.nixos-rebuild" "${extraBuildFlags[@]}" "${lockFlags[@]}"
if p=$(readlink -e "${tmpDir}/nixos-rebuild"); then
SHOULD_REEXEC=1
fi
fi
if [[ -n $SHOULD_REEXEC ]]; then
export _NIXOS_REBUILD_REEXEC=1
# Manually call cleanup as the EXIT trap is not triggered when using exec
cleanup
runCmd exec "$p/bin/nixos-rebuild" "${origArgs[@]}"
exit 1
fi
fi
# Find configuration.nix and open editor instead of building.
if [ "$action" = edit ]; then
if [[ -z $buildingAttribute ]]; then
log "error: '--file' and '--attr' are not supported with 'edit'"
exit 1
elif [[ -z $flake ]]; then
NIXOS_CONFIG=${NIXOS_CONFIG:-$(runCmd nix-instantiate --find-file nixos-config)}
if [[ -d $NIXOS_CONFIG ]]; then
NIXOS_CONFIG=$NIXOS_CONFIG/default.nix
fi
runCmd exec ${EDITOR:-nano} "$NIXOS_CONFIG"
else
runCmd exec nix "${flakeFlags[@]}" edit "${lockFlags[@]}" -- "$flake#$flakeAttr"
fi
exit 1
fi
# First build Nix, since NixOS may require a newer version than the
# current one.
if [[ -n "$rollback" || "$action" = dry-build ]]; then
buildNix=
fi
nixSystem() {
machine="$(uname -m)"
if [[ "$machine" =~ i.86 ]]; then
machine=i686
fi
echo $machine-linux
}
prebuiltNix() {
machine="$1"
if [ "$machine" = x86_64 ]; then
echo @nix_x86_64_linux@
elif [[ "$machine" =~ i.86 ]]; then
echo @nix_i686_linux@
elif [[ "$machine" = aarch64 ]]; then
echo @nix_aarch64_linux@
else
log "$0: unsupported platform"
exit 1
fi
}
getNixDrv() {
nixDrv=
if [[ -z $buildingAttribute ]]; then
if nixDrv="$(runCmd nix-instantiate $buildFile --add-root "$tmpDir/nix.drv" --indirect -A ${attr:+$attr.}config.nix.package.out "${extraBuildFlags[@]}")"; then return; fi
fi
if nixDrv="$(runCmd nix-instantiate '<nixpkgs/nixos>' --add-root "$tmpDir/nix.drv" --indirect -A config.nix.package.out "${extraBuildFlags[@]}")"; then return; fi
if nixDrv="$(runCmd nix-instantiate '<nixpkgs>' --add-root "$tmpDir/nix.drv" --indirect -A nix "${extraBuildFlags[@]}")"; then return; fi
if ! nixStorePath="$(runCmd nix-instantiate --eval '<nixpkgs/nixos/modules/installer/tools/nix-fallback-paths.nix>' -A "$(nixSystem)" | sed -e 's/^"//' -e 's/"$//')"; then
nixStorePath="$(prebuiltNix "$(uname -m)")"
fi
if ! runCmd nix-store -r "$nixStorePath" --add-root "${tmpDir}/nix" --indirect \
--option extra-binary-caches https://cache.nixos.org/; then
log "warning: don't know how to get latest Nix"
fi
# Older version of nix-store -r don't support --add-root.
[ -e "$tmpDir/nix" ] || ln -sf "$nixStorePath" "$tmpDir/nix"
if [ -n "$buildHost" ]; then
remoteNixStorePath="$(runCmd prebuiltNix "$(buildHostCmd uname -m)")"
remoteNix="$remoteNixStorePath/bin"
if ! buildHostCmd nix-store -r "$remoteNixStorePath" \
--option extra-binary-caches https://cache.nixos.org/ >/dev/null; then
remoteNix=
log "warning: don't know how to get latest Nix"
fi
fi
}
getVersion() {
local dir="$1"
local rev=
local gitDir="$dir/.git"
if [ -e "$gitDir" ]; then
if [ -z "$(type -P git)" ]; then
echo "warning: Git not found; cannot figure out revision of $dir" >&2
return
fi
cd "$dir"
rev=$(git --git-dir="$gitDir" rev-parse --short HEAD)
if git --git-dir="$gitDir" describe --always --dirty | grep -q dirty; then
rev+=M
fi
fi
if [ -n "$rev" ]; then
echo ".git.$rev"
fi
}
if [[ -n $buildNix && -z $flake ]]; then
log "building Nix..."
getNixDrv
if [ -a "$nixDrv" ]; then
nix-store -r "$nixDrv"'!'"out" --add-root "$tmpDir/nix" --indirect >/dev/null
if [ -n "$buildHost" ]; then
nix-copy-closure "${copyFlags[@]}" --to "$buildHost" "$nixDrv"
# The nix build produces multiple outputs, we add them all to the remote path
for p in $(buildHostCmd nix-store -r "$(readlink "$nixDrv")" "${buildArgs[@]}"); do
remoteNix="$remoteNix${remoteNix:+:}$p/bin"
done
fi
fi
PATH="$tmpDir/nix/bin:$PATH"
fi
# Update the version suffix if we're building from Git (so that
# nixos-version shows something useful).
if [[ -n $canRun && -z $flake ]]; then
if nixpkgs=$(runCmd nix-instantiate --find-file nixpkgs "${extraBuildFlags[@]}"); then
suffix=$(getVersion "$nixpkgs" || true)
if [ -n "$suffix" ]; then
echo -n "$suffix" > "$nixpkgs/.version-suffix" || true
fi
fi
fi
if [ "$action" = dry-build ]; then
extraBuildFlags+=(--dry-run)
fi
if [ "$action" = repl ]; then
# This is a very end user command, implemented using sub-optimal means.
# You should feel free to improve its behavior, as well as resolve tech
# debt in "breaking" ways. Humans adapt quite well.
if [[ -z $buildingAttribute ]]; then
exec nix repl --file $buildFile $attr "${extraBuildFlags[@]}"
elif [[ -z $flake ]]; then
exec nix repl --file '<nixpkgs/nixos>' "${extraBuildFlags[@]}"
else
if [[ -n "${lockFlags[0]}" ]]; then
# nix repl itself does not support locking flags
log "nixos-rebuild repl does not support locking flags yet"
exit 1
fi
d='$'
q='"'
bold="$(echo -e '\033[1m')"
blue="$(echo -e '\033[34;1m')"
attention="$(echo -e '\033[35;1m')"
reset="$(echo -e '\033[0m')"
if [[ -e $flake ]]; then
flakePath=$(realpath "$flake")
else
flakePath=$flake
fi
# This nix repl invocation is impure, because usually the flakeref is.
# For a solution that preserves the motd and custom scope, we need
# something like https://github.com/NixOS/nix/issues/8679.
exec nix repl --impure --expr "
let flake = builtins.getFlake ''$flakePath'';
configuration = flake.$flakeAttr;
motd = ''
$d{$q\n$q}
Hello and welcome to the NixOS configuration
$flakeAttr
in $flake
The following is loaded into nix repl's scope:
- ${blue}config${reset} All option values
- ${blue}options${reset} Option data and metadata
- ${blue}pkgs${reset} Nixpkgs package set
- ${blue}lib${reset} Nixpkgs library functions
- other module arguments
- ${blue}flake${reset} Flake outputs, inputs and source info of $flake
Use tab completion to browse around ${blue}config${reset}.
Use ${bold}:r${reset} to ${bold}reload${reset} everything after making a change in the flake.
(assuming $flake is a mutable flake ref)
See ${bold}:?${reset} for more repl commands.
${attention}warning:${reset} nixos-rebuild repl does not currently enforce pure evaluation.
'';
scope =
assert configuration._type or null == ''configuration'';
assert configuration.class or ''nixos'' == ''nixos'';
configuration._module.args //
configuration._module.specialArgs //
{
inherit (configuration) config options;
lib = configuration.lib or configuration.pkgs.lib;
inherit flake;
};
in builtins.seq scope builtins.trace motd scope
" "${extraBuildFlags[@]}"
fi
fi
if [ "$action" = list-generations ]; then
if [ ! -L "$profile" ]; then
log "No profile \`$(basename "$profile")' found"
exit 1
fi
generation_from_dir() {
generation_dir="$1"
generation_base="$(basename "$generation_dir")" # Has the format "system-123-link" for generation 123
no_link_gen="${generation_base%-link}" # remove the "-link"
echo "${no_link_gen##*-}" # remove everything before the last dash
}
describe_generation(){
generation_dir="$1"
generation_number="$(generation_from_dir "$generation_dir")"
nixos_version="$(cat "$generation_dir/nixos-version" 2> /dev/null || echo "Unknown")"
kernel_dir="$(dirname "$(realpath "$generation_dir/kernel")")"
kernel_version="$(ls "$kernel_dir/lib/modules" || echo "Unknown")"
configurationRevision="$("$generation_dir/sw/bin/nixos-version" --configuration-revision 2> /dev/null || true)"
# Old nixos-version output ignored unknown flags and just printed the version
# therefore the following workaround is done not to show the default output
nixos_version_default="$("$generation_dir/sw/bin/nixos-version")"
if [ "$configurationRevision" == "$nixos_version_default" ]; then
configurationRevision=""
fi
# jq automatically quotes the output => don't try to quote it in output!
build_date="$(stat "$generation_dir" --format=%W | jq 'todate')"
pushd "$generation_dir/specialisation/" > /dev/null || :
specialisation_list=(*)
popd > /dev/null || :
specialisations="$(jq --compact-output --null-input '$ARGS.positional' --args -- "${specialisation_list[@]}")"
if [ "$(basename "$generation_dir")" = "$(readlink "$profile")" ]; then
current_generation_tag="true"
else
current_generation_tag="false"
fi
# Escape userdefined strings
nixos_version="$(jq -aR <<< "$nixos_version")"
kernel_version="$(jq -aR <<< "$kernel_version")"
configurationRevision="$(jq -aR <<< "$configurationRevision")"
cat << EOF
{
"generation": $generation_number,
"date": $build_date,
"nixosVersion": $nixos_version,
"kernelVersion": $kernel_version,
"configurationRevision": $configurationRevision,
"specialisations": $specialisations,
"current": $current_generation_tag
}
EOF
}
find "$(dirname "$profile")" -regex "$profile-[0-9]+-link" |
sort -Vr |
while read -r generation_dir; do
describe_generation "$generation_dir"
done |
if [ -z "$json" ]; then
jq --slurp -r '.[] | [
([.generation, (if .current == true then "current" else "" end)] | join(" ")),
(.date | fromdate | strflocaltime("%Y-%m-%d %H:%M:%S")),
.nixosVersion, .kernelVersion, .configurationRevision,
(.specialisations | join(" "))
] | @tsv' |
column --separator $'\t' --table --table-columns "Generation,Build-date,NixOS version,Kernel,Configuration Revision,Specialisation"
else
jq --slurp .
fi
exit 0
fi
# Either upgrade the configuration in the system profile (for "switch"
# or "boot"), or just build it and create a symlink "result" in the
# current directory (for "build" and "test").
if [ -z "$rollback" ]; then
log "building the system configuration..."
if [[ "$action" = switch || "$action" = boot ]]; then
if [[ -z $buildingAttribute ]]; then
pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.toplevel" "${extraBuildFlags[@]}")"
elif [[ -z $flake ]]; then
pathToConfig="$(nixBuild '<nixpkgs/nixos>' --no-out-link -A system "${extraBuildFlags[@]}")"
else
pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
fi
copyToTarget "$pathToConfig"
targetHostSudoCmd nix-env -p "$profile" --set "$pathToConfig"
elif [[ "$action" = test || "$action" = build || "$action" = dry-build || "$action" = dry-activate ]]; then
if [[ -z $buildingAttribute ]]; then
pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.toplevel" "${extraBuildFlags[@]}")"
elif [[ -z $flake ]]; then
pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}")"
else
pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
fi
elif [ "$action" = build-vm ]; then
if [[ -z $buildingAttribute ]]; then
pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.vm" "${extraBuildFlags[@]}")"
elif [[ -z $flake ]]; then
pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vm -k "${extraBuildFlags[@]}")"
else
pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.vm" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
fi
elif [ "$action" = build-vm-with-bootloader ]; then
if [[ -z $buildingAttribute ]]; then
pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.vmWithBootLoader" "${extraBuildFlags[@]}")"
elif [[ -z $flake ]]; then
pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vmWithBootLoader -k "${extraBuildFlags[@]}")"
else
pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.vmWithBootLoader" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
fi
→elif→→ →→[→→ →→"$action"→→ →→=→→ →→build-image→→ →→];→→ →→then→→
→→if→→ →→[[→→ →→-z→→ →→$buildingAttribute→→ →→]];→→ →→then→→
→→variants="$(→→
→→runCmd→→ →→nix-instantiate→→ →→--eval→→ →→--strict→→ →→--json→→ →→--expr→→ →→\→→
→→"let→→
→→value→→ →→=→→ →→import→→ →→\"$(realpath→→ →→$buildFile)\";→→
→→set→→ →→=→→ →→if→→ →→builtins.isFunction→→ →→value→→ →→then→→ →→value→→ →→{}→→ →→else→→ →→value;→→
→→in→→ →→builtins.mapAttrs→→ →→(n:→→ →→v:→→ →→v.passthru.filePath)→→ →→set.${attr:+$attr.}config.system.build.images"→→ →→\→→
→→"${extraBuildFlags[@]}"→→
→→)"→→
→→elif→→ →→[[→→ →→-z→→ →→$flake→→ →→]];→→ →→then→→
→→variants="$(→→
→→runCmd→→ →→nix-instantiate→→ →→--eval→→ →→--strict→→ →→--json→→ →→--expr→→ →→\→→
→→"with→→ →→import→→ →→<nixpkgs/nixos>→→ →→{};→→ →→builtins.mapAttrs→→ →→(n:→→ →→v:→→ →→v.passthru.filePath)→→ →→config.system.build.images"→→ →→\→→
→→"${extraBuildFlags[@]}"→→
→→)"→→
→→else→→
→→variants="$(→→
→→runCmd→→ →→nix→→ →→"${flakeFlags[@]}"→→ →→eval→→ →→--json→→ →→\→→
→→"$flake#$flakeAttr.config.system.build.images"→→ →→\→→
→→--apply→→ →→"builtins.mapAttrs→→ →→(n:→→ →→v:→→ →→v.passthru.filePath)"→→ →→"${evalArgs[@]}"→→ →→"${extraBuildFlags[@]}"→→
→→)"→→
→→fi→→
→→if→→ →→!→→ →→echo→→ →→"$variants"→→ →→|→→ →→jq→→ →→-e→→ →→--arg→→ →→variant→→ →→"$imageVariant"→→ →→"keys→→ →→|→→ →→any(.→→ →→==→→ →→\$variant)"→→ →→>→→ →→/dev/null;→→ →→then→→
→→echo→→ →→-e→→ →→"Please→→ →→specify→→ →→one→→ →→of→→ →→the→→ →→following→→ →→supported→→ →→image→→ →→variants→→ →→via→→ →→--image-variant:\n"→→ →→>&2→→
→→echo→→ →→"$variants"→→ →→|→→ →→jq→→ →→-r→→ →→'.→→ →→|→→ →→keys→→ →→|→→ →→join→→ →→("\n")'→→
→→exit→→ →→1→→
→→fi→→
→→imageName="$(echo→→ →→"$variants"→→ →→|→→ →→jq→→ →→-r→→ →→--arg→→ →→variant→→ →→"$imageVariant"→→ →→".[\$variant]")"→→
→→if→→ →→[[→→ →→-z→→ →→$buildingAttribute→→ →→]];→→ →→then→→
→→pathToConfig="$(nixBuild→→ →→$buildFile→→ →→-A→→ →→"${attr:+$attr.}config.system.build.images.${imageVariant}"→→ →→"${extraBuildFlags[@]}")"→→
→→elif→→ →→[[→→ →→-z→→ →→$flake→→ →→]];→→ →→then→→
→→pathToConfig="$(nixBuild→→ →→'<nixpkgs/nixos>'→→ →→-A→→ →→config.system.build.images.${imageVariant}→→ →→-k→→ →→"${extraBuildFlags[@]}")"→→
→→else→→
→→pathToConfig="$(nixFlakeBuild→→ →→"$flake#$flakeAttr.config.system.build.images.${imageVariant}"→→ →→"${extraBuildFlags[@]}"→→ →→"${lockFlags[@]}")"→→
→→fi→→
→else
showSyntax
fi
# Copy build to target host if we haven't already done it
if ! [[ "$action" = switch || "$action" = boot ]]; then
copyToTarget "$pathToConfig"
fi
else # [ -n "$rollback" ]
if [[ "$action" = switch || "$action" = boot ]]; then
targetHostSudoCmd nix-env --rollback -p "$profile"
pathToConfig="$profile"
elif [[ "$action" = test || "$action" = build ]]; then
systemNumber=$(
targetHostCmd nix-env -p "$profile" --list-generations |
sed -n '/current/ {g; p;}; s/ *\([0-9]*\).*/\1/; h'
)
pathToConfig="$profile"-${systemNumber}-link
if [ -z "$targetHost" ]; then
ln -sT "$pathToConfig" ./result
fi
else
showSyntax
fi
fi
# If we're not just building, then make the new configuration the boot
# default and/or activate it now.
if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" = dry-activate ]]; then
# Using systemd-run here to protect against PTY failures/network
# disconnections during rebuild.
# See: https://github.com/NixOS/nixpkgs/issues/39118
cmd=(
"systemd-run"
"-E" "LOCALE_ARCHIVE" # Will be set to new value early in switch-to-configuration script, but interpreter starts out with old value
"-E" "NIXOS_INSTALL_BOOTLOADER=$installBootloader"
"--collect"
"--no-ask-password"
"--pipe"
"--quiet"
"--service-type=exec"
"--unit=nixos-rebuild-switch-to-configuration"
"--wait"
)
# Check if we have a working systemd-run. In chroot environments we may have
# a non-working systemd, so we fallback to not using systemd-run.
# You may also want to explicitly set NIXOS_SWITCH_USE_DIRTY_ENV environment
# variable, since systemd-run runs inside an isolated environment and
# this may break some post-switch scripts. However keep in mind that this
# may be dangerous in remote access (e.g. SSH).
if [[ -n "$NIXOS_SWITCH_USE_DIRTY_ENV" ]]; then
log "warning: skipping systemd-run since NIXOS_SWITCH_USE_DIRTY_ENV is set. This environment variable will be ignored in the future"
cmd=("env" "NIXOS_INSTALL_BOOTLOADER=$installBootloader")
elif ! targetHostSudoCmd "${cmd[@]}" true; then
logVerbose "Skipping systemd-run to switch configuration since it is not working in target host."
cmd=(
"env"
"-i"
"LOCALE_ARCHIVE=$LOCALE_ARCHIVE"
"NIXOS_INSTALL_BOOTLOADER=$installBootloader"
)
else
logVerbose "Using systemd-run to switch configuration."
fi
if [[ -z "$specialisation" ]]; then
cmd+=("$pathToConfig/bin/switch-to-configuration")
else
cmd+=("$pathToConfig/specialisation/$specialisation/bin/switch-to-configuration")
if [ -z "$targetHost" ]; then
specialisationExists=$(test -f "${cmd[-1]}")
else
specialisationExists=$(targetHostCmd test -f "${cmd[-1]}")
fi
if ! $specialisationExists; then
log "error: specialisation not found: $specialisation"
exit 1
fi
fi
if ! targetHostSudoCmd "${cmd[@]}" "$action"; then
log "warning: error(s) occurred while switching to the new configuration"
exit 1
fi
fi
if [[ "$action" = build-vm || "$action" = build-vm-with-bootloader ]]; then
cat >&2 <<EOF
Done. The virtual machine can be started by running $(echo "${pathToConfig}/bin/"run-*-vm)
EOF→
→→fi→→
→→if→→ →→[[→→ →→"$action"→→ →→=→→ →→build-image→→ →→]];→→ →→then→→
→→echo→→ →→-n→→ →→"Done.→→ →→The→→ →→disk→→ →→image→→ →→can→→ →→be→→ →→found→→ →→in→→ →→"→→ →→>&2→→
→→echo→→ →→"${pathToConfig}/${imageName}"→
fi
''
• The environments do not match:
postInstall=''
installManPage ←/nix/store/6rnxc38y8lbg6q0pfz3x6xc5qgff39ys-nixos-rebuild.8←→/nix/store/d6krrc888446800q4f7isvh20hrrpnyf-nixos-rebuild.8→
installShellCompletion \
--bash /nix/store/bakmakyqdlm8dnmzzk7w64n3zyq95hdl-_nixos-rebuild
''
src=''
←/nix/store/r77ynxfmdk39xs6fnszyk3y7ga0wl453-nixos-rebuild.sh←→/nix/store/hi01gjxrszidyadlxjmfiaf7x9qvia8v-nixos-rebuild.sh→
''
• Skipping environment comparison
• Skipping environment comparison
• The input derivation named `system-path` differs
• These two derivations have already been compared
• The input derivation named `system-units` differs
- /nix/store/w89jgsgy3xim24w1x3j4iybnn0mdqdm6-system-units.drv:{out}
+ /nix/store/frw2jjli3xbfcq3q2nz53s9a2hrh2dxn-system-units.drv:{out}
• The input derivation named `unit-dbus.service` differs
- /nix/store/a9msixmbin74rlzngi1cgrdj6z07dkbm-unit-dbus.service.drv:{out}
+ /nix/store/m5jz0jpdisgg5y186m4kwnzxrx86mkz7-unit-dbus.service.drv:{out}
• The input derivation named `X-Restart-Triggers-dbus` differs
- /nix/store/q9kwzsmyd6x94ann24d9bb595m6v27kl-X-Restart-Triggers-dbus.drv:{out}
+ /nix/store/pynz3b3n4qm2l3ma5kv7hfkf3fziq3l4-X-Restart-Triggers-dbus.drv:{out}
• The input derivation named `dbus-1` differs
• These two derivations have already been compared
• Skipping environment comparison
• Skipping environment comparison
• Skipping environment comparison
• The input derivation named `user-units` differs
- /nix/store/g3da2qx1mj2dyi7prxq79pvffnwrxh1q-user-units.drv:{out}
+ /nix/store/binjgmvksk1jzr664bgqgc783srf1ld2-user-units.drv:{out}
• The input derivation named `unit-dbus.service` differs
- /nix/store/fb036h5bm1z3wax0r2h606d9jhq5imsr-unit-dbus.service.drv:{out}
+ /nix/store/i4ys3l0x4qcyqy2b5xaw8agsj87icb8k-unit-dbus.service.drv:{out}
• The input derivation named `X-Restart-Triggers-dbus` differs
• These two derivations have already been compared
• Skipping environment comparison
• Skipping environment comparison
• Skipping environment comparison
• The input derivation named `system-path` differs
• These two derivations have already been compared
• Skipping environment comparison
• Skipping environment comparison
• The input derivation named `isolinux.cfg` differs
- /nix/store/rl0hqa8rnp13k9vdk67vk1qb2nkpjfgp-isolinux.cfg.drv:{out}
+ /nix/store/m58kx012r4kcn6b9svpgqbjc00sv91lj-isolinux.cfg.drv:{out}
• The input derivation named `isolinux.cfg-in` differs
- /nix/store/c8jnpvzzqmc8rrcyaw5ijjsafkwv97w0-isolinux.cfg-in.drv:{out}
+ /nix/store/ggw5822hlpwf8h9j0phycn1hi8iih3zl-isolinux.cfg-in.drv:{out}
• The input derivation named `nixos-system-nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
• Skipping environment comparison
• Skipping environment comparison
iso-installer
- result/master/iso-installer:{out}
+ result/new/iso-installer:{out}
• The input derivation named `closure-info` differs
- /nix/store/sj5ja2430d8sy48a2ipi5f3f8nsd4943-closure-info.drv:{out}
+ /nix/store/7m0a5ywr8li7nxq3a2cpsdivl9gch3vs-closure-info.drv:{out}
• The input derivation named `nixos-system-nixos-25.05pre-git` differs
- /nix/store/f5syc17hn75zi7mfqk6fn1lwjg8dzwpp-nixos-system-nixos-25.05pre-git.drv:{out}
+ /nix/store/650p7f3w268855l5nsn99941xzz4693g-nixos-system-nixos-25.05pre-git.drv:{out}
• The input derivation named `etc` differs
- /nix/store/xv4p4s7irw51nlfdniyi7h0a8c6mcbk8-etc.drv:{out}
+ /nix/store/l24x5mql3yapd377dn1dj0iqzscilaqq-etc.drv:{out}
• The input derivation named `dbus-1` differs
- /nix/store/sawcw3llmgpmwi6x4sn8injr2qlzmn9b-dbus-1.drv:{out}
+ /nix/store/0416z1s8gqbrnqnkbghjan9qs5aypjjj-dbus-1.drv:{out}
• The input derivation named `system-path` differs
- /nix/store/i70xfqhq0cgzb9fr5d1zzfv03bjp7wxw-system-path.drv:{out}
+ /nix/store/d2jl2mpimjmwjzvlslv5b0yv9zrsfhp1-system-path.drv:{out}
• The input derivation named `nixos-rebuild` differs
- /nix/store/x8w3s72v1nd6r830pkcnai0vrllrzwjx-nixos-rebuild.drv:{out}
+ /nix/store/yb5jb0wpglskm5kfwzv5nfjbhnqwxz18-nixos-rebuild.drv:{out}
• The input source named `nixos-rebuild.8` differs
''
.Dd January 1, 1980
.Dt nixos-rebuild 8
.Os
.Sh NAME
.Nm nixos-rebuild
.Nd reconfigure a NixOS machine
.
.
.
.Sh SYNOPSIS
.Nm
.Bro
.Cm switch | boot | test | build | dry-build | dry-activate | edit | repl | build-vm | build-vm-with-bootloader | →build-image→→ →→|→→ →list-generations Op Fl -json
.Brc
.br
.Op Fl -upgrade | -upgrade-all
.Op Fl -install-bootloader
.Op Fl -no-build-nix
.Op Fl -fast
.Op Fl -rollback
.br
.Op Fl -file | f Ar path
.Op Fl -attr | A Ar attrPath
.Op Fl -flake Ar flake-uri
.Op Fl -no-flake
.Op Fl -recreate-lock-file
.Op Fl -no-update-lock-file
.Op Fl -no-write-lock-file
.Op Fl -no-registries
.Op Fl -commit-lock-file
.Op Fl -update-input Ar input-path
.Op Fl -override-input Ar input-path flake-url
.br
.Op Fl -profile-name | p Ar name
.Op Fl -specialisation | c Ar name
.br
.Op Fl →-image-variant→→ →→Ar→→ →→variant→→
→→.br→→
→→.Op→→ →→Fl→→ →-build-host Va host
.Op Fl -target-host Va host
.Op Fl -use-remote-sudo
.Op Fl -no-ssh-tty
.br
.Op Fl -verbose | v
.Op Fl -quiet
.Op Fl -log-format Ar format
.Op Fl -no-build-output | Q
.Op Fl -max-jobs | j Va number
.Op Fl -cores Va number
.Op Fl -keep-going | k
.Op Fl -keep-failed | K
.Op Fl -fallback
.Op Fl I Va NIX_PATH
.Op Fl -option Ar name value
.Op Fl -repair
.Op Fl -builders Va builder-spec
.Op Fl -accept-flake-config
.Op Fl -print-build-logs | L
.Op Fl -show-trace
.Op Fl -refresh
.Op Fl -impure
.Op Fl -offline
.Op Fl -no-net
.
.
.
.Sh DESCRIPTION
This command updates the system so that it corresponds to the
configuration specified in
.Pa /etc/nixos/configuration.nix Ns
,
.Pa /etc/nixos/flake.nix
or the file and attribute specified by the
.Fl -file
and/or
.Fl -attr
options. Thus, every time you modify the configuration or any other NixOS
module, you must run
.Nm
to make the changes take effect. It builds the new system in
.Pa /nix/store Ns
, runs its activation script, and stop and (re)starts any system services if
needed. Please note that user services need to be started manually as they
aren't detected by the activation script at the moment.
.
.Pp
This command has one required argument, which specifies the desired
operation. It must be one of the following:
.Bl -tag -width indent
.It Cm switch
Build and activate the new configuration, and make it the boot default. That
is, the configuration is added to the GRUB boot menu as the default
menu entry, so that subsequent reboots will boot the system into the new
configuration. Previous configurations activated with
.Ic nixos-rebuild switch
or
.Ic nixos-rebuild boot
remain available in the GRUB menu.
.Pp
Note that if you are using specializations, running just
.Ic nixos-rebuild switch
will switch you back to the unspecialized, base system \(em in that case, you
might want to use this instead:
.Bd -literal -offset indent
$ nixos-rebuild switch --specialisation your-specialisation-name
.Ed
.Pp
This command will build all specialisations and make them bootable just
like regular
.Ic nixos-rebuild switch
does \(em the only thing different is that it will switch to given
specialisation instead of the base system; it can be also used to switch from
the base system into a specialised one, or to switch between specialisations.
.
.It Cm boot
Build the new configuration and make it the boot default (as with
.Ic nixos-rebuild switch Ns
), but do not activate it. That is, the system continues to run the previous
configuration until the next reboot.
.
.It Cm test
Build and activate the new configuration, but do not add it to the GRUB
boot menu. Thus, if you reboot the system (or if it crashes), you will
automatically revert to the default configuration (i.e. the
configuration resulting from the last call to
.Ic nixos-rebuild switch
or
.Ic nixos-rebuild boot Ns
).
.Pp
Note that if you are using specialisations, running just
.Ic nixos-rebuild test
will activate the unspecialised, base system \(em in that case, you might want
to use this instead:
.Bd -literal -offset indent
$ nixos-rebuild test --specialisation your-specialisation-name
.Ed
.Pp
This command can be also used to switch from the base system into a
specialised one, or to switch between specialisations.
.
.It Cm build
Build the new configuration, but neither activate it nor add it to the
GRUB boot menu. It leaves a symlink named
.Pa result
in the current directory, which points to the output of the top-level
.Dq system
derivation. This is essentially the same as doing
.Bd -literal -offset indent
$ nix-build /path/to/nixpkgs/nixos -A system
.Ed
.Pp
Note that you do not need to be root to run
.Ic nixos-rebuild build Ns
\&.
.
.It Cm dry-build
Show what store paths would be built or downloaded by any of the
operations above, but otherwise do nothing.
.
.It Cm dry-activate
Build the new configuration, but instead of activating it, show what
changes would be performed by the activation (i.e. by
.Ic nixos-rebuild test Ns
). For instance, this command will print which systemd units would be restarted.
The list of changes is not guaranteed to be complete.
.
.It Cm edit
Opens
.Pa configuration.nix
in the default editor.
.
.It Cm repl
Opens the configuration in
.Ic nix repl Ns .
.
.It Cm build-vm
Build a script that starts a NixOS virtual machine with the desired
configuration. It leaves a symlink
.Pa result
in the current directory that points (under
.Ql result/bin/run\- Ns Va hostname Ns \-vm Ns
)
at the script that starts the VM. Thus, to test a NixOS configuration in
a virtual machine, you should do the following:
.Bd -literal -offset indent
$ nixos-rebuild build-vm
$ ./result/bin/run-*-vm
.Ed
.Pp
The VM is implemented using the
.Ql qemu
package. For best performance, you should load the
.Ql kvm-intel
or
.Ql kvm-amd
kernel modules to get hardware virtualisation.
.Pp
The VM mounts the Nix store of the host through the 9P file system. The
host Nix store is read-only, so Nix commands that modify the Nix store
will not work in the VM. This includes commands such as
.Nm Ns
; to change the VM’s configuration, you must halt the VM and re-run the commands
above.
.Pp
The VM has its own ext3 root file system, which is automatically created when
the VM is first started, and is persistent across reboots of the VM. It is
stored in
.Ql ./ Ns Va hostname Ns .qcow2 Ns
\&.
.\" The entire file system hierarchy of the host is available in
.\" the VM under
.\" .Pa /hostfs Ns
.\" .
.
.It Cm build-vm-with-bootloader
Like
.Cm build-vm Ns
, but boots using the regular boot loader of your configuration (e.g. GRUB 1 or
2), rather than booting directly into the kernel and initial ramdisk of the
system. This allows you to test whether the boot loader works correctly. \
However, it does not guarantee that your NixOS configuration will boot
successfully on the host hardware (i.e., after running
.Ic nixos-rebuild switch Ns
), because the hardware and boot loader configuration in the VM are different.
The boot loader is installed on an automatically generated virtual disk
containing a
.Pa /boot
partition.
.
.It Cm →build-image→→
→→Build→→ →→a→→ →→disk-image→→ →→variant,→→ →→pre-configured→→ →→for→→ →→the→→ →→given→→ →→platform/provider.→→
→→Select→→ →→a→→ →→variant→→ →→with→→ →→the→→
→→.Fl→→ →→--image-variant→→
→→option→→ →→or→→ →→run→→ →→without→→ →→any→→ →→options→→ →→to→→ →→get→→ →→a→→ →→list→→ →→of→→ →→available→→ →→variants.→→
→→.Bd→→ →→-literal→→ →→-offset→→ →→indent→→
→→$→→ →→nixos-rebuild→→ →→build-image→→ →→--image-variant→→ →→proxmox→→
→→.Ed→→
→→.→→
→→.It→→ →→Cm→→ →list-generations Op Fl -json
List the available generations in a similar manner to the boot loader
menu. It shows the generation number, build date and time, NixOS version,
kernel version and the configuration revision.
There is also a json version of output available.
.El
.
.
.
.Sh OPTIONS
.Bl -tag -width indent
.It Fl -upgrade , -upgrade-all
Update the root user's channel named
.Ql nixos
before rebuilding the system.
.Pp
In addition to the
.Ql nixos
channel, the root user's channels which have a file named
.Ql .update-on-nixos-rebuild
in their base directory will also be updated.
.Pp
Passing
.Fl -upgrade-all
updates all of the root user's channels.
.
.It Fl -install-bootloader
Causes the boot loader to be (re)installed on the device specified by the
relevant configuration options.
.
.It Fl -no-build-nix
Normally,
.Nm
first builds the
.Ql nixUnstable
attribute in Nixpkgs, and uses the resulting instance of the Nix package manager
to build the new system configuration. This is necessary if the NixOS modules
use features not provided by the currently installed version of Nix. This option
disables building a new Nix.
.
.It Fl -fast
Equivalent to
.Fl -no-build-nix Ns
\&. This option is useful if you call
.Nm
frequently (e.g. if you’re hacking on a NixOS module).
.
.It Fl -rollback
Instead of building a new configuration as specified by
.Pa /etc/nixos/configuration.nix Ns
, roll back to the previous configuration. (The previous configuration is
defined as the one before the “current” generation of the Nix profile
.Pa /nix/var/nix/profiles/system Ns
\&.)
.
.It Fl -builders Ar builder-spec
Allow ad-hoc remote builders for building the new system. This requires
the user executing
.Nm
(usually root) to be configured as a trusted user in the Nix daemon. This can be
achieved by using the
.Va nix.settings.trusted-users
NixOS option. Examples values for that option are described in the
.Dq Remote builds
chapter in the Nix manual, (i.e.
.Ql --builders \(dqssh://bigbrother x86_64-linux\(dq Ns
). By specifying an empty string existing builders specified in
.Pa /etc/nix/machines
can be ignored:
.Ql --builders \(dq\(dq
for example when they are not reachable due to network connectivity.
.
.It Fl -profile-name Ar name , Fl p Ar name
Instead of using the Nix profile
.Pa /nix/var/nix/profiles/system
to keep track of the current and previous system configurations, use
.Pa /nix/var/nix/profiles/system-profiles/ Ns Va name Ns
\&. When you use GRUB 2, for every system profile created with this flag, NixOS
will create a submenu named
.Dq NixOS - Profile Va name
in GRUB’s boot menu, containing the current and previous configurations of this profile.
.Pp
For instance, if you want to test a configuration file named
.Pa test.nix
without affecting the default system profile, you would do:
.Bd -literal -offset indent
$ nixos-rebuild switch -p test -I nixos-config=./test.nix
.Ed
.Pp
The new configuration will appear in the GRUB 2 submenu
.Dq NixOS - Profile 'test' Ns
\&.
.
.It Fl -specialisation Ar name , Fl c Ar name
Activates given specialisation; when not specified, switching and testing
will activate the base, unspecialised system.→
→→.→→
→→.It→→ →→Fl→→ →→-image-variant→→ →→Ar→→ →→variant→→
→→Selects→→ →→an→→ →→image→→ →→variant→→ →→to→→ →→build→→ →→from→→
→→the→→
→→.Va→→ →→config.system.build.images→→
→→attribute→→ →→of→→ →→the→→ →→given→→ →→configuration.→→ →→A→→ →→list→→ →→of→→ →→variants→→ →→is→→ →→printed→→ →→if→→ →→this→→ →→option→→ →→remains→→ →→unset.→
.
.It Fl -build-host Ar host
Instead of building the new configuration locally, use the specified host
to perform the build. The host needs to be accessible with
.Ic ssh Ns ,
and must be able to perform Nix builds. If the option
.Fl -target-host
is not set, the build will be copied back to the local machine when done.
.Pp
Note that, if
.Fl -no-build-nix
is not specified, Nix will be built both locally and remotely. This is because
the configuration will always be evaluated locally even though the building
might be performed remotely.
.Pp
You can include a remote user name in the host name
.Ns ( Va user@host Ns
). You can also set ssh options by defining the
.Ev NIX_SSHOPTS
environment variable.
.
.It Fl -target-host Ar host
Specifies the NixOS target host. By setting this to something other than an
empty string, the system activation will happen on the remote host instead of
the local machine. The remote host needs to be accessible over
.Ic ssh Ns ,
and for the commands
.Cm switch Ns
,
.Cm boot
and
.Cm test
you need root access.
.Pp
If
.Fl -build-host
is not explicitly specified or empty, building will take place locally.
.Pp
You can include a remote user name in the host name
.Ns ( Va user@host Ns
). You can also set ssh options by defining the
.Ev NIX_SSHOPTS
environment variable.
.Pp
Note that
.Nm
honors the
.Va nixpkgs.crossSystem
setting of the given configuration but disregards the true architecture of the
target host. Hence the
.Va nixpkgs.crossSystem
setting has to match the target platform or else activation will fail.
.
.It Fl -use-substitutes
When set, nixos-rebuild will add
.Fl -use-substitutes
to each invocation of nix-copy-closure. This will only affect the behavior of
nixos-rebuild if
.Fl -target-host
or
.Fl -build-host
is also set. This is useful when the target-host connection to cache.nixos.org
is faster than the connection between hosts.
.
.It Fl -use-remote-sudo
When set, nixos-rebuild prefixes activation commands that run on the
.Fl -target-host
system with
.Ic sudo Ns
\&. Setting this option allows deploying as a non-root user.
.
.It Fl -no-ssh-tty
When set, nixos-rebuild will not request a tty when executing commands on the
.Fl -target-host
system with
.Ic ssh Ns
\&. This may help avoid corrupted terminal output when running multiple
nixos-rebuild commands in parallel, but may also prevent the remote
.Ic sudo
from working properly.
.
.It Fl -file Ar path , Fl f Ar path
Enable and build the NixOS system from the specified file. The file must
evaluate to an attribute set, and it must contain a valid NixOS configuration
at attribute
.Va attrPath Ns
\&. This is useful for building a NixOS system from a nix file that is not
a flake or a NixOS configuration module. Attribute set a with valid NixOS
configuration can be made using
.Va nixos
function in nixpkgs or importing and calling
.Pa nixos/lib/eval-config.nix
from nixpkgs. If specified without
.Fl -attr
option, builds the configuration from the top-level
attribute of the file.
.
.It Fl -attr Ar attrPath , Fl A Ar attrPath
Enable and build the NixOS system from nix file and use the specified attribute
path from file specified by the
.Fl -file
option. If specified without
.Fl -file
option, uses
.Pa default.nix
in current directory.
.
.It Fl -flake Va flake-uri Ns Op Va #name
Build the NixOS system from the specified flake. It defaults to the directory
containing the target of the symlink
.Pa /etc/nixos/flake.nix Ns
, if it exists. The flake must contain an output named
.Ql nixosConfigurations. Ns Va name Ns
\&. If
.Va name
is omitted, it default to the current host name.
.
.It Fl -no-flake
Do not imply
.Fl -flake
if
.Pa /etc/nixos/flake.nix
exists. With this option, it is possible to build non-flake NixOS configurations
even if the current NixOS systems uses flakes.
.El
.Pp
In addition,
.Nm
accepts following options from nix commands that the tool calls:
.
.Pp
flake-related options:
.Bd -offset indent
.Fl -recreate-lock-file Ns ,
.Fl -no-update-lock-file Ns ,
.Fl -no-write-lock-file Ns ,
.Fl -no-registries Ns ,
.Fl -commit-lock-file Ns ,
.Fl -update-input Ar input-path Ns ,
.Fl -override-input Ar input-path flake-url Ns
.Ed
.
.Pp
Builder options:
.Bd -offset indent
.Fl -verbose Ns ,
.Fl v Ns ,
.Fl -quiet Ns ,
.Fl -log-format Ns ,
.Fl -no-build-output Ns ,
.Fl Q Ns ,
.Fl -max-jobs Ns ,
.Fl j Ns ,
.Fl -cores Ns ,
.Fl -keep-going Ns ,
.Fl k Ns ,
.Fl -keep-failed Ns ,
.Fl K Ns ,
.Fl -fallback Ns ,
.Fl I Ns ,
.Fl -option Ns
.Fl -repair Ns ,
.Fl -builders Ns ,
.Fl -accept-flake-config Ns ,
.Fl -print-build-logs Ns ,
.Fl L Ns ,
.Fl -show-trace Ns ,
.Fl -refresh Ns ,
.Fl -impure Ns ,
.Fl -offline Ns ,
.Fl -no-net Ns
.Ed
.
.Pp
See the Nix manual,
.Ic nix flake lock --help
or
.Ic nix-build --help
for details.
.
.
.
.Sh ENVIRONMENT
.Bl -tag -width indent
.It Ev NIXOS_CONFIG
Path to the main NixOS configuration module. Defaults to
.Pa /etc/nixos/configuration.nix Ns
\&.
.
.It Ev NIX_PATH
A colon-separated list of directories used to look up Nix expressions enclosed
in angle brackets (e.g. <nixpkgs>). Example:
.Bd -literal -offset indent
nixpkgs=./my-nixpkgs
.Ed
.
.It Ev NIX_SSHOPTS
Additional options to be passed to
.Ic ssh
on the command line.
.Ed
.
.It Ev NIXOS_SWITCH_USE_DIRTY_ENV
Expose the the current environment variables to post activation scripts. Will
skip usage of
.Ic systemd-run
during system activation. Possibly dangerous, specially in remote environments
(e.g.: via SSH). Will be removed in the future.
.El
.
.
.
.Sh FILES
.Bl -tag -width indent
.It Pa /etc/nixos/flake.nix
If this file exists, then
.Nm
will use it as if the
.Fl -flake
option was given. This file may be a symlink to a
.Pa flake.nix
in an actual flake; thus
.Pa /etc/nixos
need not be a flake.
.
.It Pa /run/current-system
A symlink to the currently active system configuration in the Nix store.
.
.It Pa /nix/var/nix/profiles/system
The Nix profile that contains the current and previous system
configurations. Used to generate the GRUB boot menu.
.El
.
.
.
.Sh BUGS
This command should be renamed to something more descriptive.
.
.
.
.Sh AUTHORS
.An -nosplit
.An Eelco Dolstra
and
.An the Nixpkgs/NixOS contributors
''
• The input source named `nixos-rebuild.sh` differs
''
#! @runtimeShell@
# shellcheck shell=bash
if [ -x "@runtimeShell@" ]; then export SHELL="@runtimeShell@"; fi;
set -e
set -o pipefail
shopt -s inherit_errexit
export PATH=@path@:$PATH
showSyntax() {
exec man nixos-rebuild
exit 1
}
# Parse the command line.
origArgs=("$@")
copyFlags=()
extraBuildFlags=()
lockFlags=()
flakeFlags=(--extra-experimental-features 'nix-command flakes')
action=
buildNix=1
fast=
rollback=
upgrade=
upgrade_all=
profile=/nix/var/nix/profiles/system
specialisation=
→imageVariant=→→
→buildHost=
targetHost=
remoteSudo=
noSSHTTY=
verboseScript=
noFlake=
attr=
buildFile=default.nix
buildingAttribute=1
installBootloader=
json=
# log the given argument to stderr
log() {
echo "$@" >&2
}
while [ "$#" -gt 0 ]; do
i="$1"; shift 1
case "$i" in
--help)
showSyntax
;;
←switch|boot|test|build|edit|repl|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader|list-generations)←→switch|boot|test|build|edit|repl|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader|build-image|list-generations)→
if [ "$i" = dry-run ]; then i=dry-build; fi
if [ "$i" = list-generations ]; then
buildNix=
fast=1
fi
# exactly one action mandatory, bail out if multiple are given
if [ -n "$action" ]; then showSyntax; fi
action="$i"
;;
--file|-f)
if [ -z "$1" ]; then
log "$0: '$i' requires an argument"
exit 1
fi
buildFile="$1"
buildingAttribute=
shift 1
;;
--attr|-A)
if [ -z "$1" ]; then
log "$0: '$i' requires an argument"
exit 1
fi
attr="$1"
buildingAttribute=
shift 1
;;
--install-grub)
log "$0: --install-grub deprecated, use --install-bootloader instead"
installBootloader=1
;;
--install-bootloader)
installBootloader=1
;;
--no-build-nix)
buildNix=
;;
--rollback)
rollback=1
;;
--upgrade)
upgrade=1
;;
--upgrade-all)
upgrade=1
upgrade_all=1
;;
--use-substitutes|--substitute-on-destination|-s)
copyFlags+=("-s")
;;
-I|--builders)
j="$1"; shift 1
extraBuildFlags+=("$i" "$j")
;;
--max-jobs|-j|--cores|--log-format)
j="$1"; shift 1
extraBuildFlags+=("$i" "$j")
copyFlags+=("$i" "$j")
;;
--accept-flake-config|-j*|--quiet|--print-build-logs|-L|--no-build-output|-Q|--show-trace|--refresh|--impure|--offline|--no-net)
extraBuildFlags+=("$i")
;;
--keep-going|-k|--keep-failed|-K|--fallback|--repair)
extraBuildFlags+=("$i")
copyFlags+=("$i")
;;
--verbose|-v|-vv|-vvv|-vvvv|-vvvvv)
verboseScript="true"
extraBuildFlags+=("$i")
copyFlags+=("$i")
;;
--option)
j="$1"; shift 1
k="$1"; shift 1
extraBuildFlags+=("$i" "$j" "$k")
copyFlags+=("$i" "$j" "$k")
;;
--fast)
buildNix=
fast=1
;;
--profile-name|-p)
if [ -z "$1" ]; then
log "$0: ‘--profile-name’ requires an argument"
exit 1
fi
if [ "$1" != system ]; then
profile="/nix/var/nix/profiles/system-profiles/$1"
mkdir -p -m 0755 "$(dirname "$profile")"
fi
shift 1
;;
--specialisation|-c)
if [ -z "$1" ]; then
log "$0: ‘--specialisation’ requires an argument"
exit 1
fi
specialisation="$1"
shift 1
;;
→--image-variant)→→
→→if→→ →→[→→ →→-z→→ →→"$1"→→ →→];→→ →→then→→
→→log→→ →→"$0:→→ →→‘--image-variant’→→ →→requires→→ →→an→→ →→argument"→→
→→exit→→ →→1→→
→→fi→→
→→imageVariant="$1"→→
→→shift→→ →→1→→
→→;;→→
→--build-host)
buildHost="$1"
shift 1
;;
--target-host)
targetHost="$1"
shift 1
;;
--use-remote-sudo)
remoteSudo=1
;;
--no-ssh-tty)
noSSHTTY=1
;;
--flake)
flake="$1"
shift 1
;;
--no-flake)
noFlake=1
;;
--recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file)
lockFlags+=("$i")
;;
--update-input)
j="$1"; shift 1
lockFlags+=("$i" "$j")
;;
--override-input)
j="$1"; shift 1
k="$1"; shift 1
lockFlags+=("$i" "$j" "$k")
;;
--json)
json=1
;;
*)
log "$0: unknown option \`$i'"
exit 1
;;
esac
done
# log the given argument to stderr if verbose mode is on
logVerbose() {
if [ -n "$verboseScript" ]; then
echo "$@" >&2
fi
}
# Run a command, logging it first if verbose mode is on
runCmd() {
logVerbose "$" "$@"
"$@"
}
buildHostCmd() {
local c
if [[ "${useSudo:-x}" = 1 ]]; then
c=("sudo")
else
c=()
fi
if [ -z "$buildHost" ]; then
runCmd "$@"
elif [ -n "$remoteNix" ]; then
runCmd ssh $SSHOPTS "$buildHost" "${c[@]}" env PATH="$remoteNix":'$PATH' "$@"
else
runCmd ssh $SSHOPTS "$buildHost" "${c[@]}" "$@"
fi
}
targetHostCmd() {
local c
if [[ "${useSudo:-x}" = 1 ]]; then
c=("sudo")
else
c=()
fi
if [ -z "$targetHost" ]; then
runCmd "${c[@]}" "$@"
else
runCmd ssh $SSHOPTS "$targetHost" "${c[@]}" "$@"
fi
}
targetHostSudoCmd() {
local t=
if [[ ! "${noSSHTTY:-x}" = 1 ]]; then
t="-t"
fi
if [ -n "$remoteSudo" ]; then
useSudo=1 SSHOPTS="$SSHOPTS $t" targetHostCmd "$@"
else
# While a tty might not be necessary, we apply it to be consistent with
# sudo usage, and an experience that is more consistent with local deployment.
# But if the user really doesn't want it, don't do it.
SSHOPTS="$SSHOPTS $t" targetHostCmd "$@"
fi
}
copyToTarget() {
if ! [ "$targetHost" = "$buildHost" ]; then
if [ -z "$targetHost" ]; then
logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --from "$buildHost" "$1"
elif [ -z "$buildHost" ]; then
logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1"
else
buildHostCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1"
fi
fi
}
nixBuild() {
logVerbose "Building in legacy (non-flake) mode."
if [ -z "$buildHost" ]; then
logVerbose "No --build-host given, running nix-build locally"
runCmd nix-build "$@"
else
logVerbose "buildHost set to \"$buildHost\", running nix-build remotely"
local instArgs=()
local buildArgs=()
local drv=
while [ "$#" -gt 0 ]; do
local i="$1"; shift 1
case "$i" in
-o)
local out="$1"; shift 1
buildArgs+=("--add-root" "$out" "--indirect")
;;
-A)
local j="$1"; shift 1
instArgs+=("$i" "$j")
;;
-I) # We don't want this in buildArgs
shift 1
;;
--no-out-link) # We don't want this in buildArgs
;;
"<"*) # nix paths
instArgs+=("$i")
;;
*)
buildArgs+=("$i")
;;
esac
done
if [[ -z $buildingAttribute ]]; then
instArgs+=("$buildFile")
fi
drv="$(runCmd nix-instantiate "${instArgs[@]}" "${extraBuildFlags[@]}")"
if [ -a "$drv" ]; then
logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure --to "$buildHost" "$drv"
buildHostCmd nix-store -r "$drv" "${buildArgs[@]}"
else
log "nix-instantiate failed"
exit 1
fi
fi
}
nixFlakeBuild() {
logVerbose "Building in flake mode."
if [[ -z "$buildHost" && -z "$targetHost" && "$action" != switch && "$action" != boot && "$action" != test && "$action" != dry-activate ]]
then
runCmd nix "${flakeFlags[@]}" build "$@"
readlink -f ./result
elif [ -z "$buildHost" ]; then
runCmd nix "${flakeFlags[@]}" build "$@" --out-link "${tmpDir}/result"
readlink -f "${tmpDir}/result"
else
local attr="$1"
shift 1
local evalArgs=()
local buildArgs=()
local drv=
while [ "$#" -gt 0 ]; do
local i="$1"; shift 1
case "$i" in
--recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file)
evalArgs+=("$i")
;;
--update-input)
local j="$1"; shift 1
evalArgs+=("$i" "$j")
;;
--override-input)
local j="$1"; shift 1
local k="$1"; shift 1
evalArgs+=("$i" "$j" "$k")
;;
--impure) # We don't want this in buildArgs, it's only needed at evaluation time, and unsupported during realisation
;;
*)
buildArgs+=("$i")
;;
esac
done
drv="$(runCmd nix "${flakeFlags[@]}" eval --raw "${attr}.drvPath" "${evalArgs[@]}" "${extraBuildFlags[@]}")"
if [ -a "$drv" ]; then
logVerbose "Running nix with these NIX_SSHOPTS: $SSHOPTS"
NIX_SSHOPTS=$SSHOPTS runCmd nix "${flakeFlags[@]}" copy "${copyFlags[@]}" --derivation --to "ssh://$buildHost" "$drv"
buildHostCmd nix-store -r "$drv" "${buildArgs[@]}"
else
log "nix eval failed"
exit 1
fi
fi
}
if [ -z "$action" ]; then showSyntax; fi
# Only run shell scripts from the Nixpkgs tree if the action is
# "switch", "boot", or "test". With other actions (such as "build"),
# the user may reasonably expect that no code from the Nixpkgs tree is
# executed, so it's safe to run nixos-rebuild against a potentially
# untrusted tree.
canRun=
if [[ "$action" = switch || "$action" = boot || "$action" = test ]]; then
canRun=1
fi
# Verify that user is not trying to use attribute building and flake
# at the same time
if [[ -z $buildingAttribute && -n $flake ]]; then
log "error: '--flake' cannot be used with '--file' or '--attr'"
exit 1
fi
# If ‘--upgrade’ or `--upgrade-all` is given,
# run ‘nix-channel --update nixos’.
if [[ -n $upgrade && -z $_NIXOS_REBUILD_REEXEC && -z $flake ]]; then
# If --upgrade-all is passed, or there are other channels that
# contain a file called ".update-on-nixos-rebuild", update them as
# well. Also upgrade the nixos channel.
for channelpath in /nix/var/nix/profiles/per-user/root/channels/*; do
channel_name=$(basename "$channelpath")
if [[ "$channel_name" == "nixos" ]]; then
runCmd nix-channel --update "$channel_name"
elif [ -e "$channelpath/.update-on-nixos-rebuild" ]; then
runCmd nix-channel --update "$channel_name"
elif [[ -n $upgrade_all ]] ; then
runCmd nix-channel --update "$channel_name"
fi
done
fi
# Make sure that we use the Nix package we depend on, not something
# else from the PATH for nix-{env,instantiate,build}. This is
# important, because NixOS defaults the architecture of the rebuilt
# system to the architecture of the nix-* binaries used. So if on an
# amd64 system the user has an i686 Nix package in her PATH, then we
# would silently downgrade the whole system to be i686 NixOS on the
# next reboot.
if [ -z "$_NIXOS_REBUILD_REEXEC" ]; then
export PATH=@nix@/bin:$PATH
fi
# Use /etc/nixos/flake.nix if it exists. It can be a symlink to the
# actual flake.
if [[ -z $flake && -e /etc/nixos/flake.nix && -z $noFlake ]]; then
flake="$(dirname "$(readlink -f /etc/nixos/flake.nix)")"
fi
tmpDir=$(mktemp -t -d nixos-rebuild.XXXXXX)
if [[ ${#tmpDir} -ge 60 ]]; then
# Very long tmp dirs lead to "too long for Unix domain socket"
# SSH ControlPath errors. Especially macOS sets long TMPDIR paths.
rmdir "$tmpDir"
tmpDir=$(TMPDIR= mktemp -t -d nixos-rebuild.XXXXXX)
fi
cleanup() {
for ctrl in "$tmpDir"/ssh-*; do
ssh -o ControlPath="$ctrl" -O exit dummyhost 2>/dev/null || true
done
rm -rf "$tmpDir"
}
trap cleanup EXIT
SSHOPTS="$NIX_SSHOPTS -o ControlMaster=auto -o ControlPath=$tmpDir/ssh-%n -o ControlPersist=60"
# For convenience, use the hostname as the default configuration to
# build from the flake.
if [[ -n $flake ]]; then
if [[ $flake =~ ^(.*)\#([^\#\"]*)$ ]]; then
flake="${BASH_REMATCH[1]}"
flakeAttr="${BASH_REMATCH[2]}"
fi
if [[ -z $flakeAttr ]]; then
hostname="$(targetHostCmd cat /proc/sys/kernel/hostname)"
if [[ -z $hostname ]]; then
hostname=default
fi
flakeAttr="nixosConfigurations.\"$hostname\""
else
flakeAttr="nixosConfigurations.\"$flakeAttr\""
fi
fi
if [[ ! -z "$specialisation" && ! "$action" = switch && ! "$action" = test ]]; then
log "error: ‘--specialisation’ can only be used with ‘switch’ and ‘test’"
exit 1
fi
# Re-execute nixos-rebuild from the Nixpkgs tree.
if [[ -z $_NIXOS_REBUILD_REEXEC && -n $canRun && -z $fast ]]; then
if [[ -z $buildingAttribute ]]; then
p=$(runCmd nix-build --no-out-link $buildFile -A "${attr:+$attr.}config.system.build.nixos-rebuild" "${extraBuildFlags[@]}")
SHOULD_REEXEC=1
elif [[ -z $flake ]]; then
if p=$(runCmd nix-build --no-out-link --expr 'with import <nixpkgs/nixos> {}; config.system.build.nixos-rebuild' "${extraBuildFlags[@]}"); then
SHOULD_REEXEC=1
fi
else
runCmd nix "${flakeFlags[@]}" build --out-link "${tmpDir}/nixos-rebuild" "$flake#$flakeAttr.config.system.build.nixos-rebuild" "${extraBuildFlags[@]}" "${lockFlags[@]}"
if p=$(readlink -e "${tmpDir}/nixos-rebuild"); then
SHOULD_REEXEC=1
fi
fi
if [[ -n $SHOULD_REEXEC ]]; then
export _NIXOS_REBUILD_REEXEC=1
# Manually call cleanup as the EXIT trap is not triggered when using exec
cleanup
runCmd exec "$p/bin/nixos-rebuild" "${origArgs[@]}"
exit 1
fi
fi
# Find configuration.nix and open editor instead of building.
if [ "$action" = edit ]; then
if [[ -z $buildingAttribute ]]; then
log "error: '--file' and '--attr' are not supported with 'edit'"
exit 1
elif [[ -z $flake ]]; then
NIXOS_CONFIG=${NIXOS_CONFIG:-$(runCmd nix-instantiate --find-file nixos-config)}
if [[ -d $NIXOS_CONFIG ]]; then
NIXOS_CONFIG=$NIXOS_CONFIG/default.nix
fi
runCmd exec ${EDITOR:-nano} "$NIXOS_CONFIG"
else
runCmd exec nix "${flakeFlags[@]}" edit "${lockFlags[@]}" -- "$flake#$flakeAttr"
fi
exit 1
fi
# First build Nix, since NixOS may require a newer version than the
# current one.
if [[ -n "$rollback" || "$action" = dry-build ]]; then
buildNix=
fi
nixSystem() {
machine="$(uname -m)"
if [[ "$machine" =~ i.86 ]]; then
machine=i686
fi
echo $machine-linux
}
prebuiltNix() {
machine="$1"
if [ "$machine" = x86_64 ]; then
echo @nix_x86_64_linux@
elif [[ "$machine" =~ i.86 ]]; then
echo @nix_i686_linux@
elif [[ "$machine" = aarch64 ]]; then
echo @nix_aarch64_linux@
else
log "$0: unsupported platform"
exit 1
fi
}
getNixDrv() {
nixDrv=
if [[ -z $buildingAttribute ]]; then
if nixDrv="$(runCmd nix-instantiate $buildFile --add-root "$tmpDir/nix.drv" --indirect -A ${attr:+$attr.}config.nix.package.out "${extraBuildFlags[@]}")"; then return; fi
fi
if nixDrv="$(runCmd nix-instantiate '<nixpkgs/nixos>' --add-root "$tmpDir/nix.drv" --indirect -A config.nix.package.out "${extraBuildFlags[@]}")"; then return; fi
if nixDrv="$(runCmd nix-instantiate '<nixpkgs>' --add-root "$tmpDir/nix.drv" --indirect -A nix "${extraBuildFlags[@]}")"; then return; fi
if ! nixStorePath="$(runCmd nix-instantiate --eval '<nixpkgs/nixos/modules/installer/tools/nix-fallback-paths.nix>' -A "$(nixSystem)" | sed -e 's/^"//' -e 's/"$//')"; then
nixStorePath="$(prebuiltNix "$(uname -m)")"
fi
if ! runCmd nix-store -r "$nixStorePath" --add-root "${tmpDir}/nix" --indirect \
--option extra-binary-caches https://cache.nixos.org/; then
log "warning: don't know how to get latest Nix"
fi
# Older version of nix-store -r don't support --add-root.
[ -e "$tmpDir/nix" ] || ln -sf "$nixStorePath" "$tmpDir/nix"
if [ -n "$buildHost" ]; then
remoteNixStorePath="$(runCmd prebuiltNix "$(buildHostCmd uname -m)")"
remoteNix="$remoteNixStorePath/bin"
if ! buildHostCmd nix-store -r "$remoteNixStorePath" \
--option extra-binary-caches https://cache.nixos.org/ >/dev/null; then
remoteNix=
log "warning: don't know how to get latest Nix"
fi
fi
}
getVersion() {
local dir="$1"
local rev=
local gitDir="$dir/.git"
if [ -e "$gitDir" ]; then
if [ -z "$(type -P git)" ]; then
echo "warning: Git not found; cannot figure out revision of $dir" >&2
return
fi
cd "$dir"
rev=$(git --git-dir="$gitDir" rev-parse --short HEAD)
if git --git-dir="$gitDir" describe --always --dirty | grep -q dirty; then
rev+=M
fi
fi
if [ -n "$rev" ]; then
echo ".git.$rev"
fi
}
if [[ -n $buildNix && -z $flake ]]; then
log "building Nix..."
getNixDrv
if [ -a "$nixDrv" ]; then
nix-store -r "$nixDrv"'!'"out" --add-root "$tmpDir/nix" --indirect >/dev/null
if [ -n "$buildHost" ]; then
nix-copy-closure "${copyFlags[@]}" --to "$buildHost" "$nixDrv"
# The nix build produces multiple outputs, we add them all to the remote path
for p in $(buildHostCmd nix-store -r "$(readlink "$nixDrv")" "${buildArgs[@]}"); do
remoteNix="$remoteNix${remoteNix:+:}$p/bin"
done
fi
fi
PATH="$tmpDir/nix/bin:$PATH"
fi
# Update the version suffix if we're building from Git (so that
# nixos-version shows something useful).
if [[ -n $canRun && -z $flake ]]; then
if nixpkgs=$(runCmd nix-instantiate --find-file nixpkgs "${extraBuildFlags[@]}"); then
suffix=$(getVersion "$nixpkgs" || true)
if [ -n "$suffix" ]; then
echo -n "$suffix" > "$nixpkgs/.version-suffix" || true
fi
fi
fi
if [ "$action" = dry-build ]; then
extraBuildFlags+=(--dry-run)
fi
if [ "$action" = repl ]; then
# This is a very end user command, implemented using sub-optimal means.
# You should feel free to improve its behavior, as well as resolve tech
# debt in "breaking" ways. Humans adapt quite well.
if [[ -z $buildingAttribute ]]; then
exec nix repl --file $buildFile $attr "${extraBuildFlags[@]}"
elif [[ -z $flake ]]; then
exec nix repl --file '<nixpkgs/nixos>' "${extraBuildFlags[@]}"
else
if [[ -n "${lockFlags[0]}" ]]; then
# nix repl itself does not support locking flags
log "nixos-rebuild repl does not support locking flags yet"
exit 1
fi
d='$'
q='"'
bold="$(echo -e '\033[1m')"
blue="$(echo -e '\033[34;1m')"
attention="$(echo -e '\033[35;1m')"
reset="$(echo -e '\033[0m')"
if [[ -e $flake ]]; then
flakePath=$(realpath "$flake")
else
flakePath=$flake
fi
# This nix repl invocation is impure, because usually the flakeref is.
# For a solution that preserves the motd and custom scope, we need
# something like https://github.com/NixOS/nix/issues/8679.
exec nix repl --impure --expr "
let flake = builtins.getFlake ''$flakePath'';
configuration = flake.$flakeAttr;
motd = ''
$d{$q\n$q}
Hello and welcome to the NixOS configuration
$flakeAttr
in $flake
The following is loaded into nix repl's scope:
- ${blue}config${reset} All option values
- ${blue}options${reset} Option data and metadata
- ${blue}pkgs${reset} Nixpkgs package set
- ${blue}lib${reset} Nixpkgs library functions
- other module arguments
- ${blue}flake${reset} Flake outputs, inputs and source info of $flake
Use tab completion to browse around ${blue}config${reset}.
Use ${bold}:r${reset} to ${bold}reload${reset} everything after making a change in the flake.
(assuming $flake is a mutable flake ref)
See ${bold}:?${reset} for more repl commands.
${attention}warning:${reset} nixos-rebuild repl does not currently enforce pure evaluation.
'';
scope =
assert configuration._type or null == ''configuration'';
assert configuration.class or ''nixos'' == ''nixos'';
configuration._module.args //
configuration._module.specialArgs //
{
inherit (configuration) config options;
lib = configuration.lib or configuration.pkgs.lib;
inherit flake;
};
in builtins.seq scope builtins.trace motd scope
" "${extraBuildFlags[@]}"
fi
fi
if [ "$action" = list-generations ]; then
if [ ! -L "$profile" ]; then
log "No profile \`$(basename "$profile")' found"
exit 1
fi
generation_from_dir() {
generation_dir="$1"
generation_base="$(basename "$generation_dir")" # Has the format "system-123-link" for generation 123
no_link_gen="${generation_base%-link}" # remove the "-link"
echo "${no_link_gen##*-}" # remove everything before the last dash
}
describe_generation(){
generation_dir="$1"
generation_number="$(generation_from_dir "$generation_dir")"
nixos_version="$(cat "$generation_dir/nixos-version" 2> /dev/null || echo "Unknown")"
kernel_dir="$(dirname "$(realpath "$generation_dir/kernel")")"
kernel_version="$(ls "$kernel_dir/lib/modules" || echo "Unknown")"
configurationRevision="$("$generation_dir/sw/bin/nixos-version" --configuration-revision 2> /dev/null || true)"
# Old nixos-version output ignored unknown flags and just printed the version
# therefore the following workaround is done not to show the default output
nixos_version_default="$("$generation_dir/sw/bin/nixos-version")"
if [ "$configurationRevision" == "$nixos_version_default" ]; then
configurationRevision=""
fi
# jq automatically quotes the output => don't try to quote it in output!
build_date="$(stat "$generation_dir" --format=%W | jq 'todate')"
pushd "$generation_dir/specialisation/" > /dev/null || :
specialisation_list=(*)
popd > /dev/null || :
specialisations="$(jq --compact-output --null-input '$ARGS.positional' --args -- "${specialisation_list[@]}")"
if [ "$(basename "$generation_dir")" = "$(readlink "$profile")" ]; then
current_generation_tag="true"
else
current_generation_tag="false"
fi
# Escape userdefined strings
nixos_version="$(jq -aR <<< "$nixos_version")"
kernel_version="$(jq -aR <<< "$kernel_version")"
configurationRevision="$(jq -aR <<< "$configurationRevision")"
cat << EOF
{
"generation": $generation_number,
"date": $build_date,
"nixosVersion": $nixos_version,
"kernelVersion": $kernel_version,
"configurationRevision": $configurationRevision,
"specialisations": $specialisations,
"current": $current_generation_tag
}
EOF
}
find "$(dirname "$profile")" -regex "$profile-[0-9]+-link" |
sort -Vr |
while read -r generation_dir; do
describe_generation "$generation_dir"
done |
if [ -z "$json" ]; then
jq --slurp -r '.[] | [
([.generation, (if .current == true then "current" else "" end)] | join(" ")),
(.date | fromdate | strflocaltime("%Y-%m-%d %H:%M:%S")),
.nixosVersion, .kernelVersion, .configurationRevision,
(.specialisations | join(" "))
] | @tsv' |
column --separator $'\t' --table --table-columns "Generation,Build-date,NixOS version,Kernel,Configuration Revision,Specialisation"
else
jq --slurp .
fi
exit 0
fi
# Either upgrade the configuration in the system profile (for "switch"
# or "boot"), or just build it and create a symlink "result" in the
# current directory (for "build" and "test").
if [ -z "$rollback" ]; then
log "building the system configuration..."
if [[ "$action" = switch || "$action" = boot ]]; then
if [[ -z $buildingAttribute ]]; then
pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.toplevel" "${extraBuildFlags[@]}")"
elif [[ -z $flake ]]; then
pathToConfig="$(nixBuild '<nixpkgs/nixos>' --no-out-link -A system "${extraBuildFlags[@]}")"
else
pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
fi
copyToTarget "$pathToConfig"
targetHostSudoCmd nix-env -p "$profile" --set "$pathToConfig"
elif [[ "$action" = test || "$action" = build || "$action" = dry-build || "$action" = dry-activate ]]; then
if [[ -z $buildingAttribute ]]; then
pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.toplevel" "${extraBuildFlags[@]}")"
elif [[ -z $flake ]]; then
pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}")"
else
pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
fi
elif [ "$action" = build-vm ]; then
if [[ -z $buildingAttribute ]]; then
pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.vm" "${extraBuildFlags[@]}")"
elif [[ -z $flake ]]; then
pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vm -k "${extraBuildFlags[@]}")"
else
pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.vm" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
fi
elif [ "$action" = build-vm-with-bootloader ]; then
if [[ -z $buildingAttribute ]]; then
pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.vmWithBootLoader" "${extraBuildFlags[@]}")"
elif [[ -z $flake ]]; then
pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vmWithBootLoader -k "${extraBuildFlags[@]}")"
else
pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.vmWithBootLoader" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
fi
→elif→→ →→[→→ →→"$action"→→ →→=→→ →→build-image→→ →→];→→ →→then→→
→→if→→ →→[[→→ →→-z→→ →→$buildingAttribute→→ →→]];→→ →→then→→
→→variants="$(→→
→→runCmd→→ →→nix-instantiate→→ →→--eval→→ →→--strict→→ →→--json→→ →→--expr→→ →→\→→
→→"let→→
→→value→→ →→=→→ →→import→→ →→\"$(realpath→→ →→$buildFile)\";→→
→→set→→ →→=→→ →→if→→ →→builtins.isFunction→→ →→value→→ →→then→→ →→value→→ →→{}→→ →→else→→ →→value;→→
→→in→→ →→builtins.mapAttrs→→ →→(n:→→ →→v:→→ →→v.passthru.filePath)→→ →→set.${attr:+$attr.}config.system.build.images"→→ →→\→→
→→"${extraBuildFlags[@]}"→→
→→)"→→
→→elif→→ →→[[→→ →→-z→→ →→$flake→→ →→]];→→ →→then→→
→→variants="$(→→
→→runCmd→→ →→nix-instantiate→→ →→--eval→→ →→--strict→→ →→--json→→ →→--expr→→ →→\→→
→→"with→→ →→import→→ →→<nixpkgs/nixos>→→ →→{};→→ →→builtins.mapAttrs→→ →→(n:→→ →→v:→→ →→v.passthru.filePath)→→ →→config.system.build.images"→→ →→\→→
→→"${extraBuildFlags[@]}"→→
→→)"→→
→→else→→
→→variants="$(→→
→→runCmd→→ →→nix→→ →→"${flakeFlags[@]}"→→ →→eval→→ →→--json→→ →→\→→
→→"$flake#$flakeAttr.config.system.build.images"→→ →→\→→
→→--apply→→ →→"builtins.mapAttrs→→ →→(n:→→ →→v:→→ →→v.passthru.filePath)"→→ →→"${evalArgs[@]}"→→ →→"${extraBuildFlags[@]}"→→
→→)"→→
→→fi→→
→→if→→ →→!→→ →→echo→→ →→"$variants"→→ →→|→→ →→jq→→ →→-e→→ →→--arg→→ →→variant→→ →→"$imageVariant"→→ →→"keys→→ →→|→→ →→any(.→→ →→==→→ →→\$variant)"→→ →→>→→ →→/dev/null;→→ →→then→→
→→echo→→ →→-e→→ →→"Please→→ →→specify→→ →→one→→ →→of→→ →→the→→ →→following→→ →→supported→→ →→image→→ →→variants→→ →→via→→ →→--image-variant:\n"→→ →→>&2→→
→→echo→→ →→"$variants"→→ →→|→→ →→jq→→ →→-r→→ →→'.→→ →→|→→ →→keys→→ →→|→→ →→join→→ →→("\n")'→→
→→exit→→ →→1→→
→→fi→→
→→imageName="$(echo→→ →→"$variants"→→ →→|→→ →→jq→→ →→-r→→ →→--arg→→ →→variant→→ →→"$imageVariant"→→ →→".[\$variant]")"→→
→→if→→ →→[[→→ →→-z→→ →→$buildingAttribute→→ →→]];→→ →→then→→
→→pathToConfig="$(nixBuild→→ →→$buildFile→→ →→-A→→ →→"${attr:+$attr.}config.system.build.images.${imageVariant}"→→ →→"${extraBuildFlags[@]}")"→→
→→elif→→ →→[[→→ →→-z→→ →→$flake→→ →→]];→→ →→then→→
→→pathToConfig="$(nixBuild→→ →→'<nixpkgs/nixos>'→→ →→-A→→ →→config.system.build.images.${imageVariant}→→ →→-k→→ →→"${extraBuildFlags[@]}")"→→
→→else→→
→→pathToConfig="$(nixFlakeBuild→→ →→"$flake#$flakeAttr.config.system.build.images.${imageVariant}"→→ →→"${extraBuildFlags[@]}"→→ →→"${lockFlags[@]}")"→→
→→fi→→
→else
showSyntax
fi
# Copy build to target host if we haven't already done it
if ! [[ "$action" = switch || "$action" = boot ]]; then
copyToTarget "$pathToConfig"
fi
else # [ -n "$rollback" ]
if [[ "$action" = switch || "$action" = boot ]]; then
targetHostSudoCmd nix-env --rollback -p "$profile"
pathToConfig="$profile"
elif [[ "$action" = test || "$action" = build ]]; then
systemNumber=$(
targetHostCmd nix-env -p "$profile" --list-generations |
sed -n '/current/ {g; p;}; s/ *\([0-9]*\).*/\1/; h'
)
pathToConfig="$profile"-${systemNumber}-link
if [ -z "$targetHost" ]; then
ln -sT "$pathToConfig" ./result
fi
else
showSyntax
fi
fi
# If we're not just building, then make the new configuration the boot
# default and/or activate it now.
if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" = dry-activate ]]; then
# Using systemd-run here to protect against PTY failures/network
# disconnections during rebuild.
# See: https://github.com/NixOS/nixpkgs/issues/39118
cmd=(
"systemd-run"
"-E" "LOCALE_ARCHIVE" # Will be set to new value early in switch-to-configuration script, but interpreter starts out with old value
"-E" "NIXOS_INSTALL_BOOTLOADER=$installBootloader"
"--collect"
"--no-ask-password"
"--pipe"
"--quiet"
"--service-type=exec"
"--unit=nixos-rebuild-switch-to-configuration"
"--wait"
)
# Check if we have a working systemd-run. In chroot environments we may have
# a non-working systemd, so we fallback to not using systemd-run.
# You may also want to explicitly set NIXOS_SWITCH_USE_DIRTY_ENV environment
# variable, since systemd-run runs inside an isolated environment and
# this may break some post-switch scripts. However keep in mind that this
# may be dangerous in remote access (e.g. SSH).
if [[ -n "$NIXOS_SWITCH_USE_DIRTY_ENV" ]]; then
log "warning: skipping systemd-run since NIXOS_SWITCH_USE_DIRTY_ENV is set. This environment variable will be ignored in the future"
cmd=("env" "NIXOS_INSTALL_BOOTLOADER=$installBootloader")
elif ! targetHostSudoCmd "${cmd[@]}" true; then
logVerbose "Skipping systemd-run to switch configuration since it is not working in target host."
cmd=(
"env"
"-i"
"LOCALE_ARCHIVE=$LOCALE_ARCHIVE"
"NIXOS_INSTALL_BOOTLOADER=$installBootloader"
)
else
logVerbose "Using systemd-run to switch configuration."
fi
if [[ -z "$specialisation" ]]; then
cmd+=("$pathToConfig/bin/switch-to-configuration")
else
cmd+=("$pathToConfig/specialisation/$specialisation/bin/switch-to-configuration")
if [ -z "$targetHost" ]; then
specialisationExists=$(test -f "${cmd[-1]}")
else
specialisationExists=$(targetHostCmd test -f "${cmd[-1]}")
fi
if ! $specialisationExists; then
log "error: specialisation not found: $specialisation"
exit 1
fi
fi
if ! targetHostSudoCmd "${cmd[@]}" "$action"; then
log "warning: error(s) occurred while switching to the new configuration"
exit 1
fi
fi
if [[ "$action" = build-vm || "$action" = build-vm-with-bootloader ]]; then
cat >&2 <<EOF
Done. The virtual machine can be started by running $(echo "${pathToConfig}/bin/"run-*-vm)
EOF→
→→fi→→
→→if→→ →→[[→→ →→"$action"→→ →→=→→ →→build-image→→ →→]];→→ →→then→→
→→echo→→ →→-n→→ →→"Done.→→ →→The→→ →→disk→→ →→image→→ →→can→→ →→be→→ →→found→→ →→in→→ →→"→→ →→>&2→→
→→echo→→ →→"${pathToConfig}/${imageName}"→
fi
''
• The environments do not match:
postInstall=''
installManPage ←/nix/store/6rnxc38y8lbg6q0pfz3x6xc5qgff39ys-nixos-rebuild.8←→/nix/store/d6krrc888446800q4f7isvh20hrrpnyf-nixos-rebuild.8→
installShellCompletion \
--bash /nix/store/bakmakyqdlm8dnmzzk7w64n3zyq95hdl-_nixos-rebuild
''
src=''
←/nix/store/r77ynxfmdk39xs6fnszyk3y7ga0wl453-nixos-rebuild.sh←→/nix/store/hi01gjxrszidyadlxjmfiaf7x9qvia8v-nixos-rebuild.sh→
''
• Skipping environment comparison
• Skipping environment comparison
• The input derivation named `etc-nix-registry.json` differs
- /nix/store/p0f3q4xccgx0vbkcdlhip9mp0ivcw14w-etc-nix-registry.json.drv:{out}
+ /nix/store/y6aph029plmbmvcs8ckjcqqsisr24q0y-etc-nix-registry.json.drv:{out}
• The input derivation named `nixos-25.05pre-git` differs
- /nix/store/qc7kd94755gff6kda6w8z625mc6kikbl-nixos-25.05pre-git.drv:{out}
+ /nix/store/xxahnq6pm5azh8wh9rcvq415f1xcsrrv-nixos-25.05pre-git.drv:{out}
• The input source named `source` differs
• The environments do not match:
buildCommand=''
mkdir -p $out
cp -prd ←/nix/store/pavyzp5xf2mrzh98l3xnpz3g9b7z4zxy-source←→/nix/store/r82zv817z34g7zasq20iwdrx630jzqsv-source→ $out/nixos
chmod -R u+w $out/nixos
if [ ! -e $out/nixos/nixpkgs ]; then
ln -s . $out/nixos/nixpkgs
fi
echo -n pre-git > $out/nixos/.version-suffix
echo pre-git | sed -e s/pre// > $out/nixos/svn-revision
''
• Skipping environment comparison
• The input derivation named `system-path` differs
• These two derivations have already been compared
• The input derivation named `system-units` differs
- /nix/store/jgm0dkdqrm4fxzjp4m7n6al48frrggrr-system-units.drv:{out}
+ /nix/store/bs8bngrbxxkz9aryp2pj2f1f2lx0f51l-system-units.drv:{out}
• The input derivation named `unit-dbus.service` differs
- /nix/store/cxs8g0mbd2hdlyc5wkspf6qgzgzqfniq-unit-dbus.service.drv:{out}
+ /nix/store/v8z6c8bc2rgq8a8mwx342fhnyadpwrb9-unit-dbus.service.drv:{out}
• The input derivation named `X-Restart-Triggers-dbus` differs
- /nix/store/ha2r0lkclfdhxq3dmqdbmzi1cdf0jjm5-X-Restart-Triggers-dbus.drv:{out}
+ /nix/store/v93rs5jyc0igi92k58ndnrp6b1c6ya1c-X-Restart-Triggers-dbus.drv:{out}
• The input derivation named `dbus-1` differs
• These two derivations have already been compared
• Skipping environment comparison
• Skipping environment comparison
• The input derivation named `unit-polkit.service` differs
- /nix/store/cp53z64yra6yy4r3mlc87vvfy5ykyxys-unit-polkit.service.drv:{out}
+ /nix/store/46cg2dcw8m9scbz2pz5cw1yzcr1xnh60-unit-polkit.service.drv:{out}
• The input derivation named `X-Restart-Triggers-polkit` differs
- /nix/store/9qrmrrqflaigwqyrillrymj7mdmm1dl1-X-Restart-Triggers-polkit.drv:{out}
+ /nix/store/1zd4jmzv1kl0b17kfnbgjxpwvhq2gvw0-X-Restart-Triggers-polkit.drv:{out}
• The input derivation named `system-path` differs
• These two derivations have already been compared
• Skipping environment comparison
• Skipping environment comparison
• Skipping environment comparison
• The input derivation named `user-units` differs
- /nix/store/aygd65q90wnkmiqhr3vqz9ggckw5ddp2-user-units.drv:{out}
+ /nix/store/13n4a7zn9prkp7qqcjm2wzn0g1vy7ll2-user-units.drv:{out}
• The input derivation named `unit-dbus.service` differs
- /nix/store/57g89ljwsfkcrc4gighvps08fv20jwvj-unit-dbus.service.drv:{out}
+ /nix/store/aiwnnl0hdpar6856z5vwwls0mrlag9s3-unit-dbus.service.drv:{out}
• The input derivation named `X-Restart-Triggers-dbus` differs
• These two derivations have already been compared
• Skipping environment comparison
• Skipping environment comparison
• Skipping environment comparison
• The input derivation named `stage-2-init.sh` differs
- /nix/store/snrlfk68bg51ik5cdvz0dik10ax0anxg-stage-2-init.sh.drv:{out}
+ /nix/store/jsn2br5mh8jnbfi8hv85j2pnbz4z9nvv-stage-2-init.sh.drv:{out}
• The input derivation named `local-cmds` differs
- /nix/store/vmss3ji4inchibway88isd80ij379sfz-local-cmds.drv:{out}
+ /nix/store/7rn89fds1j80qi2p5yj5954b7l8msd66-local-cmds.drv:{out}
• The input derivation named `nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
• Skipping environment comparison
• The input derivation named `system-path` differs
• These two derivations have already been compared
• Skipping environment comparison
• Skipping environment comparison
• The input derivation named `efi-directory` differs
- /nix/store/x2v0rwkjhv9j7j1q3vrflwwxxk0c51hk-efi-directory.drv:{out}
+ /nix/store/d44la2bmzbggh6nqryfdci3a3w0yx77d-efi-directory.drv:{out}
• The input derivation named `nixos-system-nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
• The input derivation named `efi-image_eltorito` differs
- /nix/store/7ys5bydapxi4y16w63pmzjv8ncyhwi9c-efi-image_eltorito.drv:{out}
+ /nix/store/fhayzw2ksh96gcaqiwyvh7hgh8l749r8-efi-image_eltorito.drv:{out}
• The input derivation named `efi-directory` differs
• These two derivations have already been compared
• Skipping environment comparison
• The input derivation named `isolinux.cfg` differs
- /nix/store/bwl4sl3hsk85idr4639byd7961picsx4-isolinux.cfg.drv:{out}
+ /nix/store/9fllxqf3sgnrwps7aqnp6c9183czy0hp-isolinux.cfg.drv:{out}
• The input derivation named `isolinux.cfg-in` differs
- /nix/store/zzgh63k3slwp6fsyjld0lzklcvw4ari3-isolinux.cfg-in.drv:{out}
+ /nix/store/zsx6a1him8db4yr05xqy800ssf4zp6qs-isolinux.cfg-in.drv:{out}
• The input derivation named `nixos-system-nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
• Skipping environment comparison
• Skipping environment comparison
kubevirt
- result/master/kubevirt:{out}
+ result/new/kubevirt:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-kubevirt-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/xhnidi3c3hcnmqbhrx457vh0hnzgsfsa-closure-info.drv:{out}
+ /nix/store/7c266m3h17ar07f4w78hjqqm1dxi2r1i-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-kubevirt-25.05pre-git
• The input derivation named `nixos-25.05pre-git` differs
- /nix/store/icnva3w4w72x72d7rj2yjkllamh8s67q-nixos-25.05pre-git.drv:{out}
+ /nix/store/brlzsqwvlkzbw3apqncqbf70m9ndrbnd-nixos-25.05pre-git.drv:{out}
• The input source named `source` differs
• The environments do not match:
buildCommand=''
mkdir -p $out
cp -prd ←/nix/store/pavyzp5xf2mrzh98l3xnpz3g9b7z4zxy-source←→/nix/store/r82zv817z34g7zasq20iwdrx630jzqsv-source→ $out/nixos
chmod -R u+w $out/nixos
if [ ! -e $out/nixos/nixpkgs ]; then
ln -s . $out/nixos/nixpkgs
fi
rm -rf $out/nixos/.git
echo -n pre-git > $out/nixos/.version-suffix
''
• Skipping environment comparison
• The input derivation named `nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
linode
- result/master/linode:{out}
+ result/new/linode:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-linode-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/d2cl2fjbghlv7jfz36xyn8rxvgmz779b-closure-info.drv:{out}
+ /nix/store/cdp9x7lysd7dxqkzhl9bgmjg0akc8387-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-linode-25.05pre-git
• The input derivation named `nixos-25.05pre-git` differs
- /nix/store/icnva3w4w72x72d7rj2yjkllamh8s67q-nixos-25.05pre-git.drv:{out}
+ /nix/store/brlzsqwvlkzbw3apqncqbf70m9ndrbnd-nixos-25.05pre-git.drv:{out}
• The input source named `source` differs
• The environments do not match:
buildCommand=''
mkdir -p $out
cp -prd ←/nix/store/pavyzp5xf2mrzh98l3xnpz3g9b7z4zxy-source←→/nix/store/r82zv817z34g7zasq20iwdrx630jzqsv-source→ $out/nixos
chmod -R u+w $out/nixos
if [ ! -e $out/nixos/nixpkgs ]; then
ln -s . $out/nixos/nixpkgs
fi
rm -rf $out/nixos/.git
echo -n pre-git > $out/nixos/.version-suffix
''
• Skipping environment comparison
• The input derivation named `nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
lxc
- result/master/lxc:{out}
+ result/new/lxc:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-lxc-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/p51s3gj4zna3kaf4g1bsycm8alz1gjpy-closure-info.drv:{out}
+ /nix/store/7lv00n5r9jf6dhld9scqd177a7alrb4l-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-lxc-25.05pre-git
• The environments do not match:
__json=''
{"buildCommand":"out=${outputs[out]}\n\nmkdir $out\n\nif [[ -n \"$empty\" ]]; then\n echo 0 > $out/total-nar-size\n touch $out/registration $out/store-paths\nelse\n jq -r \".closure | map(.narSize) | add\" < \"$NIX_ATTRS_JSON_FILE\" > $out/total-nar-size\n jq -r '.closure | map([.path, .narHash, .narSize, \"\", (.references | length)] + .references) | add | map(\"\\(.)\\n\") | add' < \"$NIX_ATTRS_JSON_FILE\" | head -n -1 > $out/registration\n jq -r '.closure[].path' < \"$NIX_ATTRS_JSON_FILE\" > ←$out/store-paths\nfi\n\n","buildInputs":[],"builder":"/nix/store/0irlcqx2n3qm6b1pc9rsd2i8qpvcccaj-bash-5.2p37/bin/bash","cmakeFlags":[],"configureFlags":[],"depsBuildBuild":[],"depsBuildBuildPropagated":[],"depsBuildTarget":[],"depsBuildTargetPropagated":[],"depsHostHost":[],"depsHostHostPropagated":[],"depsTargetTarget":[],"depsTargetTargetPropagated":[],"doCheck":false,"doInstallCheck":false,"empty":false,"env":{},"exportReferencesGraph":{"closure":["/nix/store/d7y3b5gy7i987fyz7hiij5zz1ad30g56-nixos-system-nixos-25.05pre-git"]},"mesonFlags":[],"name":"closure-info","nativeBuildInputs":["/nix/store/k48bha2fjqzarg52picsdfwlqx75aqbb-coreutils-9.5","/nix/store/f5y04jklz034w0y55bnqhcfnd271spwa-jq-1.7.1-dev"],"outputs":["out"],"patches":[],"preferLocalBuild":true,"propagatedBuildInputs":[],"propagatedNativeBuildInputs":[],"stdenv":"/nix/store/z50gnrdklgq4sfq59z2sw80mbnr9nrk3-stdenv-linux","strictDeps":false,"system":"x86_64-linux"}←→$out/store-paths\nfi\n\n","buildInputs":[],"builder":"/nix/store/0irlcqx2n3qm6b1pc9rsd2i8qpvcccaj-bash-5.2p37/bin/bash","cmakeFlags":[],"configureFlags":[],"depsBuildBuild":[],"depsBuildBuildPropagated":[],"depsBuildTarget":[],"depsBuildTargetPropagated":[],"depsHostHost":[],"depsHostHostPropagated":[],"depsTargetTarget":[],"depsTargetTargetPropagated":[],"doCheck":false,"doInstallCheck":false,"empty":false,"env":{},"exportReferencesGraph":{"closure":["/nix/store/y91g1jarnfzsrby3q6xy2rqc1aph9hm7-nixos-system-nixos-lxc-25.05pre-git"]},"mesonFlags":[],"name":"closure-info","nativeBuildInputs":["/nix/store/k48bha2fjqzarg52picsdfwlqx75aqbb-coreutils-9.5","/nix/store/f5y04jklz034w0y55bnqhcfnd271spwa-jq-1.7.1-dev"],"outputs":["out"],"patches":[],"preferLocalBuild":true,"propagatedBuildInputs":[],"propagatedNativeBuildInputs":[],"stdenv":"/nix/store/z50gnrdklgq4sfq59z2sw80mbnr9nrk3-stdenv-linux","strictDeps":false,"system":"x86_64-linux"}→
''
• Skipping environment comparison
lxc-metadata
- result/master/lxc-metadata:{out}
+ result/new/lxc-metadata:{out}
• The input derivation named `metadata.yaml` differs
- /nix/store/mh11nwcqhwz3wka5ljjybvj63h93ggf0-metadata.yaml.drv:{out}
+ /nix/store/9hv2rql893sijik3jbcq4ar0ckgj5xfc-metadata.yaml.drv:{out}
• The environments do not match:
text=''
{"architecture":"x86_64","creation_date":1,"properties":{"description":"NixOS Warbler ←25.05pre-git←→lxc-metadata-25.05pre-git→ x86_64-linux","os":"nixos","release":"Warbler"},"templates":{}}
''
• Skipping environment comparison
oci
- result/master/oci:{out}
+ result/new/oci:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-oci-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/njw9xgf8qvzjypx07ckiw9zdb47jjmnc-closure-info.drv:{out}
+ /nix/store/xijgws2n0mh37rrama1v4jknl0hg7wrz-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-oci-25.05pre-git
• The input derivation named `nixos-25.05pre-git` differs
- /nix/store/icnva3w4w72x72d7rj2yjkllamh8s67q-nixos-25.05pre-git.drv:{out}
+ /nix/store/brlzsqwvlkzbw3apqncqbf70m9ndrbnd-nixos-25.05pre-git.drv:{out}
• The input source named `source` differs
• The environments do not match:
buildCommand=''
mkdir -p $out
cp -prd ←/nix/store/pavyzp5xf2mrzh98l3xnpz3g9b7z4zxy-source←→/nix/store/r82zv817z34g7zasq20iwdrx630jzqsv-source→ $out/nixos
chmod -R u+w $out/nixos
if [ ! -e $out/nixos/nixpkgs ]; then
ln -s . $out/nixos/nixpkgs
fi
rm -rf $out/nixos/.git
echo -n pre-git > $out/nixos/.version-suffix
''
• Skipping environment comparison
• The input derivation named `nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
openstack
- result/master/openstack:{out}
+ result/new/openstack:{out}
• The set of input derivation names do not match:
- nixos-system-unnamed-25.05pre-git
+ nixos-system-unnamed-openstack-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/zicgylaha7fvlsidmabigi3pjsxy888d-closure-info.drv:{out}
+ /nix/store/hc31d9nrgmc9hqgdxbf2lns46hxqgicg-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-unnamed-25.05pre-git
+ nixos-system-unnamed-openstack-25.05pre-git
• The input derivation named `nixos-25.05pre-git` differs
- /nix/store/icnva3w4w72x72d7rj2yjkllamh8s67q-nixos-25.05pre-git.drv:{out}
+ /nix/store/brlzsqwvlkzbw3apqncqbf70m9ndrbnd-nixos-25.05pre-git.drv:{out}
• The input source named `source` differs
• The environments do not match:
buildCommand=''
mkdir -p $out
cp -prd ←/nix/store/pavyzp5xf2mrzh98l3xnpz3g9b7z4zxy-source←→/nix/store/r82zv817z34g7zasq20iwdrx630jzqsv-source→ $out/nixos
chmod -R u+w $out/nixos
if [ ! -e $out/nixos/nixpkgs ]; then
ln -s . $out/nixos/nixpkgs
fi
rm -rf $out/nixos/.git
echo -n pre-git > $out/nixos/.version-suffix
''
• Skipping environment comparison
• The input derivation named `nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
openstack-zfs
- result/master/openstack-zfs:{out}
+ result/new/openstack-zfs:{out}
• The set of input derivation names do not match:
- nixos-system-unnamed-25.05pre-git
+ nixos-system-unnamed-openstack-zfs-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/fmwsrlrl4bjcwrxjlh1fayvshvgfalv7-closure-info.drv:{out}
+ /nix/store/m3ss36rj6r5qq3baj9ny7nypn1yf9hi7-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-unnamed-25.05pre-git
+ nixos-system-unnamed-openstack-zfs-25.05pre-git
• The input derivation named `nixos-25.05pre-git` differs
- /nix/store/icnva3w4w72x72d7rj2yjkllamh8s67q-nixos-25.05pre-git.drv:{out}
+ /nix/store/brlzsqwvlkzbw3apqncqbf70m9ndrbnd-nixos-25.05pre-git.drv:{out}
• The input source named `source` differs
• The environments do not match:
buildCommand=''
mkdir -p $out
cp -prd ←/nix/store/pavyzp5xf2mrzh98l3xnpz3g9b7z4zxy-source←→/nix/store/r82zv817z34g7zasq20iwdrx630jzqsv-source→ $out/nixos
chmod -R u+w $out/nixos
if [ ! -e $out/nixos/nixpkgs ]; then
ln -s . $out/nixos/nixpkgs
fi
rm -rf $out/nixos/.git
echo -n pre-git > $out/nixos/.version-suffix
''
• Skipping environment comparison
• The input derivation named `nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
proxmox
- result/master/proxmox:{out}
+ result/new/proxmox:{out}
• The input derivation named `closure-info` differs
- /nix/store/g2w69b0kcjhvq2ii12s3abzvsqn02y3v-closure-info.drv:{out}
+ /nix/store/wz33s7d9mcz27hbvhrwd8djlc6ybyh41-closure-info.drv:{out}
• The input derivation named `nixos-25.05pre-git` differs
- /nix/store/icnva3w4w72x72d7rj2yjkllamh8s67q-nixos-25.05pre-git.drv:{out}
+ /nix/store/brlzsqwvlkzbw3apqncqbf70m9ndrbnd-nixos-25.05pre-git.drv:{out}
• The input source named `source` differs
• The environments do not match:
buildCommand=''
mkdir -p $out
cp -prd ←/nix/store/pavyzp5xf2mrzh98l3xnpz3g9b7z4zxy-source←→/nix/store/r82zv817z34g7zasq20iwdrx630jzqsv-source→ $out/nixos
chmod -R u+w $out/nixos
if [ ! -e $out/nixos/nixpkgs ]; then
ln -s . $out/nixos/nixpkgs
fi
rm -rf $out/nixos/.git
echo -n pre-git > $out/nixos/.version-suffix
''
• The input derivation named `nixos-system-unnamed-25.05pre-git` differs
- /nix/store/nznq8gaa69q9jl34wdfiz5v42cynrdm3-nixos-system-unnamed-25.05pre-git.drv:{out}
+ /nix/store/185f4zzx0vf3g6qzz20fqrfa4810kmdw-nixos-system-unnamed-25.05pre-git.drv:{out}
• The input derivation named `etc` differs
- /nix/store/j4ylwv5d08f40578f0a3999h78q2rkna-etc.drv:{out}
+ /nix/store/fn4j6xsq6wm9am432qcaw9ipz79hwlr3-etc.drv:{out}
• The input derivation named `dbus-1` differs
- /nix/store/a8ib2v6gnlxg4lc10w6j8c412mvnikpg-dbus-1.drv:{out}
+ /nix/store/pdjpngg5fdgwp3s519ybhzbgsayij946-dbus-1.drv:{out}
• The input derivation named `system-path` differs
- /nix/store/wh0srr6z3ba33yj571g6vl5nbdxg1q2n-system-path.drv:{out}
+ /nix/store/pl21y155lrqfjyxy05z0mz01dpp7b5ag-system-path.drv:{out}
• The input derivation named `nixos-rebuild` differs
- /nix/store/x8w3s72v1nd6r830pkcnai0vrllrzwjx-nixos-rebuild.drv:{out}
+ /nix/store/yb5jb0wpglskm5kfwzv5nfjbhnqwxz18-nixos-rebuild.drv:{out}
• The input source named `nixos-rebuild.8` differs
''
.Dd January 1, 1980
.Dt nixos-rebuild 8
.Os
.Sh NAME
.Nm nixos-rebuild
.Nd reconfigure a NixOS machine
.
.
.
.Sh SYNOPSIS
.Nm
.Bro
.Cm switch | boot | test | build | dry-build | dry-activate | edit | repl | build-vm | build-vm-with-bootloader | →build-image→→ →→|→→ →list-generations Op Fl -json
.Brc
.br
.Op Fl -upgrade | -upgrade-all
.Op Fl -install-bootloader
.Op Fl -no-build-nix
.Op Fl -fast
.Op Fl -rollback
.br
.Op Fl -file | f Ar path
.Op Fl -attr | A Ar attrPath
.Op Fl -flake Ar flake-uri
.Op Fl -no-flake
.Op Fl -recreate-lock-file
.Op Fl -no-update-lock-file
.Op Fl -no-write-lock-file
.Op Fl -no-registries
.Op Fl -commit-lock-file
.Op Fl -update-input Ar input-path
.Op Fl -override-input Ar input-path flake-url
.br
.Op Fl -profile-name | p Ar name
.Op Fl -specialisation | c Ar name
.br
.Op Fl →-image-variant→→ →→Ar→→ →→variant→→
→→.br→→
→→.Op→→ →→Fl→→ →-build-host Va host
.Op Fl -target-host Va host
.Op Fl -use-remote-sudo
.Op Fl -no-ssh-tty
.br
.Op Fl -verbose | v
.Op Fl -quiet
.Op Fl -log-format Ar format
.Op Fl -no-build-output | Q
.Op Fl -max-jobs | j Va number
.Op Fl -cores Va number
.Op Fl -keep-going | k
.Op Fl -keep-failed | K
.Op Fl -fallback
.Op Fl I Va NIX_PATH
.Op Fl -option Ar name value
.Op Fl -repair
.Op Fl -builders Va builder-spec
.Op Fl -accept-flake-config
.Op Fl -print-build-logs | L
.Op Fl -show-trace
.Op Fl -refresh
.Op Fl -impure
.Op Fl -offline
.Op Fl -no-net
.
.
.
.Sh DESCRIPTION
This command updates the system so that it corresponds to the
configuration specified in
.Pa /etc/nixos/configuration.nix Ns
,
.Pa /etc/nixos/flake.nix
or the file and attribute specified by the
.Fl -file
and/or
.Fl -attr
options. Thus, every time you modify the configuration or any other NixOS
module, you must run
.Nm
to make the changes take effect. It builds the new system in
.Pa /nix/store Ns
, runs its activation script, and stop and (re)starts any system services if
needed. Please note that user services need to be started manually as they
aren't detected by the activation script at the moment.
.
.Pp
This command has one required argument, which specifies the desired
operation. It must be one of the following:
.Bl -tag -width indent
.It Cm switch
Build and activate the new configuration, and make it the boot default. That
is, the configuration is added to the GRUB boot menu as the default
menu entry, so that subsequent reboots will boot the system into the new
configuration. Previous configurations activated with
.Ic nixos-rebuild switch
or
.Ic nixos-rebuild boot
remain available in the GRUB menu.
.Pp
Note that if you are using specializations, running just
.Ic nixos-rebuild switch
will switch you back to the unspecialized, base system \(em in that case, you
might want to use this instead:
.Bd -literal -offset indent
$ nixos-rebuild switch --specialisation your-specialisation-name
.Ed
.Pp
This command will build all specialisations and make them bootable just
like regular
.Ic nixos-rebuild switch
does \(em the only thing different is that it will switch to given
specialisation instead of the base system; it can be also used to switch from
the base system into a specialised one, or to switch between specialisations.
.
.It Cm boot
Build the new configuration and make it the boot default (as with
.Ic nixos-rebuild switch Ns
), but do not activate it. That is, the system continues to run the previous
configuration until the next reboot.
.
.It Cm test
Build and activate the new configuration, but do not add it to the GRUB
boot menu. Thus, if you reboot the system (or if it crashes), you will
automatically revert to the default configuration (i.e. the
configuration resulting from the last call to
.Ic nixos-rebuild switch
or
.Ic nixos-rebuild boot Ns
).
.Pp
Note that if you are using specialisations, running just
.Ic nixos-rebuild test
will activate the unspecialised, base system \(em in that case, you might want
to use this instead:
.Bd -literal -offset indent
$ nixos-rebuild test --specialisation your-specialisation-name
.Ed
.Pp
This command can be also used to switch from the base system into a
specialised one, or to switch between specialisations.
.
.It Cm build
Build the new configuration, but neither activate it nor add it to the
GRUB boot menu. It leaves a symlink named
.Pa result
in the current directory, which points to the output of the top-level
.Dq system
derivation. This is essentially the same as doing
.Bd -literal -offset indent
$ nix-build /path/to/nixpkgs/nixos -A system
.Ed
.Pp
Note that you do not need to be root to run
.Ic nixos-rebuild build Ns
\&.
.
.It Cm dry-build
Show what store paths would be built or downloaded by any of the
operations above, but otherwise do nothing.
.
.It Cm dry-activate
Build the new configuration, but instead of activating it, show what
changes would be performed by the activation (i.e. by
.Ic nixos-rebuild test Ns
). For instance, this command will print which systemd units would be restarted.
The list of changes is not guaranteed to be complete.
.
.It Cm edit
Opens
.Pa configuration.nix
in the default editor.
.
.It Cm repl
Opens the configuration in
.Ic nix repl Ns .
.
.It Cm build-vm
Build a script that starts a NixOS virtual machine with the desired
configuration. It leaves a symlink
.Pa result
in the current directory that points (under
.Ql result/bin/run\- Ns Va hostname Ns \-vm Ns
)
at the script that starts the VM. Thus, to test a NixOS configuration in
a virtual machine, you should do the following:
.Bd -literal -offset indent
$ nixos-rebuild build-vm
$ ./result/bin/run-*-vm
.Ed
.Pp
The VM is implemented using the
.Ql qemu
package. For best performance, you should load the
.Ql kvm-intel
or
.Ql kvm-amd
kernel modules to get hardware virtualisation.
.Pp
The VM mounts the Nix store of the host through the 9P file system. The
host Nix store is read-only, so Nix commands that modify the Nix store
will not work in the VM. This includes commands such as
.Nm Ns
; to change the VM’s configuration, you must halt the VM and re-run the commands
above.
.Pp
The VM has its own ext3 root file system, which is automatically created when
the VM is first started, and is persistent across reboots of the VM. It is
stored in
.Ql ./ Ns Va hostname Ns .qcow2 Ns
\&.
.\" The entire file system hierarchy of the host is available in
.\" the VM under
.\" .Pa /hostfs Ns
.\" .
.
.It Cm build-vm-with-bootloader
Like
.Cm build-vm Ns
, but boots using the regular boot loader of your configuration (e.g. GRUB 1 or
2), rather than booting directly into the kernel and initial ramdisk of the
system. This allows you to test whether the boot loader works correctly. \
However, it does not guarantee that your NixOS configuration will boot
successfully on the host hardware (i.e., after running
.Ic nixos-rebuild switch Ns
), because the hardware and boot loader configuration in the VM are different.
The boot loader is installed on an automatically generated virtual disk
containing a
.Pa /boot
partition.
.
.It Cm →build-image→→
→→Build→→ →→a→→ →→disk-image→→ →→variant,→→ →→pre-configured→→ →→for→→ →→the→→ →→given→→ →→platform/provider.→→
→→Select→→ →→a→→ →→variant→→ →→with→→ →→the→→
→→.Fl→→ →→--image-variant→→
→→option→→ →→or→→ →→run→→ →→without→→ →→any→→ →→options→→ →→to→→ →→get→→ →→a→→ →→list→→ →→of→→ →→available→→ →→variants.→→
→→.Bd→→ →→-literal→→ →→-offset→→ →→indent→→
→→$→→ →→nixos-rebuild→→ →→build-image→→ →→--image-variant→→ →→proxmox→→
→→.Ed→→
→→.→→
→→.It→→ →→Cm→→ →list-generations Op Fl -json
List the available generations in a similar manner to the boot loader
menu. It shows the generation number, build date and time, NixOS version,
kernel version and the configuration revision.
There is also a json version of output available.
.El
.
.
.
.Sh OPTIONS
.Bl -tag -width indent
.It Fl -upgrade , -upgrade-all
Update the root user's channel named
.Ql nixos
before rebuilding the system.
.Pp
In addition to the
.Ql nixos
channel, the root user's channels which have a file named
.Ql .update-on-nixos-rebuild
in their base directory will also be updated.
.Pp
Passing
.Fl -upgrade-all
updates all of the root user's channels.
.
.It Fl -install-bootloader
Causes the boot loader to be (re)installed on the device specified by the
relevant configuration options.
.
.It Fl -no-build-nix
Normally,
.Nm
first builds the
.Ql nixUnstable
attribute in Nixpkgs, and uses the resulting instance of the Nix package manager
to build the new system configuration. This is necessary if the NixOS modules
use features not provided by the currently installed version of Nix. This option
disables building a new Nix.
.
.It Fl -fast
Equivalent to
.Fl -no-build-nix Ns
\&. This option is useful if you call
.Nm
frequently (e.g. if you’re hacking on a NixOS module).
.
.It Fl -rollback
Instead of building a new configuration as specified by
.Pa /etc/nixos/configuration.nix Ns
, roll back to the previous configuration. (The previous configuration is
defined as the one before the “current” generation of the Nix profile
.Pa /nix/var/nix/profiles/system Ns
\&.)
.
.It Fl -builders Ar builder-spec
Allow ad-hoc remote builders for building the new system. This requires
the user executing
.Nm
(usually root) to be configured as a trusted user in the Nix daemon. This can be
achieved by using the
.Va nix.settings.trusted-users
NixOS option. Examples values for that option are described in the
.Dq Remote builds
chapter in the Nix manual, (i.e.
.Ql --builders \(dqssh://bigbrother x86_64-linux\(dq Ns
). By specifying an empty string existing builders specified in
.Pa /etc/nix/machines
can be ignored:
.Ql --builders \(dq\(dq
for example when they are not reachable due to network connectivity.
.
.It Fl -profile-name Ar name , Fl p Ar name
Instead of using the Nix profile
.Pa /nix/var/nix/profiles/system
to keep track of the current and previous system configurations, use
.Pa /nix/var/nix/profiles/system-profiles/ Ns Va name Ns
\&. When you use GRUB 2, for every system profile created with this flag, NixOS
will create a submenu named
.Dq NixOS - Profile Va name
in GRUB’s boot menu, containing the current and previous configurations of this profile.
.Pp
For instance, if you want to test a configuration file named
.Pa test.nix
without affecting the default system profile, you would do:
.Bd -literal -offset indent
$ nixos-rebuild switch -p test -I nixos-config=./test.nix
.Ed
.Pp
The new configuration will appear in the GRUB 2 submenu
.Dq NixOS - Profile 'test' Ns
\&.
.
.It Fl -specialisation Ar name , Fl c Ar name
Activates given specialisation; when not specified, switching and testing
will activate the base, unspecialised system.→
→→.→→
→→.It→→ →→Fl→→ →→-image-variant→→ →→Ar→→ →→variant→→
→→Selects→→ →→an→→ →→image→→ →→variant→→ →→to→→ →→build→→ →→from→→
→→the→→
→→.Va→→ →→config.system.build.images→→
→→attribute→→ →→of→→ →→the→→ →→given→→ →→configuration.→→ →→A→→ →→list→→ →→of→→ →→variants→→ →→is→→ →→printed→→ →→if→→ →→this→→ →→option→→ →→remains→→ →→unset.→
.
.It Fl -build-host Ar host
Instead of building the new configuration locally, use the specified host
to perform the build. The host needs to be accessible with
.Ic ssh Ns ,
and must be able to perform Nix builds. If the option
.Fl -target-host
is not set, the build will be copied back to the local machine when done.
.Pp
Note that, if
.Fl -no-build-nix
is not specified, Nix will be built both locally and remotely. This is because
the configuration will always be evaluated locally even though the building
might be performed remotely.
.Pp
You can include a remote user name in the host name
.Ns ( Va user@host Ns
). You can also set ssh options by defining the
.Ev NIX_SSHOPTS
environment variable.
.
.It Fl -target-host Ar host
Specifies the NixOS target host. By setting this to something other than an
empty string, the system activation will happen on the remote host instead of
the local machine. The remote host needs to be accessible over
.Ic ssh Ns ,
and for the commands
.Cm switch Ns
,
.Cm boot
and
.Cm test
you need root access.
.Pp
If
.Fl -build-host
is not explicitly specified or empty, building will take place locally.
.Pp
You can include a remote user name in the host name
.Ns ( Va user@host Ns
). You can also set ssh options by defining the
.Ev NIX_SSHOPTS
environment variable.
.Pp
Note that
.Nm
honors the
.Va nixpkgs.crossSystem
setting of the given configuration but disregards the true architecture of the
target host. Hence the
.Va nixpkgs.crossSystem
setting has to match the target platform or else activation will fail.
.
.It Fl -use-substitutes
When set, nixos-rebuild will add
.Fl -use-substitutes
to each invocation of nix-copy-closure. This will only affect the behavior of
nixos-rebuild if
.Fl -target-host
or
.Fl -build-host
is also set. This is useful when the target-host connection to cache.nixos.org
is faster than the connection between hosts.
.
.It Fl -use-remote-sudo
When set, nixos-rebuild prefixes activation commands that run on the
.Fl -target-host
system with
.Ic sudo Ns
\&. Setting this option allows deploying as a non-root user.
.
.It Fl -no-ssh-tty
When set, nixos-rebuild will not request a tty when executing commands on the
.Fl -target-host
system with
.Ic ssh Ns
\&. This may help avoid corrupted terminal output when running multiple
nixos-rebuild commands in parallel, but may also prevent the remote
.Ic sudo
from working properly.
.
.It Fl -file Ar path , Fl f Ar path
Enable and build the NixOS system from the specified file. The file must
evaluate to an attribute set, and it must contain a valid NixOS configuration
at attribute
.Va attrPath Ns
\&. This is useful for building a NixOS system from a nix file that is not
a flake or a NixOS configuration module. Attribute set a with valid NixOS
configuration can be made using
.Va nixos
function in nixpkgs or importing and calling
.Pa nixos/lib/eval-config.nix
from nixpkgs. If specified without
.Fl -attr
option, builds the configuration from the top-level
attribute of the file.
.
.It Fl -attr Ar attrPath , Fl A Ar attrPath
Enable and build the NixOS system from nix file and use the specified attribute
path from file specified by the
.Fl -file
option. If specified without
.Fl -file
option, uses
.Pa default.nix
in current directory.
.
.It Fl -flake Va flake-uri Ns Op Va #name
Build the NixOS system from the specified flake. It defaults to the directory
containing the target of the symlink
.Pa /etc/nixos/flake.nix Ns
, if it exists. The flake must contain an output named
.Ql nixosConfigurations. Ns Va name Ns
\&. If
.Va name
is omitted, it default to the current host name.
.
.It Fl -no-flake
Do not imply
.Fl -flake
if
.Pa /etc/nixos/flake.nix
exists. With this option, it is possible to build non-flake NixOS configurations
even if the current NixOS systems uses flakes.
.El
.Pp
In addition,
.Nm
accepts following options from nix commands that the tool calls:
.
.Pp
flake-related options:
.Bd -offset indent
.Fl -recreate-lock-file Ns ,
.Fl -no-update-lock-file Ns ,
.Fl -no-write-lock-file Ns ,
.Fl -no-registries Ns ,
.Fl -commit-lock-file Ns ,
.Fl -update-input Ar input-path Ns ,
.Fl -override-input Ar input-path flake-url Ns
.Ed
.
.Pp
Builder options:
.Bd -offset indent
.Fl -verbose Ns ,
.Fl v Ns ,
.Fl -quiet Ns ,
.Fl -log-format Ns ,
.Fl -no-build-output Ns ,
.Fl Q Ns ,
.Fl -max-jobs Ns ,
.Fl j Ns ,
.Fl -cores Ns ,
.Fl -keep-going Ns ,
.Fl k Ns ,
.Fl -keep-failed Ns ,
.Fl K Ns ,
.Fl -fallback Ns ,
.Fl I Ns ,
.Fl -option Ns
.Fl -repair Ns ,
.Fl -builders Ns ,
.Fl -accept-flake-config Ns ,
.Fl -print-build-logs Ns ,
.Fl L Ns ,
.Fl -show-trace Ns ,
.Fl -refresh Ns ,
.Fl -impure Ns ,
.Fl -offline Ns ,
.Fl -no-net Ns
.Ed
.
.Pp
See the Nix manual,
.Ic nix flake lock --help
or
.Ic nix-build --help
for details.
.
.
.
.Sh ENVIRONMENT
.Bl -tag -width indent
.It Ev NIXOS_CONFIG
Path to the main NixOS configuration module. Defaults to
.Pa /etc/nixos/configuration.nix Ns
\&.
.
.It Ev NIX_PATH
A colon-separated list of directories used to look up Nix expressions enclosed
in angle brackets (e.g. <nixpkgs>). Example:
.Bd -literal -offset indent
nixpkgs=./my-nixpkgs
.Ed
.
.It Ev NIX_SSHOPTS
Additional options to be passed to
.Ic ssh
on the command line.
.Ed
.
.It Ev NIXOS_SWITCH_USE_DIRTY_ENV
Expose the the current environment variables to post activation scripts. Will
skip usage of
.Ic systemd-run
during system activation. Possibly dangerous, specially in remote environments
(e.g.: via SSH). Will be removed in the future.
.El
.
.
.
.Sh FILES
.Bl -tag -width indent
.It Pa /etc/nixos/flake.nix
If this file exists, then
.Nm
will use it as if the
.Fl -flake
option was given. This file may be a symlink to a
.Pa flake.nix
in an actual flake; thus
.Pa /etc/nixos
need not be a flake.
.
.It Pa /run/current-system
A symlink to the currently active system configuration in the Nix store.
.
.It Pa /nix/var/nix/profiles/system
The Nix profile that contains the current and previous system
configurations. Used to generate the GRUB boot menu.
.El
.
.
.
.Sh BUGS
This command should be renamed to something more descriptive.
.
.
.
.Sh AUTHORS
.An -nosplit
.An Eelco Dolstra
and
.An the Nixpkgs/NixOS contributors
''
• The input source named `nixos-rebuild.sh` differs
''
#! @runtimeShell@
# shellcheck shell=bash
if [ -x "@runtimeShell@" ]; then export SHELL="@runtimeShell@"; fi;
set -e
set -o pipefail
shopt -s inherit_errexit
export PATH=@path@:$PATH
showSyntax() {
exec man nixos-rebuild
exit 1
}
# Parse the command line.
origArgs=("$@")
copyFlags=()
extraBuildFlags=()
lockFlags=()
flakeFlags=(--extra-experimental-features 'nix-command flakes')
action=
buildNix=1
fast=
rollback=
upgrade=
upgrade_all=
profile=/nix/var/nix/profiles/system
specialisation=
→imageVariant=→→
→buildHost=
targetHost=
remoteSudo=
noSSHTTY=
verboseScript=
noFlake=
attr=
buildFile=default.nix
buildingAttribute=1
installBootloader=
json=
# log the given argument to stderr
log() {
echo "$@" >&2
}
while [ "$#" -gt 0 ]; do
i="$1"; shift 1
case "$i" in
--help)
showSyntax
;;
←switch|boot|test|build|edit|repl|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader|list-generations)←→switch|boot|test|build|edit|repl|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader|build-image|list-generations)→
if [ "$i" = dry-run ]; then i=dry-build; fi
if [ "$i" = list-generations ]; then
buildNix=
fast=1
fi
# exactly one action mandatory, bail out if multiple are given
if [ -n "$action" ]; then showSyntax; fi
action="$i"
;;
--file|-f)
if [ -z "$1" ]; then
log "$0: '$i' requires an argument"
exit 1
fi
buildFile="$1"
buildingAttribute=
shift 1
;;
--attr|-A)
if [ -z "$1" ]; then
log "$0: '$i' requires an argument"
exit 1
fi
attr="$1"
buildingAttribute=
shift 1
;;
--install-grub)
log "$0: --install-grub deprecated, use --install-bootloader instead"
installBootloader=1
;;
--install-bootloader)
installBootloader=1
;;
--no-build-nix)
buildNix=
;;
--rollback)
rollback=1
;;
--upgrade)
upgrade=1
;;
--upgrade-all)
upgrade=1
upgrade_all=1
;;
--use-substitutes|--substitute-on-destination|-s)
copyFlags+=("-s")
;;
-I|--builders)
j="$1"; shift 1
extraBuildFlags+=("$i" "$j")
;;
--max-jobs|-j|--cores|--log-format)
j="$1"; shift 1
extraBuildFlags+=("$i" "$j")
copyFlags+=("$i" "$j")
;;
--accept-flake-config|-j*|--quiet|--print-build-logs|-L|--no-build-output|-Q|--show-trace|--refresh|--impure|--offline|--no-net)
extraBuildFlags+=("$i")
;;
--keep-going|-k|--keep-failed|-K|--fallback|--repair)
extraBuildFlags+=("$i")
copyFlags+=("$i")
;;
--verbose|-v|-vv|-vvv|-vvvv|-vvvvv)
verboseScript="true"
extraBuildFlags+=("$i")
copyFlags+=("$i")
;;
--option)
j="$1"; shift 1
k="$1"; shift 1
extraBuildFlags+=("$i" "$j" "$k")
copyFlags+=("$i" "$j" "$k")
;;
--fast)
buildNix=
fast=1
;;
--profile-name|-p)
if [ -z "$1" ]; then
log "$0: ‘--profile-name’ requires an argument"
exit 1
fi
if [ "$1" != system ]; then
profile="/nix/var/nix/profiles/system-profiles/$1"
mkdir -p -m 0755 "$(dirname "$profile")"
fi
shift 1
;;
--specialisation|-c)
if [ -z "$1" ]; then
log "$0: ‘--specialisation’ requires an argument"
exit 1
fi
specialisation="$1"
shift 1
;;
→--image-variant)→→
→→if→→ →→[→→ →→-z→→ →→"$1"→→ →→];→→ →→then→→
→→log→→ →→"$0:→→ →→‘--image-variant’→→ →→requires→→ →→an→→ →→argument"→→
→→exit→→ →→1→→
→→fi→→
→→imageVariant="$1"→→
→→shift→→ →→1→→
→→;;→→
→--build-host)
buildHost="$1"
shift 1
;;
--target-host)
targetHost="$1"
shift 1
;;
--use-remote-sudo)
remoteSudo=1
;;
--no-ssh-tty)
noSSHTTY=1
;;
--flake)
flake="$1"
shift 1
;;
--no-flake)
noFlake=1
;;
--recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file)
lockFlags+=("$i")
;;
--update-input)
j="$1"; shift 1
lockFlags+=("$i" "$j")
;;
--override-input)
j="$1"; shift 1
k="$1"; shift 1
lockFlags+=("$i" "$j" "$k")
;;
--json)
json=1
;;
*)
log "$0: unknown option \`$i'"
exit 1
;;
esac
done
# log the given argument to stderr if verbose mode is on
logVerbose() {
if [ -n "$verboseScript" ]; then
echo "$@" >&2
fi
}
# Run a command, logging it first if verbose mode is on
runCmd() {
logVerbose "$" "$@"
"$@"
}
buildHostCmd() {
local c
if [[ "${useSudo:-x}" = 1 ]]; then
c=("sudo")
else
c=()
fi
if [ -z "$buildHost" ]; then
runCmd "$@"
elif [ -n "$remoteNix" ]; then
runCmd ssh $SSHOPTS "$buildHost" "${c[@]}" env PATH="$remoteNix":'$PATH' "$@"
else
runCmd ssh $SSHOPTS "$buildHost" "${c[@]}" "$@"
fi
}
targetHostCmd() {
local c
if [[ "${useSudo:-x}" = 1 ]]; then
c=("sudo")
else
c=()
fi
if [ -z "$targetHost" ]; then
runCmd "${c[@]}" "$@"
else
runCmd ssh $SSHOPTS "$targetHost" "${c[@]}" "$@"
fi
}
targetHostSudoCmd() {
local t=
if [[ ! "${noSSHTTY:-x}" = 1 ]]; then
t="-t"
fi
if [ -n "$remoteSudo" ]; then
useSudo=1 SSHOPTS="$SSHOPTS $t" targetHostCmd "$@"
else
# While a tty might not be necessary, we apply it to be consistent with
# sudo usage, and an experience that is more consistent with local deployment.
# But if the user really doesn't want it, don't do it.
SSHOPTS="$SSHOPTS $t" targetHostCmd "$@"
fi
}
copyToTarget() {
if ! [ "$targetHost" = "$buildHost" ]; then
if [ -z "$targetHost" ]; then
logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --from "$buildHost" "$1"
elif [ -z "$buildHost" ]; then
logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1"
else
buildHostCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1"
fi
fi
}
nixBuild() {
logVerbose "Building in legacy (non-flake) mode."
if [ -z "$buildHost" ]; then
logVerbose "No --build-host given, running nix-build locally"
runCmd nix-build "$@"
else
logVerbose "buildHost set to \"$buildHost\", running nix-build remotely"
local instArgs=()
local buildArgs=()
local drv=
while [ "$#" -gt 0 ]; do
local i="$1"; shift 1
case "$i" in
-o)
local out="$1"; shift 1
buildArgs+=("--add-root" "$out" "--indirect")
;;
-A)
local j="$1"; shift 1
instArgs+=("$i" "$j")
;;
-I) # We don't want this in buildArgs
shift 1
;;
--no-out-link) # We don't want this in buildArgs
;;
"<"*) # nix paths
instArgs+=("$i")
;;
*)
buildArgs+=("$i")
;;
esac
done
if [[ -z $buildingAttribute ]]; then
instArgs+=("$buildFile")
fi
drv="$(runCmd nix-instantiate "${instArgs[@]}" "${extraBuildFlags[@]}")"
if [ -a "$drv" ]; then
logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure --to "$buildHost" "$drv"
buildHostCmd nix-store -r "$drv" "${buildArgs[@]}"
else
log "nix-instantiate failed"
exit 1
fi
fi
}
nixFlakeBuild() {
logVerbose "Building in flake mode."
if [[ -z "$buildHost" && -z "$targetHost" && "$action" != switch && "$action" != boot && "$action" != test && "$action" != dry-activate ]]
then
runCmd nix "${flakeFlags[@]}" build "$@"
readlink -f ./result
elif [ -z "$buildHost" ]; then
runCmd nix "${flakeFlags[@]}" build "$@" --out-link "${tmpDir}/result"
readlink -f "${tmpDir}/result"
else
local attr="$1"
shift 1
local evalArgs=()
local buildArgs=()
local drv=
while [ "$#" -gt 0 ]; do
local i="$1"; shift 1
case "$i" in
--recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file)
evalArgs+=("$i")
;;
--update-input)
local j="$1"; shift 1
evalArgs+=("$i" "$j")
;;
--override-input)
local j="$1"; shift 1
local k="$1"; shift 1
evalArgs+=("$i" "$j" "$k")
;;
--impure) # We don't want this in buildArgs, it's only needed at evaluation time, and unsupported during realisation
;;
*)
buildArgs+=("$i")
;;
esac
done
drv="$(runCmd nix "${flakeFlags[@]}" eval --raw "${attr}.drvPath" "${evalArgs[@]}" "${extraBuildFlags[@]}")"
if [ -a "$drv" ]; then
logVerbose "Running nix with these NIX_SSHOPTS: $SSHOPTS"
NIX_SSHOPTS=$SSHOPTS runCmd nix "${flakeFlags[@]}" copy "${copyFlags[@]}" --derivation --to "ssh://$buildHost" "$drv"
buildHostCmd nix-store -r "$drv" "${buildArgs[@]}"
else
log "nix eval failed"
exit 1
fi
fi
}
if [ -z "$action" ]; then showSyntax; fi
# Only run shell scripts from the Nixpkgs tree if the action is
# "switch", "boot", or "test". With other actions (such as "build"),
# the user may reasonably expect that no code from the Nixpkgs tree is
# executed, so it's safe to run nixos-rebuild against a potentially
# untrusted tree.
canRun=
if [[ "$action" = switch || "$action" = boot || "$action" = test ]]; then
canRun=1
fi
# Verify that user is not trying to use attribute building and flake
# at the same time
if [[ -z $buildingAttribute && -n $flake ]]; then
log "error: '--flake' cannot be used with '--file' or '--attr'"
exit 1
fi
# If ‘--upgrade’ or `--upgrade-all` is given,
# run ‘nix-channel --update nixos’.
if [[ -n $upgrade && -z $_NIXOS_REBUILD_REEXEC && -z $flake ]]; then
# If --upgrade-all is passed, or there are other channels that
# contain a file called ".update-on-nixos-rebuild", update them as
# well. Also upgrade the nixos channel.
for channelpath in /nix/var/nix/profiles/per-user/root/channels/*; do
channel_name=$(basename "$channelpath")
if [[ "$channel_name" == "nixos" ]]; then
runCmd nix-channel --update "$channel_name"
elif [ -e "$channelpath/.update-on-nixos-rebuild" ]; then
runCmd nix-channel --update "$channel_name"
elif [[ -n $upgrade_all ]] ; then
runCmd nix-channel --update "$channel_name"
fi
done
fi
# Make sure that we use the Nix package we depend on, not something
# else from the PATH for nix-{env,instantiate,build}. This is
# important, because NixOS defaults the architecture of the rebuilt
# system to the architecture of the nix-* binaries used. So if on an
# amd64 system the user has an i686 Nix package in her PATH, then we
# would silently downgrade the whole system to be i686 NixOS on the
# next reboot.
if [ -z "$_NIXOS_REBUILD_REEXEC" ]; then
export PATH=@nix@/bin:$PATH
fi
# Use /etc/nixos/flake.nix if it exists. It can be a symlink to the
# actual flake.
if [[ -z $flake && -e /etc/nixos/flake.nix && -z $noFlake ]]; then
flake="$(dirname "$(readlink -f /etc/nixos/flake.nix)")"
fi
tmpDir=$(mktemp -t -d nixos-rebuild.XXXXXX)
if [[ ${#tmpDir} -ge 60 ]]; then
# Very long tmp dirs lead to "too long for Unix domain socket"
# SSH ControlPath errors. Especially macOS sets long TMPDIR paths.
rmdir "$tmpDir"
tmpDir=$(TMPDIR= mktemp -t -d nixos-rebuild.XXXXXX)
fi
cleanup() {
for ctrl in "$tmpDir"/ssh-*; do
ssh -o ControlPath="$ctrl" -O exit dummyhost 2>/dev/null || true
done
rm -rf "$tmpDir"
}
trap cleanup EXIT
SSHOPTS="$NIX_SSHOPTS -o ControlMaster=auto -o ControlPath=$tmpDir/ssh-%n -o ControlPersist=60"
# For convenience, use the hostname as the default configuration to
# build from the flake.
if [[ -n $flake ]]; then
if [[ $flake =~ ^(.*)\#([^\#\"]*)$ ]]; then
flake="${BASH_REMATCH[1]}"
flakeAttr="${BASH_REMATCH[2]}"
fi
if [[ -z $flakeAttr ]]; then
hostname="$(targetHostCmd cat /proc/sys/kernel/hostname)"
if [[ -z $hostname ]]; then
hostname=default
fi
flakeAttr="nixosConfigurations.\"$hostname\""
else
flakeAttr="nixosConfigurations.\"$flakeAttr\""
fi
fi
if [[ ! -z "$specialisation" && ! "$action" = switch && ! "$action" = test ]]; then
log "error: ‘--specialisation’ can only be used with ‘switch’ and ‘test’"
exit 1
fi
# Re-execute nixos-rebuild from the Nixpkgs tree.
if [[ -z $_NIXOS_REBUILD_REEXEC && -n $canRun && -z $fast ]]; then
if [[ -z $buildingAttribute ]]; then
p=$(runCmd nix-build --no-out-link $buildFile -A "${attr:+$attr.}config.system.build.nixos-rebuild" "${extraBuildFlags[@]}")
SHOULD_REEXEC=1
elif [[ -z $flake ]]; then
if p=$(runCmd nix-build --no-out-link --expr 'with import <nixpkgs/nixos> {}; config.system.build.nixos-rebuild' "${extraBuildFlags[@]}"); then
SHOULD_REEXEC=1
fi
else
runCmd nix "${flakeFlags[@]}" build --out-link "${tmpDir}/nixos-rebuild" "$flake#$flakeAttr.config.system.build.nixos-rebuild" "${extraBuildFlags[@]}" "${lockFlags[@]}"
if p=$(readlink -e "${tmpDir}/nixos-rebuild"); then
SHOULD_REEXEC=1
fi
fi
if [[ -n $SHOULD_REEXEC ]]; then
export _NIXOS_REBUILD_REEXEC=1
# Manually call cleanup as the EXIT trap is not triggered when using exec
cleanup
runCmd exec "$p/bin/nixos-rebuild" "${origArgs[@]}"
exit 1
fi
fi
# Find configuration.nix and open editor instead of building.
if [ "$action" = edit ]; then
if [[ -z $buildingAttribute ]]; then
log "error: '--file' and '--attr' are not supported with 'edit'"
exit 1
elif [[ -z $flake ]]; then
NIXOS_CONFIG=${NIXOS_CONFIG:-$(runCmd nix-instantiate --find-file nixos-config)}
if [[ -d $NIXOS_CONFIG ]]; then
NIXOS_CONFIG=$NIXOS_CONFIG/default.nix
fi
runCmd exec ${EDITOR:-nano} "$NIXOS_CONFIG"
else
runCmd exec nix "${flakeFlags[@]}" edit "${lockFlags[@]}" -- "$flake#$flakeAttr"
fi
exit 1
fi
# First build Nix, since NixOS may require a newer version than the
# current one.
if [[ -n "$rollback" || "$action" = dry-build ]]; then
buildNix=
fi
nixSystem() {
machine="$(uname -m)"
if [[ "$machine" =~ i.86 ]]; then
machine=i686
fi
echo $machine-linux
}
prebuiltNix() {
machine="$1"
if [ "$machine" = x86_64 ]; then
echo @nix_x86_64_linux@
elif [[ "$machine" =~ i.86 ]]; then
echo @nix_i686_linux@
elif [[ "$machine" = aarch64 ]]; then
echo @nix_aarch64_linux@
else
log "$0: unsupported platform"
exit 1
fi
}
getNixDrv() {
nixDrv=
if [[ -z $buildingAttribute ]]; then
if nixDrv="$(runCmd nix-instantiate $buildFile --add-root "$tmpDir/nix.drv" --indirect -A ${attr:+$attr.}config.nix.package.out "${extraBuildFlags[@]}")"; then return; fi
fi
if nixDrv="$(runCmd nix-instantiate '<nixpkgs/nixos>' --add-root "$tmpDir/nix.drv" --indirect -A config.nix.package.out "${extraBuildFlags[@]}")"; then return; fi
if nixDrv="$(runCmd nix-instantiate '<nixpkgs>' --add-root "$tmpDir/nix.drv" --indirect -A nix "${extraBuildFlags[@]}")"; then return; fi
if ! nixStorePath="$(runCmd nix-instantiate --eval '<nixpkgs/nixos/modules/installer/tools/nix-fallback-paths.nix>' -A "$(nixSystem)" | sed -e 's/^"//' -e 's/"$//')"; then
nixStorePath="$(prebuiltNix "$(uname -m)")"
fi
if ! runCmd nix-store -r "$nixStorePath" --add-root "${tmpDir}/nix" --indirect \
--option extra-binary-caches https://cache.nixos.org/; then
log "warning: don't know how to get latest Nix"
fi
# Older version of nix-store -r don't support --add-root.
[ -e "$tmpDir/nix" ] || ln -sf "$nixStorePath" "$tmpDir/nix"
if [ -n "$buildHost" ]; then
remoteNixStorePath="$(runCmd prebuiltNix "$(buildHostCmd uname -m)")"
remoteNix="$remoteNixStorePath/bin"
if ! buildHostCmd nix-store -r "$remoteNixStorePath" \
--option extra-binary-caches https://cache.nixos.org/ >/dev/null; then
remoteNix=
log "warning: don't know how to get latest Nix"
fi
fi
}
getVersion() {
local dir="$1"
local rev=
local gitDir="$dir/.git"
if [ -e "$gitDir" ]; then
if [ -z "$(type -P git)" ]; then
echo "warning: Git not found; cannot figure out revision of $dir" >&2
return
fi
cd "$dir"
rev=$(git --git-dir="$gitDir" rev-parse --short HEAD)
if git --git-dir="$gitDir" describe --always --dirty | grep -q dirty; then
rev+=M
fi
fi
if [ -n "$rev" ]; then
echo ".git.$rev"
fi
}
if [[ -n $buildNix && -z $flake ]]; then
log "building Nix..."
getNixDrv
if [ -a "$nixDrv" ]; then
nix-store -r "$nixDrv"'!'"out" --add-root "$tmpDir/nix" --indirect >/dev/null
if [ -n "$buildHost" ]; then
nix-copy-closure "${copyFlags[@]}" --to "$buildHost" "$nixDrv"
# The nix build produces multiple outputs, we add them all to the remote path
for p in $(buildHostCmd nix-store -r "$(readlink "$nixDrv")" "${buildArgs[@]}"); do
remoteNix="$remoteNix${remoteNix:+:}$p/bin"
done
fi
fi
PATH="$tmpDir/nix/bin:$PATH"
fi
# Update the version suffix if we're building from Git (so that
# nixos-version shows something useful).
if [[ -n $canRun && -z $flake ]]; then
if nixpkgs=$(runCmd nix-instantiate --find-file nixpkgs "${extraBuildFlags[@]}"); then
suffix=$(getVersion "$nixpkgs" || true)
if [ -n "$suffix" ]; then
echo -n "$suffix" > "$nixpkgs/.version-suffix" || true
fi
fi
fi
if [ "$action" = dry-build ]; then
extraBuildFlags+=(--dry-run)
fi
if [ "$action" = repl ]; then
# This is a very end user command, implemented using sub-optimal means.
# You should feel free to improve its behavior, as well as resolve tech
# debt in "breaking" ways. Humans adapt quite well.
if [[ -z $buildingAttribute ]]; then
exec nix repl --file $buildFile $attr "${extraBuildFlags[@]}"
elif [[ -z $flake ]]; then
exec nix repl --file '<nixpkgs/nixos>' "${extraBuildFlags[@]}"
else
if [[ -n "${lockFlags[0]}" ]]; then
# nix repl itself does not support locking flags
log "nixos-rebuild repl does not support locking flags yet"
exit 1
fi
d='$'
q='"'
bold="$(echo -e '\033[1m')"
blue="$(echo -e '\033[34;1m')"
attention="$(echo -e '\033[35;1m')"
reset="$(echo -e '\033[0m')"
if [[ -e $flake ]]; then
flakePath=$(realpath "$flake")
else
flakePath=$flake
fi
# This nix repl invocation is impure, because usually the flakeref is.
# For a solution that preserves the motd and custom scope, we need
# something like https://github.com/NixOS/nix/issues/8679.
exec nix repl --impure --expr "
let flake = builtins.getFlake ''$flakePath'';
configuration = flake.$flakeAttr;
motd = ''
$d{$q\n$q}
Hello and welcome to the NixOS configuration
$flakeAttr
in $flake
The following is loaded into nix repl's scope:
- ${blue}config${reset} All option values
- ${blue}options${reset} Option data and metadata
- ${blue}pkgs${reset} Nixpkgs package set
- ${blue}lib${reset} Nixpkgs library functions
- other module arguments
- ${blue}flake${reset} Flake outputs, inputs and source info of $flake
Use tab completion to browse around ${blue}config${reset}.
Use ${bold}:r${reset} to ${bold}reload${reset} everything after making a change in the flake.
(assuming $flake is a mutable flake ref)
See ${bold}:?${reset} for more repl commands.
${attention}warning:${reset} nixos-rebuild repl does not currently enforce pure evaluation.
'';
scope =
assert configuration._type or null == ''configuration'';
assert configuration.class or ''nixos'' == ''nixos'';
configuration._module.args //
configuration._module.specialArgs //
{
inherit (configuration) config options;
lib = configuration.lib or configuration.pkgs.lib;
inherit flake;
};
in builtins.seq scope builtins.trace motd scope
" "${extraBuildFlags[@]}"
fi
fi
if [ "$action" = list-generations ]; then
if [ ! -L "$profile" ]; then
log "No profile \`$(basename "$profile")' found"
exit 1
fi
generation_from_dir() {
generation_dir="$1"
generation_base="$(basename "$generation_dir")" # Has the format "system-123-link" for generation 123
no_link_gen="${generation_base%-link}" # remove the "-link"
echo "${no_link_gen##*-}" # remove everything before the last dash
}
describe_generation(){
generation_dir="$1"
generation_number="$(generation_from_dir "$generation_dir")"
nixos_version="$(cat "$generation_dir/nixos-version" 2> /dev/null || echo "Unknown")"
kernel_dir="$(dirname "$(realpath "$generation_dir/kernel")")"
kernel_version="$(ls "$kernel_dir/lib/modules" || echo "Unknown")"
configurationRevision="$("$generation_dir/sw/bin/nixos-version" --configuration-revision 2> /dev/null || true)"
# Old nixos-version output ignored unknown flags and just printed the version
# therefore the following workaround is done not to show the default output
nixos_version_default="$("$generation_dir/sw/bin/nixos-version")"
if [ "$configurationRevision" == "$nixos_version_default" ]; then
configurationRevision=""
fi
# jq automatically quotes the output => don't try to quote it in output!
build_date="$(stat "$generation_dir" --format=%W | jq 'todate')"
pushd "$generation_dir/specialisation/" > /dev/null || :
specialisation_list=(*)
popd > /dev/null || :
specialisations="$(jq --compact-output --null-input '$ARGS.positional' --args -- "${specialisation_list[@]}")"
if [ "$(basename "$generation_dir")" = "$(readlink "$profile")" ]; then
current_generation_tag="true"
else
current_generation_tag="false"
fi
# Escape userdefined strings
nixos_version="$(jq -aR <<< "$nixos_version")"
kernel_version="$(jq -aR <<< "$kernel_version")"
configurationRevision="$(jq -aR <<< "$configurationRevision")"
cat << EOF
{
"generation": $generation_number,
"date": $build_date,
"nixosVersion": $nixos_version,
"kernelVersion": $kernel_version,
"configurationRevision": $configurationRevision,
"specialisations": $specialisations,
"current": $current_generation_tag
}
EOF
}
find "$(dirname "$profile")" -regex "$profile-[0-9]+-link" |
sort -Vr |
while read -r generation_dir; do
describe_generation "$generation_dir"
done |
if [ -z "$json" ]; then
jq --slurp -r '.[] | [
([.generation, (if .current == true then "current" else "" end)] | join(" ")),
(.date | fromdate | strflocaltime("%Y-%m-%d %H:%M:%S")),
.nixosVersion, .kernelVersion, .configurationRevision,
(.specialisations | join(" "))
] | @tsv' |
column --separator $'\t' --table --table-columns "Generation,Build-date,NixOS version,Kernel,Configuration Revision,Specialisation"
else
jq --slurp .
fi
exit 0
fi
# Either upgrade the configuration in the system profile (for "switch"
# or "boot"), or just build it and create a symlink "result" in the
# current directory (for "build" and "test").
if [ -z "$rollback" ]; then
log "building the system configuration..."
if [[ "$action" = switch || "$action" = boot ]]; then
if [[ -z $buildingAttribute ]]; then
pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.toplevel" "${extraBuildFlags[@]}")"
elif [[ -z $flake ]]; then
pathToConfig="$(nixBuild '<nixpkgs/nixos>' --no-out-link -A system "${extraBuildFlags[@]}")"
else
pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
fi
copyToTarget "$pathToConfig"
targetHostSudoCmd nix-env -p "$profile" --set "$pathToConfig"
elif [[ "$action" = test || "$action" = build || "$action" = dry-build || "$action" = dry-activate ]]; then
if [[ -z $buildingAttribute ]]; then
pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.toplevel" "${extraBuildFlags[@]}")"
elif [[ -z $flake ]]; then
pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}")"
else
pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
fi
elif [ "$action" = build-vm ]; then
if [[ -z $buildingAttribute ]]; then
pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.vm" "${extraBuildFlags[@]}")"
elif [[ -z $flake ]]; then
pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vm -k "${extraBuildFlags[@]}")"
else
pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.vm" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
fi
elif [ "$action" = build-vm-with-bootloader ]; then
if [[ -z $buildingAttribute ]]; then
pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.vmWithBootLoader" "${extraBuildFlags[@]}")"
elif [[ -z $flake ]]; then
pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vmWithBootLoader -k "${extraBuildFlags[@]}")"
else
pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.vmWithBootLoader" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
fi
→elif→→ →→[→→ →→"$action"→→ →→=→→ →→build-image→→ →→];→→ →→then→→
→→if→→ →→[[→→ →→-z→→ →→$buildingAttribute→→ →→]];→→ →→then→→
→→variants="$(→→
→→runCmd→→ →→nix-instantiate→→ →→--eval→→ →→--strict→→ →→--json→→ →→--expr→→ →→\→→
→→"let→→
→→value→→ →→=→→ →→import→→ →→\"$(realpath→→ →→$buildFile)\";→→
→→set→→ →→=→→ →→if→→ →→builtins.isFunction→→ →→value→→ →→then→→ →→value→→ →→{}→→ →→else→→ →→value;→→
→→in→→ →→builtins.mapAttrs→→ →→(n:→→ →→v:→→ →→v.passthru.filePath)→→ →→set.${attr:+$attr.}config.system.build.images"→→ →→\→→
→→"${extraBuildFlags[@]}"→→
→→)"→→
→→elif→→ →→[[→→ →→-z→→ →→$flake→→ →→]];→→ →→then→→
→→variants="$(→→
→→runCmd→→ →→nix-instantiate→→ →→--eval→→ →→--strict→→ →→--json→→ →→--expr→→ →→\→→
→→"with→→ →→import→→ →→<nixpkgs/nixos>→→ →→{};→→ →→builtins.mapAttrs→→ →→(n:→→ →→v:→→ →→v.passthru.filePath)→→ →→config.system.build.images"→→ →→\→→
→→"${extraBuildFlags[@]}"→→
→→)"→→
→→else→→
→→variants="$(→→
→→runCmd→→ →→nix→→ →→"${flakeFlags[@]}"→→ →→eval→→ →→--json→→ →→\→→
→→"$flake#$flakeAttr.config.system.build.images"→→ →→\→→
→→--apply→→ →→"builtins.mapAttrs→→ →→(n:→→ →→v:→→ →→v.passthru.filePath)"→→ →→"${evalArgs[@]}"→→ →→"${extraBuildFlags[@]}"→→
→→)"→→
→→fi→→
→→if→→ →→!→→ →→echo→→ →→"$variants"→→ →→|→→ →→jq→→ →→-e→→ →→--arg→→ →→variant→→ →→"$imageVariant"→→ →→"keys→→ →→|→→ →→any(.→→ →→==→→ →→\$variant)"→→ →→>→→ →→/dev/null;→→ →→then→→
→→echo→→ →→-e→→ →→"Please→→ →→specify→→ →→one→→ →→of→→ →→the→→ →→following→→ →→supported→→ →→image→→ →→variants→→ →→via→→ →→--image-variant:\n"→→ →→>&2→→
→→echo→→ →→"$variants"→→ →→|→→ →→jq→→ →→-r→→ →→'.→→ →→|→→ →→keys→→ →→|→→ →→join→→ →→("\n")'→→
→→exit→→ →→1→→
→→fi→→
→→imageName="$(echo→→ →→"$variants"→→ →→|→→ →→jq→→ →→-r→→ →→--arg→→ →→variant→→ →→"$imageVariant"→→ →→".[\$variant]")"→→
→→if→→ →→[[→→ →→-z→→ →→$buildingAttribute→→ →→]];→→ →→then→→
→→pathToConfig="$(nixBuild→→ →→$buildFile→→ →→-A→→ →→"${attr:+$attr.}config.system.build.images.${imageVariant}"→→ →→"${extraBuildFlags[@]}")"→→
→→elif→→ →→[[→→ →→-z→→ →→$flake→→ →→]];→→ →→then→→
→→pathToConfig="$(nixBuild→→ →→'<nixpkgs/nixos>'→→ →→-A→→ →→config.system.build.images.${imageVariant}→→ →→-k→→ →→"${extraBuildFlags[@]}")"→→
→→else→→
→→pathToConfig="$(nixFlakeBuild→→ →→"$flake#$flakeAttr.config.system.build.images.${imageVariant}"→→ →→"${extraBuildFlags[@]}"→→ →→"${lockFlags[@]}")"→→
→→fi→→
→else
showSyntax
fi
# Copy build to target host if we haven't already done it
if ! [[ "$action" = switch || "$action" = boot ]]; then
copyToTarget "$pathToConfig"
fi
else # [ -n "$rollback" ]
if [[ "$action" = switch || "$action" = boot ]]; then
targetHostSudoCmd nix-env --rollback -p "$profile"
pathToConfig="$profile"
elif [[ "$action" = test || "$action" = build ]]; then
systemNumber=$(
targetHostCmd nix-env -p "$profile" --list-generations |
sed -n '/current/ {g; p;}; s/ *\([0-9]*\).*/\1/; h'
)
pathToConfig="$profile"-${systemNumber}-link
if [ -z "$targetHost" ]; then
ln -sT "$pathToConfig" ./result
fi
else
showSyntax
fi
fi
# If we're not just building, then make the new configuration the boot
# default and/or activate it now.
if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" = dry-activate ]]; then
# Using systemd-run here to protect against PTY failures/network
# disconnections during rebuild.
# See: https://github.com/NixOS/nixpkgs/issues/39118
cmd=(
"systemd-run"
"-E" "LOCALE_ARCHIVE" # Will be set to new value early in switch-to-configuration script, but interpreter starts out with old value
"-E" "NIXOS_INSTALL_BOOTLOADER=$installBootloader"
"--collect"
"--no-ask-password"
"--pipe"
"--quiet"
"--service-type=exec"
"--unit=nixos-rebuild-switch-to-configuration"
"--wait"
)
# Check if we have a working systemd-run. In chroot environments we may have
# a non-working systemd, so we fallback to not using systemd-run.
# You may also want to explicitly set NIXOS_SWITCH_USE_DIRTY_ENV environment
# variable, since systemd-run runs inside an isolated environment and
# this may break some post-switch scripts. However keep in mind that this
# may be dangerous in remote access (e.g. SSH).
if [[ -n "$NIXOS_SWITCH_USE_DIRTY_ENV" ]]; then
log "warning: skipping systemd-run since NIXOS_SWITCH_USE_DIRTY_ENV is set. This environment variable will be ignored in the future"
cmd=("env" "NIXOS_INSTALL_BOOTLOADER=$installBootloader")
elif ! targetHostSudoCmd "${cmd[@]}" true; then
logVerbose "Skipping systemd-run to switch configuration since it is not working in target host."
cmd=(
"env"
"-i"
"LOCALE_ARCHIVE=$LOCALE_ARCHIVE"
"NIXOS_INSTALL_BOOTLOADER=$installBootloader"
)
else
logVerbose "Using systemd-run to switch configuration."
fi
if [[ -z "$specialisation" ]]; then
cmd+=("$pathToConfig/bin/switch-to-configuration")
else
cmd+=("$pathToConfig/specialisation/$specialisation/bin/switch-to-configuration")
if [ -z "$targetHost" ]; then
specialisationExists=$(test -f "${cmd[-1]}")
else
specialisationExists=$(targetHostCmd test -f "${cmd[-1]}")
fi
if ! $specialisationExists; then
log "error: specialisation not found: $specialisation"
exit 1
fi
fi
if ! targetHostSudoCmd "${cmd[@]}" "$action"; then
log "warning: error(s) occurred while switching to the new configuration"
exit 1
fi
fi
if [[ "$action" = build-vm || "$action" = build-vm-with-bootloader ]]; then
cat >&2 <<EOF
Done. The virtual machine can be started by running $(echo "${pathToConfig}/bin/"run-*-vm)
EOF→
→→fi→→
→→if→→ →→[[→→ →→"$action"→→ →→=→→ →→build-image→→ →→]];→→ →→then→→
→→echo→→ →→-n→→ →→"Done.→→ →→The→→ →→disk→→ →→image→→ →→can→→ →→be→→ →→found→→ →→in→→ →→"→→ →→>&2→→
→→echo→→ →→"${pathToConfig}/${imageName}"→
fi
''
• The environments do not match:
postInstall=''
installManPage ←/nix/store/6rnxc38y8lbg6q0pfz3x6xc5qgff39ys-nixos-rebuild.8←→/nix/store/d6krrc888446800q4f7isvh20hrrpnyf-nixos-rebuild.8→
installShellCompletion \
--bash /nix/store/bakmakyqdlm8dnmzzk7w64n3zyq95hdl-_nixos-rebuild
''
src=''
←/nix/store/r77ynxfmdk39xs6fnszyk3y7ga0wl453-nixos-rebuild.sh←→/nix/store/hi01gjxrszidyadlxjmfiaf7x9qvia8v-nixos-rebuild.sh→
''
• Skipping environment comparison
• Skipping environment comparison
• The input derivation named `system-path` differs
• These two derivations have already been compared
• The input derivation named `system-units` differs
- /nix/store/xqywqxil2p3641vc5fknp5psg5pv46ax-system-units.drv:{out}
+ /nix/store/1as87z2y120hkyci76nnp25rxrphrb5g-system-units.drv:{out}
• The input derivation named `unit-dbus.service` differs
- /nix/store/lh8c5vgfcdmaxicnglrs22acq5wb14f2-unit-dbus.service.drv:{out}
+ /nix/store/lxhgkvyr062z4b3j3ms91g0cnczjl2i4-unit-dbus.service.drv:{out}
• The input derivation named `X-Restart-Triggers-dbus` differs
- /nix/store/5capyrrbqvsh6l26lkqfnn2qcn947321-X-Restart-Triggers-dbus.drv:{out}
+ /nix/store/x87anh9mc4kr2559vp4xbpvbfazr8r54-X-Restart-Triggers-dbus.drv:{out}
• The input derivation named `dbus-1` differs
• These two derivations have already been compared
• Skipping environment comparison
• Skipping environment comparison
• Skipping environment comparison
• The input derivation named `user-units` differs
- /nix/store/1zx4syyr9x7yxvg5xp3p2d4mdcmckfc6-user-units.drv:{out}
+ /nix/store/yysyz6a045n5x82l9nbmmkicjzmf3sg6-user-units.drv:{out}
• The input derivation named `unit-dbus.service` differs
- /nix/store/i8zngpyfpanbbxfxk1gnlhn5pwxdf9v7-unit-dbus.service.drv:{out}
+ /nix/store/cy8xss38pcwqrbk29lrgrb7rv3s3a5nn-unit-dbus.service.drv:{out}
• The input derivation named `X-Restart-Triggers-dbus` differs
• These two derivations have already been compared
• Skipping environment comparison
• Skipping environment comparison
• Skipping environment comparison
• The input derivation named `system-path` differs
• These two derivations have already been compared
• Skipping environment comparison
• Skipping environment comparison
• The input derivation named `nixos-25.05pre-git` differs
• These two derivations have already been compared
• The input derivation named `nixos-system-unnamed-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
proxmox-lxc
- result/master/proxmox-lxc:{out}
+ result/new/proxmox-lxc:{out}
• The set of input derivation names do not match:
- nixos-system-unnamed-25.05pre-git
+ nixos-system-unnamed-lxc-proxmox-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/3xy1hy4nmmb1ky190z88sdr2ndmwmyqi-closure-info.drv:{out}
+ /nix/store/wr4c81h3yb7saczrx43qalrzjmy4k65k-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-unnamed-25.05pre-git
+ nixos-system-unnamed-lxc-proxmox-25.05pre-git
• The environments do not match:
__json=''
{"buildCommand":"out=${outputs[out]}\n\nmkdir $out\n\nif [[ -n \"$empty\" ]]; then\n echo 0 > $out/total-nar-size\n touch $out/registration $out/store-paths\nelse\n jq -r \".closure | map(.narSize) | add\" < \"$NIX_ATTRS_JSON_FILE\" > $out/total-nar-size\n jq -r '.closure | map([.path, .narHash, .narSize, \"\", (.references | length)] + .references) | add | map(\"\\(.)\\n\") | add' < \"$NIX_ATTRS_JSON_FILE\" | head -n -1 > $out/registration\n jq -r '.closure[].path' < \"$NIX_ATTRS_JSON_FILE\" > ←$out/store-paths\nfi\n\n","buildInputs":[],"builder":"/nix/store/0irlcqx2n3qm6b1pc9rsd2i8qpvcccaj-bash-5.2p37/bin/bash","cmakeFlags":[],"configureFlags":[],"depsBuildBuild":[],"depsBuildBuildPropagated":[],"depsBuildTarget":[],"depsBuildTargetPropagated":[],"depsHostHost":[],"depsHostHostPropagated":[],"depsTargetTarget":[],"depsTargetTargetPropagated":[],"doCheck":false,"doInstallCheck":false,"empty":false,"env":{},"exportReferencesGraph":{"closure":["/nix/store/fhpib7hbr745nfirlcb6lkvp391rckdx-nixos-system-unnamed-25.05pre-git"]},"mesonFlags":[],"name":"closure-info","nativeBuildInputs":["/nix/store/k48bha2fjqzarg52picsdfwlqx75aqbb-coreutils-9.5","/nix/store/f5y04jklz034w0y55bnqhcfnd271spwa-jq-1.7.1-dev"],"outputs":["out"],"patches":[],"preferLocalBuild":true,"propagatedBuildInputs":[],"propagatedNativeBuildInputs":[],"stdenv":"/nix/store/z50gnrdklgq4sfq59z2sw80mbnr9nrk3-stdenv-linux","strictDeps":false,"system":"x86_64-linux"}←→$out/store-paths\nfi\n\n","buildInputs":[],"builder":"/nix/store/0irlcqx2n3qm6b1pc9rsd2i8qpvcccaj-bash-5.2p37/bin/bash","cmakeFlags":[],"configureFlags":[],"depsBuildBuild":[],"depsBuildBuildPropagated":[],"depsBuildTarget":[],"depsBuildTargetPropagated":[],"depsHostHost":[],"depsHostHostPropagated":[],"depsTargetTarget":[],"depsTargetTargetPropagated":[],"doCheck":false,"doInstallCheck":false,"empty":false,"env":{},"exportReferencesGraph":{"closure":["/nix/store/kyzbwyy89xxb4hsj3piv8gfklgl5a4ic-nixos-system-unnamed-lxc-proxmox-25.05pre-git"]},"mesonFlags":[],"name":"closure-info","nativeBuildInputs":["/nix/store/k48bha2fjqzarg52picsdfwlqx75aqbb-coreutils-9.5","/nix/store/f5y04jklz034w0y55bnqhcfnd271spwa-jq-1.7.1-dev"],"outputs":["out"],"patches":[],"preferLocalBuild":true,"propagatedBuildInputs":[],"propagatedNativeBuildInputs":[],"stdenv":"/nix/store/z50gnrdklgq4sfq59z2sw80mbnr9nrk3-stdenv-linux","strictDeps":false,"system":"x86_64-linux"}→
''
• Skipping environment comparison
sd-card
- result/master/sd-card:{out}
+ result/new/sd-card:{out}
• The input derivation named `ext4-fs.img.zst` differs
- /nix/store/qi4xmgyswx6v6d9bsq66sjrfymhnvmqy-ext4-fs.img.zst.drv:{out}
+ /nix/store/36d4s9h9az4c0lrnq6y58zzq2zxqx78v-ext4-fs.img.zst.drv:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-sd-card-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/1k5sbkdszg62g9k6ys7zzgx5rddkqpg9-closure-info.drv:{out}
+ /nix/store/sli71a36halz4y1fcn5ja2f1c6d9kr80-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-sd-card-25.05pre-git
• The environments do not match:
__json=''
{"buildCommand":"out=${outputs[out]}\n\nmkdir $out\n\nif [[ -n \"$empty\" ]]; then\n echo 0 > $out/total-nar-size\n touch $out/registration $out/store-paths\nelse\n jq -r \".closure | map(.narSize) | add\" < \"$NIX_ATTRS_JSON_FILE\" > $out/total-nar-size\n jq -r '.closure | map([.path, .narHash, .narSize, \"\", (.references | length)] + .references) | add | map(\"\\(.)\\n\") | add' < \"$NIX_ATTRS_JSON_FILE\" | head -n -1 > $out/registration\n jq -r '.closure[].path' < \"$NIX_ATTRS_JSON_FILE\" > ←$out/store-paths\nfi\n\n","buildInputs":[],"builder":"/nix/store/0irlcqx2n3qm6b1pc9rsd2i8qpvcccaj-bash-5.2p37/bin/bash","cmakeFlags":[],"configureFlags":[],"depsBuildBuild":[],"depsBuildBuildPropagated":[],"depsBuildTarget":[],"depsBuildTargetPropagated":[],"depsHostHost":[],"depsHostHostPropagated":[],"depsTargetTarget":[],"depsTargetTargetPropagated":[],"doCheck":false,"doInstallCheck":false,"empty":false,"env":{},"exportReferencesGraph":{"closure":["/nix/store/baf0fbrg1v6q39mw9w6byzd5g6fmr6fi-nixos-system-nixos-25.05pre-git"]},"mesonFlags":[],"name":"closure-info","nativeBuildInputs":["/nix/store/k48bha2fjqzarg52picsdfwlqx75aqbb-coreutils-9.5","/nix/store/f5y04jklz034w0y55bnqhcfnd271spwa-jq-1.7.1-dev"],"outputs":["out"],"patches":[],"preferLocalBuild":true,"propagatedBuildInputs":[],"propagatedNativeBuildInputs":[],"stdenv":"/nix/store/z50gnrdklgq4sfq59z2sw80mbnr9nrk3-stdenv-linux","strictDeps":false,"system":"x86_64-linux"}←→$out/store-paths\nfi\n\n","buildInputs":[],"builder":"/nix/store/0irlcqx2n3qm6b1pc9rsd2i8qpvcccaj-bash-5.2p37/bin/bash","cmakeFlags":[],"configureFlags":[],"depsBuildBuild":[],"depsBuildBuildPropagated":[],"depsBuildTarget":[],"depsBuildTargetPropagated":[],"depsHostHost":[],"depsHostHostPropagated":[],"depsTargetTarget":[],"depsTargetTargetPropagated":[],"doCheck":false,"doInstallCheck":false,"empty":false,"env":{},"exportReferencesGraph":{"closure":["/nix/store/6yxi9xx9cj6ml372nc7nym0bpcjbg4fn-nixos-system-nixos-sd-card-25.05pre-git"]},"mesonFlags":[],"name":"closure-info","nativeBuildInputs":["/nix/store/k48bha2fjqzarg52picsdfwlqx75aqbb-coreutils-9.5","/nix/store/f5y04jklz034w0y55bnqhcfnd271spwa-jq-1.7.1-dev"],"outputs":["out"],"patches":[],"preferLocalBuild":true,"propagatedBuildInputs":[],"propagatedNativeBuildInputs":[],"stdenv":"/nix/store/z50gnrdklgq4sfq59z2sw80mbnr9nrk3-stdenv-linux","strictDeps":false,"system":"x86_64-linux"}→
''
• Skipping environment comparison
• Skipping environment comparison
vagrant-virtualbox
- result/master/vagrant-virtualbox:{out}
+ result/new/vagrant-virtualbox:{out}
• The set of input derivation names do not match:
- nixos-ova-25.05pre-git-x86_64-linux
+ nixos-ova-vagrant-virtualbox-25.05pre-git-x86_64-linux
• The environments do not match:
buildCommand=''
→→→ →mkdir workdir←
←→
→cd workdir
# 1. create that metadata.json file
echo '{"provider":"virtualbox"}' > metadata.json
# 2. create a default Vagrantfile config
cat <<VAGRANTFILE > Vagrantfile
Vagrant.configure("2") do |config|
config.vm.base_mac = "0800275F0936"
end
VAGRANTFILE
# 3. add the exported VM files
tar xvf ←/nix/store/jmg0anvixp473b5s56lwq4rymah2wk7k-nixos-ova-25.05pre-git-x86_64-linux/*.ova←→/nix/store/qh6hw8cif5166402xp6sq13krkf1i52z-nixos-ova-vagrant-virtualbox-25.05pre-git-x86_64-linux/*.ova→
# 4. move the ovf to the fixed location
mv *.ovf box.ovf
# 5. generate OVF manifest file
rm *.mf
touch box.mf
for fname in *; do
checksum=$(sha256sum $fname | cut -d' ' -f 1)
echo "SHA256($fname)= $checksum" >> box.mf
done
# 6. compress everything back together
tar --owner=0 --group=0 --sort=name --numeric-owner -czf $out .
''
name=''
←virtualbox-vagrant.box←→nixos-image-vagrant-virtualbox-25.05pre-git-x86_64-linux.ova→
''
virtualbox
- result/master/virtualbox:{out}
+ result/new/virtualbox:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-virtualbox-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/mw89ag3qwb1jkjz9c58g6sh699l8ms9h-closure-info.drv:{out}
+ /nix/store/b8ilpn0bmqw3vngv4ydd4lfds5ci1xh1-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-virtualbox-25.05pre-git
• The input derivation named `nixos-25.05pre-git` differs
- /nix/store/icnva3w4w72x72d7rj2yjkllamh8s67q-nixos-25.05pre-git.drv:{out}
+ /nix/store/brlzsqwvlkzbw3apqncqbf70m9ndrbnd-nixos-25.05pre-git.drv:{out}
• The input source named `source` differs
• The environments do not match:
buildCommand=''
mkdir -p $out
cp -prd ←/nix/store/pavyzp5xf2mrzh98l3xnpz3g9b7z4zxy-source←→/nix/store/r82zv817z34g7zasq20iwdrx630jzqsv-source→ $out/nixos
chmod -R u+w $out/nixos
if [ ! -e $out/nixos/nixpkgs ]; then
ln -s . $out/nixos/nixpkgs
fi
rm -rf $out/nixos/.git
echo -n pre-git > $out/nixos/.version-suffix
''
• Skipping environment comparison
• The input derivation named `nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
vmware
- result/master/vmware:{out}
+ result/new/vmware:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-vmware-25.05pre-git
• The input derivation named `closure-info` differs
- /nix/store/fx6820x97w3yarlil5xrl6lbsij3qppi-closure-info.drv:{out}
+ /nix/store/cpnrjbshgqcnw1i8ja0bh9n2yivcd328-closure-info.drv:{out}
• The set of input derivation names do not match:
- nixos-system-nixos-25.05pre-git
+ nixos-system-nixos-vmware-25.05pre-git
• The input derivation named `nixos-25.05pre-git` differs
- /nix/store/icnva3w4w72x72d7rj2yjkllamh8s67q-nixos-25.05pre-git.drv:{out}
+ /nix/store/brlzsqwvlkzbw3apqncqbf70m9ndrbnd-nixos-25.05pre-git.drv:{out}
• The input source named `source` differs
• The environments do not match:
buildCommand=''
mkdir -p $out
cp -prd ←/nix/store/pavyzp5xf2mrzh98l3xnpz3g9b7z4zxy-source←→/nix/store/r82zv817z34g7zasq20iwdrx630jzqsv-source→ $out/nixos
chmod -R u+w $out/nixos
if [ ! -e $out/nixos/nixpkgs ]; then
ln -s . $out/nixos/nixpkgs
fi
rm -rf $out/nixos/.git
echo -n pre-git > $out/nixos/.version-suffix
''
• Skipping environment comparison
• The input derivation named `nixos-25.05pre-git` differs
• These two derivations have already been compared
• Skipping environment comparison
