!UKDpaKNNsBpOPfLWfX:zhaofeng.li

Colmena

324 Members
A simple, stateless NixOS deployment tool - https://github.com/zhaofengli/colmena110 Servers

Load older messages


SenderMessageTime
1 Dec 2022
@ask-yourself:matrix.org@ask-yourself:matrix.org Ok yeah, colmena apply-locall --sudo does not work with sudo turned off, even with deployment.privilegeEscalationCommand = ["doas"];. 19:10:44
@ask-yourself:matrix.org@ask-yourself:matrix.org * Ok yeah, colmena apply-local --sudo does not work with sudo turned off, even with deployment.privilegeEscalationCommand = ["doas"];. 19:10:51
@zhaofeng:zhaofeng.liZhaofeng Li Interesting, and it says something like sudo: command not found? 19:12:38
@zhaofeng:zhaofeng.liZhaofeng Li Just confirming, is the deployment.privilegeEscalationCommand set inside the host config? If it's outside, you may have inadvertently created a deployment node instead 19:14:14
@zhaofeng:zhaofeng.liZhaofeng Li
In reply to @linus:schreibt.jetzt
also, the heuristic results in 52 workers for me which... I think is deep into inappropriate territory for 32G of RAM :D
Well yeah, currently it assumes each node takes 512MB to evaluate 😅 Or (remaining_ram - 1024MB) / 512MB nodes
19:16:48
@ask-yourself:matrix.org@ask-yourself:matrix.org
In reply to @zhaofeng:zhaofeng.li
Interesting, and it says something like sudo: command not found?

This is the output for both commands:

.dotfiles on  main [!+] λ colmena apply-local --sudo
thread 'main' panicked at 'Failed to run sudo to escalate privileges: Os { code: 2, kind: NotFound, message: "No such file or directory" }', src/command/apply_local.rs:162:10
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

.dotfiles on  main [!+] ⊥ colmena apply-local
[WARN ] Colmena was not started by root. This is probably not going to work.
[WARN ] Hint: Add the --sudo flag.
warning: Git tree '/home/isaac/.dotfiles' is dirty
[INFO ] Using flake: git+file:///home/isaac/.dotfiles
warning: Git tree '/home/isaac/.dotfiles' is dirty
warning: Git tree '/home/isaac/.dotfiles' is dirty
        🕔 7s 2 succeeded
desktop ✅ 6s Evaluated desktop
        ❌ 7s Failed: Child process exited with error code: 1
desktop ✅ 6s Evaluated desktop
desktop ✅ 0s Built "/nix/store/pm7h842lz8c1jwx3crwj1hmwxn9hphr5-nixos-system-desktop-23.05pre-git"
desktop ✅ 0s Pushed system closure
desktop ❌ 0s Activation failed: Child process exited with error code: 1
[ERROR] Failed to deploy to desktop - Last 3 lines of logs:
[ERROR]  created)
[ERROR]    state) Running
[ERROR]  failure) Child process exited with error code: 1
[ERROR] Failed to complete requested operation - Last 1 lines of logs:
[ERROR]  failure) Child process exited with error code: 1
[ERROR] -----
[ERROR] Operation failed with error: Child process exited with error code: 1
19:23:20
@ask-yourself:matrix.org@ask-yourself:matrix.org
In reply to @zhaofeng:zhaofeng.li
Just confirming, is the deployment.privilegeEscalationCommand set inside the host config? If it's outside, you may have inadvertently created a deployment node instead
I think so, if you wanna see where I've set it up in full context, it's here: https://gitlab.com/IsaacBrown92/dotfiles/-/blob/main/nixos/desktop/security.nix
19:27:30
@zhaofeng:zhaofeng.liZhaofeng Li
In reply to @ask-yourself:matrix.org

This is the output for both commands:

.dotfiles on  main [!+] λ colmena apply-local --sudo
thread 'main' panicked at 'Failed to run sudo to escalate privileges: Os { code: 2, kind: NotFound, message: "No such file or directory" }', src/command/apply_local.rs:162:10
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

.dotfiles on  main [!+] ⊥ colmena apply-local
[WARN ] Colmena was not started by root. This is probably not going to work.
[WARN ] Hint: Add the --sudo flag.
warning: Git tree '/home/isaac/.dotfiles' is dirty
[INFO ] Using flake: git+file:///home/isaac/.dotfiles
warning: Git tree '/home/isaac/.dotfiles' is dirty
warning: Git tree '/home/isaac/.dotfiles' is dirty
        🕔 7s 2 succeeded
desktop ✅ 6s Evaluated desktop
        ❌ 7s Failed: Child process exited with error code: 1
desktop ✅ 6s Evaluated desktop
desktop ✅ 0s Built "/nix/store/pm7h842lz8c1jwx3crwj1hmwxn9hphr5-nixos-system-desktop-23.05pre-git"
desktop ✅ 0s Pushed system closure
desktop ❌ 0s Activation failed: Child process exited with error code: 1
[ERROR] Failed to deploy to desktop - Last 3 lines of logs:
[ERROR]  created)
[ERROR]    state) Running
[ERROR]  failure) Child process exited with error code: 1
[ERROR] Failed to complete requested operation - Last 1 lines of logs:
[ERROR]  failure) Child process exited with error code: 1
[ERROR] -----
[ERROR] Operation failed with error: Child process exited with error code: 1
Aha, you are using 0.3. Then you need --sudo-command=doas instead of deployment.privilegeEscalationCommand. 0.3 escalates privileges in apply-local eagerly at the beginning before evaluation.
19:43:42
@zhaofeng:zhaofeng.liZhaofeng LiIn the main development branch, it was changed to only escalate during activation using the configured privilege escalation command. 19:44:22
@ask-yourself:matrix.org@ask-yourself:matrix.orgOh, how can I be on the current version? 19:47:49
@zhaofeng:zhaofeng.liZhaofeng LiYou can use the flake of the unreleased version as mentioned here: https://colmena.cli.rs/unstable/tutorial/flakes.html19:49:03
@ask-yourself:matrix.org@ask-yourself:matrix.org Oh, so deployment.privilegeEscalationCommand is an unreleased feature? 19:52:08
@zhaofeng:zhaofeng.liZhaofeng Li It's used for the normal apply but for apply-local it's unreleased 19:52:54
@ask-yourself:matrix.org@ask-yourself:matrix.orgAhhh.19:53:42
@ask-yourself:matrix.org@ask-yourself:matrix.orgOk I see.19:53:44
@ask-yourself:matrix.org@ask-yourself:matrix.orgThank you very much.19:53:47
@ask-yourself:matrix.org@ask-yourself:matrix.org

Sry spoke too soon. That actually does not seem to resolve the issue:

.dotfiles on  main [!] λ colmena apply-local --sudo-command=doas
[WARN ] Colmena was not started by root. This is probably not going to work.
[WARN ] Hint: Add the --sudo flag.
warning: Git tree '/home/isaac/.dotfiles' is dirty
[INFO ] Using flake: git+file:///home/isaac/.dotfiles
warning: Git tree '/home/isaac/.dotfiles' is dirty
warning: Git tree '/home/isaac/.dotfiles' is dirty
        🕕 7s 2 succeeded
desktop ✅ 6s Evaluated desktop
        ❌ 7s Failed: Child process exited with error code: 1
desktop ✅ 6s Evaluated desktop
desktop ✅ 0s Built "/nix/store/7xj0j1acvhf7avnkkc746nc04a920qri-nixos-system-desktop-23.05pre-git"
desktop ✅ 0s Pushed system closure
desktop ❌ 0s Activation failed: Child process exited with error code: 1
[ERROR] Failed to complete requested operation - Last 1 lines of logs:
[ERROR]  failure) Child process exited with error code: 1
[ERROR] Failed to deploy to desktop - Last 3 lines of logs:
[ERROR]  created)
[ERROR]    state) Running
[ERROR]  failure) Child process exited with error code: 1
[ERROR] -----
[ERROR] Operation failed with error: Child process exited with error code: 1
19:56:08
@zhaofeng:zhaofeng.liZhaofeng Li Oops, you need both --sudo and --sudo-command=doas 20:43:24
@ask-yourself:matrix.org@ask-yourself:matrix.org

It still seems to complain in the same way:

.dotfiles on  main [!+] λ colmena apply-local --sudo --sudo-command=doas
error: getting the HEAD of the Git tree '/home/isaac/.dotfiles' failed with exit code 1:
       error: executing 'git': No such file or directory

(use '--show-trace' to show detailed location information)
thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: ChildFailure { exit_code: 1 }', src/command/apply_local.rs:95:55
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
20:46:55
@zhaofeng:zhaofeng.liZhaofeng Li Yeah, because the whole deployment process is relaunched as root and Nix depends on git in the PATH for flakes, you would need to add it to the global (or root's) environment. 20:48:07
@ask-yourself:matrix.org@ask-yourself:matrix.org Don't I do that with keepEnv? 20:48:46
@ask-yourself:matrix.org@ask-yourself:matrix.org
{user, ...}: {
  # deployment.privilegeEscalationCommand = ["doas"];
  security = {
    doas = {
      enable = true;
      extraRules = [
        {
          keepEnv = true;
          noPass = true;
          users = ["${user}"];
        }
      ];
    };
    sudo.enable = true ;
  };
}
20:48:51
@zhaofeng:zhaofeng.liZhaofeng Li Does doas git work? 20:49:51
@ask-yourself:matrix.org@ask-yourself:matrix.orgYup.20:50:02
@zhaofeng:zhaofeng.liZhaofeng LiHmm, this is very weird indeed.20:52:00
@zhaofeng:zhaofeng.liZhaofeng LiAnd the weirdness is part of the reason I changed it to only escalate during activation. Permissions can also be easily messed up if you interact with the flake as another user.20:52:18
@ask-yourself:matrix.org@ask-yourself:matrix.orgI can deinitely switch to unstable.20:52:58
@ask-yourself:matrix.org@ask-yourself:matrix.orgI was just a bit confused how to do that.20:53:04
@zhaofeng:zhaofeng.liZhaofeng Li nix shell github:zhaofengli/colmena should get you in a shell that has the unstable colmena. To add it to your config, add inputs.colmena.url = "github:zhaofengli/colmena"; and insert colmena.packages.${system}.colmena to devShell/systemPackages. 20:55:36
@ask-yourself:matrix.org@ask-yourself:matrix.org Ok doing this now. And then once I'm unstable the command is just colmena apply-local? 20:56:26

Show newer messages


Back to Room ListRoom Version: 6