Nix in unconnected systems

Help
1

I’m working on a system where I will have network connection initially when the base Nix software is installed, but NEVER again thereafter.

I’ll be importing new stuff directly into my local /nix/store via an rsync from a USB stick. Yeah, don’t ask.

But the jist here is this: the local /nix/store should always have everything I need to run any of the configurations I’m using. Is there any way to disable Nix from trying to download stuff from the network?

Does putting substituters = (blank) in /etc/nix/nix.conf suffice, or is there somewhere else that I need to put something.

Note that this includes wanting the default cache.nixos.org to be disabled and never contacted.

TL;DR: I need to have Nix never look for anything from the network or another store (or binary cache) after I’ve done the basic install. Everything should always be in /nix/store already.

1 Like
2

If you guarantee everything to exist in the Nix store, and Nix can match stuff with the hashes, then it shouldn’t touch the network anyway, right?

Setting this would just disable pulling cached stuff, Nix would still try to fetch the source if the cache didn’t hit. But then again, if you guarantee everything to be in /nix/store, it shouldn’t do either of those.

Not sure if the rsync bit is a joke or being serious, but use nix copy for copying over closures of software.

1 Like
3

I’m not kidding about rsync because I wasn’t sure if nix copy will do an entire store, or if I have to specify the closures I want.

can I just do a nix copy --from /path/to/usb/nix/store and have it copy everything it finds there to the local store (in the default /nix/store location)?

4

Yes you can, see the second heading under the “Examples” section on the previously linked documentation for nix copy

5

I’m thinking the following should work, but doesn’t:

when copying from my remote build machine to the USB stick:

nix copy --extra-experimental-features nix-command --all --to /usb/

seems to be the right idea, but I’m getting a error: cannot add path <a72fuas7fqeh-xgcc-13.01-libgcc> because it lacks a signature by a trusted key

Since I’m only downloading from cache.nixos.org how is that possible?

Also, I’d expect the copy from the USB to the ‘sealed’ system to go like:

nix copy --extra-experimental-features nix-command --all --from /usb/ (if /usb/nix/store exists)