Test --determinate in CI, and fix integration issues

.github/workflows/ci.yml

@@ -59,6 +59,9 @@ jobs:
     name: Run x86_64 Linux
     runs-on: ubuntu-latest
     needs: [lints, build-x86_64-linux]
+    strategy:
+      matrix:
+        extra-args: ["--determinate", ""]
     permissions:
       id-token: "write"
       contents: "read"
@@ -80,6 +83,7 @@ jobs:
         uses: DeterminateSystems/nix-installer-action@main
         with:
           flakehub: true
+          extra-args: ${{ matrix.extra-args }}
           local-root: install-root/
           logger: pretty
           log-directives: nix_installer=debug
@@ -110,6 +114,7 @@ jobs:
         uses: DeterminateSystems/nix-installer-action@main
         with:
           flakehub: true
+          extra-args: ${{ matrix.extra-args }}
           local-root: install-root/
           logger: pretty
           log-directives: nix_installer=debug
@@ -167,6 +172,9 @@ jobs:
     name: Run x86_64 Linux (No init)
     runs-on: ubuntu-latest
     needs: [lints, build-x86_64-linux]
+    strategy:
+      matrix:
+        extra-args: ["--determinate", ""]
     permissions:
       id-token: "write"
       contents: "read"
@@ -189,6 +197,7 @@ jobs:
         with:
           flakehub: true
           init: none
+          extra-args: ${{ matrix.extra-args }}
           planner: linux
           local-root: install-root/
           logger: pretty
@@ -224,6 +233,7 @@ jobs:
           flakehub: true
           init: none
           planner: linux
+          extra-args: ${{ matrix.extra-args }}
           local-root: install-root/
           logger: pretty
           log-directives: nix_installer=debug
@@ -281,6 +291,9 @@ jobs:
     name: Run x86_64 Darwin
     runs-on: macos-13
     needs: [lints, build-x86_64-darwin]
+    strategy:
+      matrix:
+        extra-args: ["--determinate", ""]
     permissions:
       id-token: "write"
       contents: "read"
@@ -302,6 +315,7 @@ jobs:
         uses: DeterminateSystems/nix-installer-action@main
         with:
           flakehub: true
+          extra-args: ${{ matrix.extra-args }}
           local-root: install-root/
           logger: pretty
           log-directives: nix_installer=debug
@@ -320,6 +334,7 @@ jobs:
         uses: DeterminateSystems/nix-installer-action@main
         with:
           flakehub: true
+          extra-args: ${{ matrix.extra-args }}
           local-root: install-root/
           logger: pretty
           log-directives: nix_installer=debug
@@ -359,11 +374,20 @@ jobs:
           NIX_INSTALLER_LOGGER: pretty
           NIX_INSTALLER_LOG_DIRECTIVES: nix_installer=debug
           RUST_BACKTRACE: full
+      - name: Breakpoint if tests failed
+        if: failure()
+        uses: namespacelabs/breakpoint-action@v0
+        with:
+          duration: 30m
+          authorized-users: grahamc
 
   run-aarch64-linux:
     name: Run aarch64 Linux
     runs-on: namespace-profile-default-arm64
     needs: [lints, build-aarch64-linux]
+    strategy:
+      matrix:
+        extra-args: ["--determinate", ""]
     permissions:
       id-token: "write"
       contents: "read"
@@ -386,6 +410,7 @@ jobs:
         with:
           flakehub: true
           local-root: install-root/
+          extra-args: ${{ matrix.extra-args }}
           logger: pretty
           log-directives: nix_installer=debug
           backtrace: full
@@ -417,6 +442,7 @@ jobs:
           flakehub: true
           local-root: install-root/
           logger: pretty
+          extra-args: ${{ matrix.extra-args }}
           log-directives: nix_installer=debug
           backtrace: full
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -472,6 +498,9 @@ jobs:
     name: Run aarch64 Darwin
     runs-on: macos-latest-xlarge
     needs: [lints, build-aarch64-darwin]
+    strategy:
+      matrix:
+        extra-args: ["--determinate", ""]
     permissions:
       id-token: "write"
       contents: "read"
@@ -494,6 +523,7 @@ jobs:
         with:
           flakehub: true
           local-root: install-root/
+          extra-args: ${{ matrix.extra-args }}
           logger: pretty
           log-directives: nix_installer=debug
           backtrace: full
@@ -512,6 +542,7 @@ jobs:
         with:
           flakehub: true
           local-root: install-root/
+          extra-args: ${{ matrix.extra-args }}
           logger: pretty
           log-directives: nix_installer=debug
           backtrace: full

flake.nix

@@ -22,6 +22,19 @@
     determinate = {
       url = "https://flakehub.com/f/DeterminateSystems/determinate/0.1.tar.gz";
 
+      inputs.determinate-nixd-aarch64-darwin = {
+        url = "https://install.determinate.systems/determinate-nixd/rev/948f25bd2d5742ee96ec938d9ae7709e4458420c/macOS";
+        flake = false;
+      };
+      inputs.determinate-nixd-aarch64-linux = {
+        url = "https://install.determinate.systems/determinate-nixd/rev/948f25bd2d5742ee96ec938d9ae7709e4458420c/aarch64-linux";
+        flake = false;
+      };
+      inputs.determinate-nixd-x86_64-linux = {
+        url = "https://install.determinate.systems/determinate-nixd/rev/948f25bd2d5742ee96ec938d9ae7709e4458420c/x86_64-linux";
+        flake = false;
+      };
+
       # We set the overrides below so the flake.lock has many fewer nodes.
       #
       # The `determinate` input is used to access the builds of `determinate-nixd`.

src/action/common/configure_determinate_nixd_init_service/mod.rs

@@ -1,3 +1,4 @@
+use std::collections::HashMap;
 use std::path::PathBuf;
 
 use serde::{Deserialize, Serialize};
@@ -140,6 +141,20 @@ impl Action for ConfigureDeterminateNixdInitService {
     async fn revert(&mut self) -> Result<(), ActionError> {
         self.configure_init_service.try_revert().await?;
 
+        let file_to_remove = match self.init {
+            InitSystem::Launchd => Some(DARWIN_NIXD_DAEMON_DEST),
+            InitSystem::Systemd => Some(LINUX_NIXD_DAEMON_DEST),
+            InitSystem::None => None,
+        };
+
+        if let Some(file_to_remove) = file_to_remove {
+            tracing::trace!(path = %file_to_remove, "Removing");
+            tokio::fs::remove_file(file_to_remove)
+                .await
+                .map_err(|e| ActionErrorKind::Remove(file_to_remove.into(), e))
+                .map_err(Self::error)?;
+        }
+
         Ok(())
     }
 }
@@ -153,11 +168,12 @@ pub enum ConfigureDeterminateNixDaemonServiceError {}
 pub struct DeterminateNixDaemonPlist {
     label: String,
     program: String,
-    keep_alive: bool,
     run_at_load: bool,
+    sockets: HashMap<String, Socket>,
     standard_error_path: String,
     standard_out_path: String,
     soft_resource_limits: ResourceLimits,
+    hard_resource_limits: ResourceLimits,
 }
 
 #[derive(Deserialize, Clone, Debug, Serialize, PartialEq)]
@@ -166,9 +182,22 @@ pub struct ResourceLimits {
     number_of_files: usize,
 }
 
+#[derive(Deserialize, Clone, Debug, Serialize, PartialEq)]
+#[serde(rename_all = "PascalCase")]
+pub struct Socket {
+    sock_family: SocketFamily,
+    sock_passive: bool,
+    sock_path_name: String,
+}
+
+#[derive(Deserialize, Clone, Debug, Serialize, PartialEq)]
+#[serde(rename_all = "PascalCase")]
+enum SocketFamily {
+    Unix,
+}
+
 fn generate_plist() -> DeterminateNixDaemonPlist {
     DeterminateNixDaemonPlist {
-        keep_alive: true,
         run_at_load: true,
         label: "systems.determinate.nix-daemon".into(),
         program: "/usr/local/bin/determinate-nixd".into(),
@@ -177,5 +206,26 @@ fn generate_plist() -> DeterminateNixDaemonPlist {
         soft_resource_limits: ResourceLimits {
             number_of_files: 1048576,
         },
+        hard_resource_limits: ResourceLimits {
+            number_of_files: 1048576 * 2,
+        },
+        sockets: HashMap::from([
+            (
+                "determinate-nixd-http".to_string(),
+                Socket {
+                    sock_family: SocketFamily::Unix,
+                    sock_passive: true,
+                    sock_path_name: "/nix/var/determinate/determinate-nixd.socket".into(),
+                },
+            ),
+            (
+                "nix-daemon.socket".to_string(),
+                Socket {
+                    sock_family: SocketFamily::Unix,
+                    sock_passive: true,
+                    sock_path_name: "/nix/var/nix/daemon-socket/socket".into(),
+                },
+            ),
+        ]),
     }
 }