nixos/etc-overlay: avoid rebuilding the initrd every time the etc con…

…tents change

Before this change, the hash of the etc metadata image was included in
the mount unit that's responsible for mounting this metadata image in the
initrd.
And because this metadata image changes with every change to the etc
contents, the initrd would be rebuild every time as well.
This can lead to a lot of rebuilds (especially when revision info is
included in /etc/os-release) and all these initrd archives use up a lot of
space on the ESP.

With this change, we instead include a symlink to the metadata image in the
top-level directory, in the same way as we already do for things like init and
prepare-root, and we deduce the store path from the init= kernel parameter,
in the same way as we already do to find the path to init and prepare-root.

Doing so avoids rebuilding the initrd all the time.

nixos/modules/system/activation/top-level.nix

@@ -20,6 +20,11 @@ let
  ''}
 
  ln -s ${config.system.build.etc}/etc $out/etc
+
+ ${lib.optionalString config.system.etc.overlay.enable ''
+ ln -s ${config.system.build.etcMetadataImage} $out/etc-metadata-image
+ ''}
+
  ln -s ${config.system.path} $out/sw
  ln -s "$systemd" $out/systemd
 

nixos/modules/system/etc/etc-activation.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 
 {
 
@@ -34,11 +34,28 @@
  mounts = [
  {
  where = "/run/etc-metadata";
- what = "/sysroot${config.system.build.etcMetadataImage}";
+ what = "/tmp/etc-metadata-image";
  type = "erofs";
  options = "loop";
- unitConfig.RequiresMountsFor = [
- "/sysroot/nix/store"
+ unitConfig = {
+ # Since this unit depends on the nix store being mounted, it cannot
+ # be a dependency of local-fs.target, because if it did, we'd have
+ # local-fs.target ordered after the nix store mount which would cause
+ # things like network.target to only become active after the nix store
+ # has been mounted.
+ # This breaks for instance setups where sshd needs to be up before
+ # any encrypted disks can be mounted.
+ DefaultDependencies = false;
+ RequiresMountsFor = [
+ "/sysroot/nix/store"
+ ];
+ };
+ requires = [
+ config.boot.initrd.systemd.services.find-etc-metadata-image.name
+ ];
+ after = [
+ "local-fs-pre.target"
+ config.boot.initrd.systemd.services.find-etc-metadata-image.name
  ];
  }
  {
@@ -67,20 +84,52 @@
  ];
  }
  ];
- services = lib.mkIf config.system.etc.overlay.mutable {
- rw-etc = {
- unitConfig = {
- DefaultDependencies = false;
- RequiresMountsFor = "/sysroot";
+ services = lib.mkMerge [
+ (lib.mkIf config.system.etc.overlay.mutable {
+ rw-etc = {
+ unitConfig = {
+ DefaultDependencies = false;
+ RequiresMountsFor = "/sysroot";
+ };
+ serviceConfig = {
+ Type = "oneshot";
+ ExecStart = ''
+ /bin/mkdir -p -m 0755 /sysroot/.rw-etc/upper /sysroot/.rw-etc/work
+ '';
+ };
  };
- serviceConfig = {
- Type = "oneshot";
- ExecStart = ''
- /bin/mkdir -p -m 0755 /sysroot/.rw-etc/upper /sysroot/.rw-etc/work
+ })
+ {
+ find-etc-metadata-image = {
+ description = "Find the path to the etc metadata image";
+ wants = [
+ config.boot.initrd.systemd.services.initrd-find-nixos-closure.name
+ ];
+ after = [
+ config.boot.initrd.systemd.services.initrd-find-nixos-closure.name
+ ];
+ before = [ "shutdown.target" ];
+ conflicts = [ "shutdown.target" ];
+ unitConfig = {
+ DefaultDependencies = false;
+ RequiresMountsFor = "/sysroot/nix/store";
+ };
+ serviceConfig = {
+ Type = "oneshot";
+ RemainAfterExit = true;
+ };
+
+ script = /* bash */ ''
+ set -uo pipefail
+
+ closure="$(realpath /nixos-closure)"
+
+ metadata_image="$(chroot /sysroot ${lib.getExe' pkgs.coreutils "realpath"} "$closure/etc-metadata-image")"
+ ln -s "/sysroot$metadata_image" /tmp/etc-metadata-image
  '';
  };
- };
- };
+ }
+ ];
  };
 
  })

nixos/tests/activation/etc-overlay-immutable.nix

@@ -50,6 +50,9 @@
  with subtest("switching to the same generation"):
  machine.succeed("/run/current-system/bin/switch-to-configuration test")
 
+ with subtest("the initrd didn't get rebuilt"):
+ machine.succeed("test /run/current-system/initrd -ef /run/current-system/specialisation/new-generation/initrd")
+
  with subtest("switching to a new generation"):
  machine.fail("stat /etc/newgen")
 

nixos/tests/activation/etc-overlay-mutable.nix

@@ -24,6 +24,9 @@
  with subtest("switching to the same generation"):
  machine.succeed("/run/current-system/bin/switch-to-configuration test")
 
+ with subtest("the initrd didn't get rebuilt"):
+ machine.succeed("test /run/current-system/initrd -ef /run/current-system/specialisation/new-generation/initrd")
+
  with subtest("switching to a new generation"):
  machine.fail("stat /etc/newgen")
  machine.succeed("echo -n 'mutable' > /etc/mutable")