Nixos-rebuild-ng: a nixos-rebuild rewrite

[eblechschmidt]

@k0kada thanks for the great work. I’m using it since several weeks without any issues remote building for different machines with different architectures. Especially just having to provide the sudo password once increases efficiency a lot.

[AngryAnt]

@k0kada

Replace nix-copy-closure with nix copy, that supports using --to and --from together. It is still kinda sub-optimal because instead of having alice talking directly with bob, now the connection between the two seems to be done in the eval machine (I tested this with a Chromebook and it was really slow because the Wi-Fi connection in my Chromebook is poor), but not sure there is much we can do (and --use-substitutes still exist for those cases). This also would mean that any usage of --to and --from would need a newer version of Nix, and we try to be compatible to nix 2.3 since some folks still depends on it

Worth noting that while this was sub optimal in that scenario, it is quite optimal in the scenario where you have an admin machine able to (temporarily) access both builder and destination, but network segmentation means they cannot access one-another.

[k0kada]

So a few weeks after release 25.05 the amount of bug reports was surprisingly small, so I think we should make nixos-rebuild-ng the default in release 25.11 as soon as possible so we can iron any last remaining issues: nixos-rebuild-ng: enable by default by thiagokokada · Pull Request #415640 · NixOS/nixpkgs · GitHub.

[sdht]

Thanks for seeing this through to the end @k0kada!