Allowing single nonfree package for a single user?

  • When I run nix run 'nixpkgs#zoom-us', it doesn’t work because of the default restriction on proprietary software.
  • When I run NIXPKGS_ALLOW_UNFREE=1 nix run --impure 'nixpkgs#zoom-us', it takes an excessively long time, and wastes a bunch of storage it seems due to “impure” mode tainting the whole expression and making it rebuild a bunch of what are supposed to be shared system libraries.

The output of the former command suggested that I could patch this by modifying “nixpkgs.config.allowUnfreePredicate”, but that does not seem to work with home-manager:

# ~/.config/home-manager/home.nix

{ config, pkgs, lib ... }:

{
  home.username = "lain";
  home.homeDirectory = "/home/lain";
  home.stateVersion = "23.11";
  programs.home-manager.enable = true;
  programs.bash.enable = true;

  nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
    "zoom"
    "zoom-us"
  ];

  home.packages = with pkgs; [
    …
  ];
}

even after “switching” to the above config, nix run 'nixpkgs#zoom-us' still fails with an error about its unfree license.

I don’t want to just blanket-enable unfree at the system-level; I’d like to keep these “allowances” limited to just the package and user account they apply to. Is this possible, and if so what’s the syntax for doing so?

Of course. The allowing-unfree that you did only applies to the nixpkgs instance in your HM config.

 nix run --expr 'import (builtins.getFlake "github:nixos/nixpkgs/2768c7d042a37de65bb1b5b3268fc987e534c49d") { system = "x86_64-linux"; config.allowUnfree = true; }' 'zoom-us'

Is it possible to direct nix run at the system / home-manager channel instance of nixpkgs, so that it can not only pick up on that statically declared license acceptance but also avoid duplication of shared libraries by leaning on the exact instances already in use by other programs?

Why are libraries being rebuilt? That doesn’t make sense without further context.

I think this should be enough to replicate:

1. My system-wide config

/etc/nixos/configuration.nix
{ config, pkgs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
      <home-manager/nixos>
    ];

  # Bootloader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  networking.hostName = "CNU352DG8J-nxo"; # Define your hostname.
  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.

  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  # Enable networking
  networking.networkmanager.enable = true;

  # Set your time zone.
  time.timeZone = "US/Central";

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.UTF-8";

  i18n.extraLocaleSettings = {
    LC_ADDRESS = "en_US.UTF-8";
    LC_IDENTIFICATION = "en_US.UTF-8";
    LC_MEASUREMENT = "en_US.UTF-8";
    LC_MONETARY = "en_US.UTF-8";
    LC_NAME = "en_US.UTF-8";
    LC_NUMERIC = "en_US.UTF-8";
    LC_PAPER = "en_US.UTF-8";
    LC_TELEPHONE = "en_US.UTF-8";
    LC_TIME = "en_US.UTF-8";
  };

  # Enable the X11 windowing system.
  # You can disable this if you're only using the Wayland session.
  services.xserver.enable = true;

  # Enable the KDE Plasma Desktop Environment.
  services.displayManager.sddm.enable = true;
  services.desktopManager.plasma6.enable = true;

  # Configure keymap in X11
  services.xserver.xkb = {
    layout = "us";
    variant = "";
  };

  # Enable CUPS to print documents.
  services.printing.enable = true;
  # Enable mDNS for .local domains for automatic printer discovery
  services.avahi.enable = true;
  services.avahi.nssmdns4 = true;

  # Enable sound with pipewire.
  hardware.pulseaudio.enable = false;
  security.rtkit.enable = true;
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
    # If you want to use JACK applications, uncomment this
    #jack.enable = true;

    # use the example session manager (no others are packaged yet so this is enabled by default,
    # no need to redefine it in your config for now)
    #media-session.enable = true;
  };
  services.libinput.enable = true;

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.lain = {
    isNormalUser = true;
    description = "Lain I.";
    extraGroups = [ "networkmanager" "wheel" ];
    # FIXME figure out what the declarative alternative to loginctl enable-linger is
  };

  # FIXME need to make this narrower
  nixpkgs.config.allowUnfree = true;

  environment.systemPackages = with pkgs; [
    home-manager
  ];

  nix.settings.experimental-features = [ "nix-command" "flakes" ];

  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.mtr.enable = true;
  # programs.gnupg.agent = {
  #   enable = true;
  #   enableSSHSupport = true;
  # };

  # List services that you want to enable:

  # Enable the OpenSSH daemon.
  # services.openssh.enable = true;

  # Open ports in the firewall.
  # networking.firewall.allowedTCPPorts = [ ... ];
  # networking.firewall.allowedUDPPorts = [ ... ];
  # Or disable the firewall altogether.
  # networking.firewall.enable = false;

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "24.05"; # Did you read the comment?

}

2. My home-manager config

~/.config/home-manager/home.nix
{ config, pkgs, lib, ... }:

{
  home.username = "lain";
  home.homeDirectory = "/home/lain";
  home.stateVersion = "23.11";
  programs.home-manager.enable = true;
  programs.bash.enable = true;

  nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
    "zoom"
    "zoom-us"
  ];

  home.packages = with pkgs; [
    # Misc
    firefox
    mpv
    nano
    libreoffice-qt # NOTE: using -qt while on the Plasma desktop
    elinks

    # System Administration
    sensible-utils
    file
    xdiskusage
    p7zip
    tmux
    htop

    # eternally useful quick tools
    gitFull git-lfs
    nodejs_22
    python3
  ];

}

3. What commands I’m running

commands
# 1. Update system
sudo nixos-rebuild switch --upgrade

# 2. Update user
home-manager switch

# 3. run system garbage collection
nix-collect-garbage

# 4. Now the slate's clean, try to run Zoom
NIXPKGS_ALLOW_UNFREE=1 nix run --impure --verbose 'nixpkgs#zoom-us'

4. What I’m seeing that makes me think I’m doing something wrong

symptoms

That last command:

  • downloaded a fresh tarball of nixpkgs
  • downloaded new instances of a ton of packages that were already installed directly or indirectly with home-manager, including openssl, pulseaudio, and glibc. (On closer inspection these were not actually being rebuilt; I initially assumed they were because that last command caused my system to completely freeze up for several minutes despite having 8GB of RAM and an SSD swapfile.)

I would like the ability to run up-to-date proprietary packages out of the home-manager instance of nixpkgs not just for storage savings, launch-time CPU savings, and run-time RAM savings of re-using shared libraries, but also for the ability to roll back a switch command if there’s ever an update that breaks important programs I run regularly.

Downloading the tarball is expected.
I assume it’s a situation like you’re using a stable release of nixpkgs for your configs and an unstable revision for nix run.
You’d have to ensure the revisions are the same to avoid issues like downloading a bunch of extra packages.

Side note: swap won’t help at all here, only RAM matters wrt memory usage. You can play around with max-jobs/-cores to help alleviate some symptoms.