NixOS 23.11 -> 24.05 upgrade issues

Although 24.05 is not yet officially released, I’m beta testing the upgrade, and in contrast to previous years, it seems to be less flawless.

I will post the things I’ve noticed here, to see if these are known/reproducable issues and of course to find solutions/workarounds.

Display manager/auto login not working

update: has to do with kanidm, see next post
context: I use emacs+EXWM managed by home-manager.

  services.displayManager = {
    defaultSession = "none+icewm";
    autoLogin.enable = true;
    autoLogin.user = "kvtb";
  };

  services.xserver = {
    enable = true;
    windowManager.icewm.enable = true;
    displayManager.lightdm.enable = true;
    displayManager.lightdm.greeter.enable = false;
  };

I have lightdm autologin enabled, but upon boot I get the regular tty where I need to login manually.

manually starting the display-manager.service unit does not work and journalctl gives no additional information other than ‘Main process exited’

The only way to get X working, is to first run

$ sudo /nix/store/awvhpsfj6l3yrw0i4bgffrvv99xg6pjx-unit-script-display-manager-start/bin/display-manager-start 

This will start a broken X session (e.g dbus not working, systemctl --user units not working)

Only then I can do

sudo systemctl restart display-manager.service

and stuff works.

add flake path to NIX_PATH

moved to separate topic 24.05: Add flake to NIX_PATH

invidious db role not upgraded

from the release notes:

services.invidious.settings.db.user, the default database username has changed from kemal to invidious. Setups involving an externally-provisioned database (i.e. services.invidious.database.createLocally == false) should adjust their configuration accordingly. The old kemal user will not be removed automatically even when the database is provisioned automatically.(#265857).

In my case, my invidious config is really straight forward (no custom settings related to database):


  services.invidious = {
    enable = true;
    nginx.enable = true;
    port = 12345;

    domain = "invidious.kvtb.net";
    settings = {
      registration_enabled = false;
      login_enabled = false;
      captcha_enabled = false;
      log_level = "warn";
      use_innertube_for_captions = true;
      default_user_preferences = {
        quality = "dash";
        related_videos = false;
        local = true;
      };
    };
  };

Out of the box, when keeping stateVersion at 23.11, existing invidious config will not work, (activation fails), I needed to manually delete the postgres db for invidious using the dropdb command.

It could be that this was needed because while using 23.11 I pinned invidious to a later version? I cannot test anymore. Anyway, invidious users be aware.

I will continue testing 24.05 on my laptop, but these are the most imported things I noticed in the past hours.

the problem: Display manager/auto login not working has been resolved using a workaround.

The cause was the kanidm PAM client (which I’m using for IAM) takes 7 seconds to be ready to serve, but systemd continues with the next units too early: The display manager is started before the autologin user is available.

Here is the code to make it work:


  # to prevent login/display manager to start too early
  systemd.services.kanidm-unixd.before = [ "nss-user-lookup.target" ];

  # a dirty workaround because although kanidm-unixd does support sd-notify
  # it does not work in NixOS for whatever reason.
  # The delay will ensure tasks daemon does not to start too early
  systemd.services.kanidm-unixd.serviceConfig.ExecStartPost =
    "/run/current-system/sw/bin/sleep 10";

  # allow access to all shells because configured user shell is checked by kanidm
  # without this, it will complain/pollute log file
  systemd.services.kanidm-unixd.serviceConfig.BindReadOnlyPaths =
    (map utils.toShellPath config.environment.shells) ++ [
      "/bin/sh"

      # required for the workaround mentioned earlier
      "/run/current-system/sw/bin/sleep"
    ];

A better solution would be to make the systemd units for both kanidm-unixd and kanidm-unixd-tasks type notify (which is supported reading the source code of kanidm), but for some reason it does not work (units hangs until timeout). Maybe @adamcstephens @erictapen @Flakebi knows?