agenix is not compatible with userborn

[Mic92]

Dec 05 00:42:37 build01 systemd[1]: Starting /nix/store/k88rz3p58mp584jd0v63wlxx3vja2fwg-nixos-system-build01-25.05.20241201.767b0e3/bin/switch-to-configuration switch...
Dec 05 00:42:37 build01 systemd[1]: Started /nix/store/k88rz3p58mp584jd0v63wlxx3vja2fwg-nixos-system-build01-25.05.20241201.767b0e3/bin/switch-to-configuration switch.
Dec 05 00:42:38 build01 nixos[4248]: switching to system configuration /nix/store/k88rz3p58mp584jd0v63wlxx3vja2fwg-nixos-system-build01-25.05.20241201.767b0e3
Dec 05 00:42:40 build01 nixos[4248]: switching to system configuration /nix/store/k88rz3p58mp584jd0v63wlxx3vja2fwg-nixos-system-build01-25.05.20241201.767b0e3 failed (status 2)
Dec 05 00:42:40 build01 systemd[1]: nixos-rebuild-switch-to-configuration.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
Dec 05 00:42:40 build01 systemd[1]: nixos-rebuild-switch-to-configuration.service: Failed with result 'exit-code'.

• nixos-rebuild switch fails.
• nixos-rebuild boot works but then running switch again (switching into the current booted generation) fails?

This was reported by @zowoq in nix-community/srvos#575

[nikstur]

I can't really do anything with this information. I don't see any failure. Whats the output of the userborn service?

[zowoq]

Dec 11 11:01:19 build01 systemd[1]: Starting Manage Users and Groups...
Dec 11 11:01:19 build01 umount[3095139]: umount: /etc/group: not mounted.
Dec 11 11:01:19 build01 umount[3095140]: umount: /etc/passwd: not mounted.
Dec 11 11:01:19 build01 umount[3095143]: umount: /etc/shadow: not mounted.
Dec 11 11:01:19 build01 systemd[1]: Finished Manage Users and Groups.
Dec 11 11:01:59 build01 systemd[1]: userborn.service: Deactivated successfully.
Dec 11 11:01:59 build01 systemd[1]: Stopped Manage Users and Groups.

[zowoq]

I don't understand why the error is just Main process exited, code=exited, status=2/INVALIDARGUMENT and not something a bit more informative but it is caused by the nixpkgs userborn module disabling system.activationScripts.users, which is needed by agenix.

The userborn module does check this:

assertion = config.system.activationScripts.users == "";

but it also does this:

system.activationScripts.users = lib.mkForce "";

so we don't see the assertion.

[nikstur]

Yeah so this basically boils down to agenix not being compatible with userborn

[Mic92]

This is needed than: https://github.com/Mic92/sops-nix/blob/a80af8929781b5fe92ddb8ae52e9027fae780d2a/modules/sops/secrets-for-users/default.nix#L29

[Mic92]

Solved by ryantm/agenix#255 but looks like upstream is a bit slow reviewing stuff.

[Mic92]

Keep this open since other people might stumble over this.