tepichord/milner
1
1
Fork 0
Code Issues 10 Pull requests 2 Projects 1 Releases Packages Wiki Activity Actions

Specify use of NIX for dependencies #7

New issue
Closed
opened 2026-08-17 10:04:49 -07:00 by tepichord · 3 comments
tepichord commented 2026-08-17 10:04:49 -07:00
Owner
Copy link
  • nix needs to be used for dependency management (e.g. terraform first and foremost), specify so in PLAN.md, and AGENTS.md that nix is available for tool use
  • a flake.nix file needs to be created with terraform and other potential dependencies.
- nix needs to be used for dependency management (e.g. terraform first and foremost), specify so in PLAN.md, and AGENTS.md that nix is available for tool use - a flake.nix file needs to be created with terraform and other potential dependencies.
tepichord added this to the MVP project 2026-08-17 10:04:49 -07:00
tepichord commented 2026-08-17 15:29:20 -07:00
Author
Owner
Copy link

Naina:
Updated on 2026-08-18 based on maintainer feedback.

Overview

This issue adopts Nix as the primary dependency manager for the infrastructure repo. We'll create a flake.nix providing all CLI tools via nix develop, then update PLAN.md, AGENTS.md, and READMEs to document the new workflow. This replaces the current Homebrew-only setup instructions with a reproducible, lockfile-pinned alternative.

Technical Approach

  1. Create flake.nix with nixpkgs pinned to a commit hash + flake-utils:
{
  description = "Evolved NPCs infrastructure tooling";
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/e5bdc4a41d4c072fe1e3787eaa0320a384741d44";
    flake-utils.url = "github:numtide/flake-utils";
  };
  outputs = { self, nixpkgs, flake-utils }:
    flake-utils.lib.eachDefaultSystem (system:
      let pkgs = import nixpkgs { inherit system; };
      in {
        devShells.default = pkgs.mkShell {
          buildInputs = with pkgs; [
            terraform libvirt qemu
            podman podman-compose
            mkcert talosctl minikube
            tailscale openssl curl
          ];
          shellHook = ''
            echo "[evolved-npcs-infra] Dev shell loaded."
          '';
        };
      }
    );
}

  1. Generate and commit flake.lock via nix flake update.

  2. Update AGENTS.md — add to ## Tech Stack:

- **Deps:** Nix flakes (`nix develop` to enter shell with all tools)

Add agent self-detection to ## Code Conventions:

- Before running `nix develop`, check if already inside: `[ "${IN_NIX_SHELL:-}" = "impure" ]`
  1. Update PLAN.md — add under ## Decided Questions:
- Nix flakes for dependency management (`nix develop`)
  1. Update README.md — replace Homebrew setup with:
## Setup

Install [Nix](https://nixos.org/download/) (with flakes enabled).

Enter the dev shell (provides terraform, podman, qemu, etc.):
```bash
nix develop


6. **Update `control-plane/README.md`** — replace `brew install terraform`:
```markdown
Enter the Nix dev shell from the repo root, or install terraform manually.
  1. Update hc-vault/README.md — replace brew install podman podman-compose and brew install mkcert nss:
Enter the Nix dev shell from the repo root (provides podman, podman-compose, mkcert).
  1. Update worker/vm-setup/create-worker-vm.sh line 137 — replace error message:
log_error "QEMU is not installed. Run 'nix develop' from the repo root, or install qemu manually."

Implementation Details

Files to create:

File Purpose
flake.nix Nix flake with devShell providing all CLI tools
flake.lock Pinned dependency lockfile (auto-generated, committed)

Files to modify:

File Change
PLAN.md Add Nix decision to Decided Questions
AGENTS.md Update Tech Stack and Code Conventions for Nix
README.md Replace Homebrew setup with Nix-first instructions
control-plane/README.md Replace brew install terraform with Nix reference
hc-vault/README.md Replace brew install podman etc. with Nix reference
worker/vm-setup/create-worker-vm.sh Update QEMU error message (line 137)

Dependencies: All tools confirmed available in nixpkgs: terraform, libvirt, qemu, podman, podman-compose, mkcert, talosctl, minikube, tailscale, openssl, curl.

Constraints:

  • libvirtd daemon cannot be managed by Nix — must be running separately. Flake provides virsh CLI only.
  • curl is defensive (already on macOS by default).
  • Targets aarch64-darwin (macOS arm64) — flake-utils.eachDefaultSystem handles this.

Out-of-scope notes:

  • nix-darwin / home-manager not needed — plain devShell flake is sufficient.
  • No .envrc / direnv — direnv hooks into interactive shell prompts, not filesystem operations. Setting Command::current_dir() in Rust does not trigger direnv. nix develop (or nix develop --command <tool>) is the only activation mechanism.
  • No version pinning of individual tools beyond what the nixpkgs revision provides.

Acceptance Criteria

  • flake.nix exists with nixpkgs pinned to a commit hash and nix develop enters a shell with terraform, virsh, qemu, podman, podman-compose, mkcert, talosctl, minikube, tailscale, openssl, and curl available
  • flake.lock is committed and pins a specific nixpkgs revision
  • PLAN.md documents Nix as the dependency management decision
  • AGENTS.md references Nix in Tech Stack and documents IN_NIX_SHELL check in Code Conventions
  • Root README.md instructs users to install Nix and run nix develop
  • control-plane/README.md and hc-vault/README.md reference Nix instead of Homebrew
  • worker/vm-setup/create-worker-vm.sh error message references nix develop

Testing Plan

  • Run nix develop --command terraform version to verify terraform is available
  • Run nix develop --command virsh --version to verify libvirt CLI is available
  • Run nix develop --command podman --version to verify podman is available
  • Run nix develop --command talosctl version --client to verify talosctl is available
  • Run nix develop --command openssl version to verify openssl is available
  • Confirm flake.lock exists and contains a pinned nixpkgs revision

Related Issues/PRs

None — this is a standalone infrastructure improvement.

Naina: *Updated on 2026-08-18 based on maintainer feedback.* #### Overview This issue adopts Nix as the primary dependency manager for the infrastructure repo. We'll create a `flake.nix` providing all CLI tools via `nix develop`, then update PLAN.md, AGENTS.md, and READMEs to document the new workflow. This replaces the current Homebrew-only setup instructions with a reproducible, lockfile-pinned alternative. #### Technical Approach 1. **Create `flake.nix`** with `nixpkgs` pinned to a commit hash + `flake-utils`: ```nix { description = "Evolved NPCs infrastructure tooling"; inputs = { nixpkgs.url = "github:NixOS/nixpkgs/e5bdc4a41d4c072fe1e3787eaa0320a384741d44"; flake-utils.url = "github:numtide/flake-utils"; }; outputs = { self, nixpkgs, flake-utils }: flake-utils.lib.eachDefaultSystem (system: let pkgs = import nixpkgs { inherit system; }; in { devShells.default = pkgs.mkShell { buildInputs = with pkgs; [ terraform libvirt qemu podman podman-compose mkcert talosctl minikube tailscale openssl curl ]; shellHook = '' echo "[evolved-npcs-infra] Dev shell loaded." ''; }; } ); } ``` 2. **Generate and commit `flake.lock`** via `nix flake update`. 3. **Update `AGENTS.md`** — add to `## Tech Stack`: ```markdown - **Deps:** Nix flakes (`nix develop` to enter shell with all tools) ``` Add agent self-detection to `## Code Conventions`: ```markdown - Before running `nix develop`, check if already inside: `[ "${IN_NIX_SHELL:-}" = "impure" ]` ``` 4. **Update `PLAN.md`** — add under `## Decided Questions`: ```markdown - Nix flakes for dependency management (`nix develop`) ``` 5. **Update `README.md`** — replace Homebrew setup with: ```markdown ## Setup Install [Nix](https://nixos.org/download/) (with flakes enabled). Enter the dev shell (provides terraform, podman, qemu, etc.): ```bash nix develop ``` ``` 6. **Update `control-plane/README.md`** — replace `brew install terraform`: ```markdown Enter the Nix dev shell from the repo root, or install terraform manually. ``` 7. **Update `hc-vault/README.md`** — replace `brew install podman podman-compose` and `brew install mkcert nss`: ```markdown Enter the Nix dev shell from the repo root (provides podman, podman-compose, mkcert). ``` 8. **Update `worker/vm-setup/create-worker-vm.sh`** line 137 — replace error message: ```bash log_error "QEMU is not installed. Run 'nix develop' from the repo root, or install qemu manually." ``` #### Implementation Details **Files to create:** | File | Purpose | |------|---------| | `flake.nix` | Nix flake with devShell providing all CLI tools | | `flake.lock` | Pinned dependency lockfile (auto-generated, committed) | **Files to modify:** | File | Change | |------|--------| | `PLAN.md` | Add Nix decision to Decided Questions | | `AGENTS.md` | Update Tech Stack and Code Conventions for Nix | | `README.md` | Replace Homebrew setup with Nix-first instructions | | `control-plane/README.md` | Replace `brew install terraform` with Nix reference | | `hc-vault/README.md` | Replace `brew install podman` etc. with Nix reference | | `worker/vm-setup/create-worker-vm.sh` | Update QEMU error message (line 137) | **Dependencies:** All tools confirmed available in nixpkgs: `terraform`, `libvirt`, `qemu`, `podman`, `podman-compose`, `mkcert`, `talosctl`, `minikube`, `tailscale`, `openssl`, `curl`. **Constraints:** - `libvirtd` daemon cannot be managed by Nix — must be running separately. Flake provides `virsh` CLI only. - `curl` is defensive (already on macOS by default). - Targets `aarch64-darwin` (macOS arm64) — `flake-utils.eachDefaultSystem` handles this. **Out-of-scope notes:** - `nix-darwin` / `home-manager` not needed — plain `devShell` flake is sufficient. - No `.envrc` / direnv — direnv hooks into interactive shell prompts, not filesystem operations. Setting `Command::current_dir()` in Rust does not trigger direnv. `nix develop` (or `nix develop --command <tool>`) is the only activation mechanism. - No version pinning of individual tools beyond what the nixpkgs revision provides. #### Acceptance Criteria - [ ] `flake.nix` exists with nixpkgs pinned to a commit hash and `nix develop` enters a shell with terraform, virsh, qemu, podman, podman-compose, mkcert, talosctl, minikube, tailscale, openssl, and curl available - [ ] `flake.lock` is committed and pins a specific nixpkgs revision - [ ] `PLAN.md` documents Nix as the dependency management decision - [ ] `AGENTS.md` references Nix in Tech Stack and documents `IN_NIX_SHELL` check in Code Conventions - [ ] Root `README.md` instructs users to install Nix and run `nix develop` - [ ] `control-plane/README.md` and `hc-vault/README.md` reference Nix instead of Homebrew - [ ] `worker/vm-setup/create-worker-vm.sh` error message references `nix develop` #### Testing Plan - Run `nix develop --command terraform version` to verify terraform is available - Run `nix develop --command virsh --version` to verify libvirt CLI is available - Run `nix develop --command podman --version` to verify podman is available - Run `nix develop --command talosctl version --client` to verify talosctl is available - Run `nix develop --command openssl version` to verify openssl is available - Confirm `flake.lock` exists and contains a pinned nixpkgs revision #### Related Issues/PRs None — this is a standalone infrastructure improvement.
tepichord commented 2026-08-17 21:28:16 -07:00
Author
Owner
Copy link

inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
flake-utils.url = "github:numtide/flake-utils";
};

Prefer pinning to a commit like the following: nixpkgs.url = "github:NixOS/nixpkgs/0bb7ec54c8483066ec9d7720e780a5caa71f8612"; except choose the latest commit available for the unstable branch.

      buildInputs = with pkgs; [

        terraform libvirt qemu
        podman podman-compose
        mkcert talosctl minikube
        tailscale curl
      ];

Add: openssl to this list

  • Deps: Nix flakes (nix develop to enter shell with all tools)

Agent should be able to determine if they need to run nix develop or not. It is likely they will already be running in the nix develop environment but waste cycles running nix develop again.

Create .envrc for direnv auto-activation:

Thinking about this from the perspective of https://git.gloom.garden/tepichord/personal-noodle-infra, will setting current directory on a Command object in rust activate direnv? Show me unequivocal proof if it does, otherwise, remove the direnv requirement.

> inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05"; flake-utils.url = "github:numtide/flake-utils"; }; Prefer pinning to a commit like the following: `nixpkgs.url = "github:NixOS/nixpkgs/0bb7ec54c8483066ec9d7720e780a5caa71f8612";` except choose the latest commit available for the unstable branch. > buildInputs = with pkgs; [ terraform libvirt qemu podman podman-compose mkcert talosctl minikube tailscale curl ]; Add: openssl to this list > - **Deps:** Nix flakes (`nix develop` to enter shell with all tools) Agent should be able to determine if they need to run nix develop or not. It is likely they will already be running in the nix develop environment but waste cycles running nix develop again. > Create .envrc for direnv auto-activation: Thinking about this from the perspective of https://git.gloom.garden/tepichord/personal-noodle-infra, will setting current directory on a Command object in rust activate direnv? Show me unequivocal proof if it does, otherwise, remove the direnv requirement.
tepichord commented 2026-08-17 22:16:00 -07:00
Author
Owner
Copy link

Naina:
Good catches on all four points — here's the plan going forward:

Commit pinning: Agreed, will pin to the latest nixos-unstable commit hash (e5bdc4a41d4c072fe1e3787eaa0320a384741d44 at time of research) instead of a branch name. The flake input will be nixpkgs.url = "github:NixOS/nixpkgs/e5bdc4a41d4c072fe1e3787eaa0320a384741d44";.

openssl: Will add it to buildInputs.

Agent self-detection: Good point about wasted cycles. nix develop sets IN_NIX_SHELL=impure, so agents can check [ "${IN_NIX_SHELL:-}" = "impure" ] before re-entering. Will document this in AGENTS.md.

direnv: You're right to be skeptical — direnv hooks into the shell's PROMPT_COMMAND/precmd, not the filesystem. Setting .current_dir() on a Rust Command does not trigger direnv activation. It only works in interactive shells with the hook installed. Dropping the .envrc requirement entirely; nix develop (or nix develop --command <tool>) is the only activation mechanism.

Naina: Good catches on all four points — here's the plan going forward: **Commit pinning:** Agreed, will pin to the latest `nixos-unstable` commit hash (`e5bdc4a41d4c072fe1e3787eaa0320a384741d44` at time of research) instead of a branch name. The flake input will be `nixpkgs.url = "github:NixOS/nixpkgs/e5bdc4a41d4c072fe1e3787eaa0320a384741d44";`. **openssl:** Will add it to `buildInputs`. **Agent self-detection:** Good point about wasted cycles. `nix develop` sets `IN_NIX_SHELL=impure`, so agents can check `[ "${IN_NIX_SHELL:-}" = "impure" ]` before re-entering. Will document this in AGENTS.md. **direnv:** You're right to be skeptical — direnv hooks into the shell's `PROMPT_COMMAND`/`precmd`, not the filesystem. Setting `.current_dir()` on a Rust `Command` does **not** trigger direnv activation. It only works in interactive shells with the hook installed. Dropping the `.envrc` requirement entirely; `nix develop` (or `nix develop --command <tool>`) is the only activation mechanism.
tepichord 2026-08-18 11:50:23 -07:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feat/12-iac-control-plane
feat/3-setting-up-agent-development
kvm-kubernetes-setup
No results found.
Labels
Clear labels   
bug

Something is not working

  
duplicate

This issue or pull request already exists

  
effort
high

  
effort
low

  
effort
medium

  
effort
minimal

  
enhancement

New feature

  
help wanted

Need some help

  
invalid

Something is wrong

  
pr
feedback
Used for PRs, indicates that feedback has been given and agent needs to make changes

  
pr
reviewing
Used for PRs, indicates that a human is waiting to review the pull request, no action needed by the agent

  
question

More information is needed

  
status
backlog
Ignore, no work needed yet, human will assign this work by changing to status/planning

  
status
document
Record findings, create flashcards, and document knowledge in knowledgebase for the future

  
status
done
Completed when PR is merged, no more work needed.

  
status
implement
Make the code changes. Should be done by a faster and cheaper model

  
status
pending
Give human a chance to review planning details

  
status
planning
Ready to begin. Fill out implementation details and things like acceptance criteria, etc. A smarter thoughtful llm should be delegated for this

  
status
reviewing
PR is created and feedback loop begins between human and agent

  
wontfix

This won't be fixed

No labels
bug
duplicate
effort
high
effort
low
effort
medium
effort
minimal
enhancement
help wanted
invalid
pr
feedback
pr
reviewing
question
status
backlog
status
document
status
done
status
implement
status
pending
status
planning
status
reviewing
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
MVP
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
tepichord/milner#7
No description provided.