From 76cb34a0ae716173d9bed6d6dcb53903762255a8 Mon Sep 17 00:00:00 2001
From: Quentin Dufour <quentin@deuxfleurs.fr>
Date: Wed, 20 Jul 2022 14:44:30 +0200
Subject: [PATCH 1/7] Fail if compiled binary is dynamic

---
 .drone.yml            |  45 ++++++++++--------
 script/not-dynamic.sh |  14 ++++++
 shell.nix             | 104 ++++++++++++++++++++++++------------------
 3 files changed, 98 insertions(+), 65 deletions(-)
 create mode 100755 script/not-dynamic.sh

diff --git a/.drone.yml b/.drone.yml
index 903be5b0..01adc278 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -25,7 +25,7 @@ steps:
       path: /etc/nix
     commands:
       - cp nix/nix.conf /etc/nix/nix.conf
-      - nix-build --no-build-output --no-out-link shell.nix --arg release false  -A inputDerivation
+      - nix-build --no-build-output --no-out-link shell.nix -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
 
   - name: code quality
     image: nixpkgs/nix:nixos-21.05
@@ -35,8 +35,8 @@ steps:
     - name: nix_config
       path: /etc/nix
     commands:
-      - nix-shell --arg release false --run "cargo fmt -- --check"
-      - nix-shell --arg release false --run "cargo clippy -- --deny warnings"
+      - nix-shell --attr rust --run "cargo fmt -- --check"
+      - nix-shell --attr rust --run "cargo clippy -- --deny warnings"
 
   - name: build
     image: nixpkgs/nix:nixos-21.05
@@ -47,6 +47,7 @@ steps:
       path: /etc/nix
     commands:
       - nix-build --no-build-output --option log-lines 100 --argstr target x86_64-unknown-linux-musl --arg release false --argstr git_version $DRONE_COMMIT
+      - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: unit + func tests
     image: nixpkgs/nix:nixos-21.05
@@ -82,7 +83,7 @@ steps:
       path: /etc/nix
     commands:
       - nix-build --no-build-output --argstr target x86_64-unknown-linux-musl --arg release false --argstr git_version $DRONE_COMMIT
-      - nix-shell --arg release false --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
+      - nix-shell --attr integration --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
 
 trigger:
   event:
@@ -120,7 +121,7 @@ steps:
       path: /etc/nix
     commands:
       - cp nix/nix.conf /etc/nix/nix.conf
-      - nix-build --no-build-output --no-out-link shell.nix -A inputDerivation
+      - nix-build --no-build-output --no-out-link shell.nix -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
 
   - name: build
     image: nixpkgs/nix:nixos-21.05
@@ -131,6 +132,7 @@ steps:
       path: /etc/nix
     commands:
       - nix-build --no-build-output --argstr target $TARGET --arg release true --argstr git_version $DRONE_COMMIT
+      - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: integration
     image: nixpkgs/nix:nixos-21.05
@@ -140,7 +142,7 @@ steps:
     - name: nix_config
       path: /etc/nix
     commands:
-      - nix-shell --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
+      - nix-shell --attr integration --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
 
   - name: push static binary
     image: nixpkgs/nix:nixos-21.05
@@ -155,7 +157,7 @@ steps:
       AWS_SECRET_ACCESS_KEY:
         from_secret: garagehq_aws_secret_access_key
     commands:
-      - nix-shell --arg rust false --arg integration false --run "to_s3"
+      - nix-shell --attr release --run "to_s3"
 
   - name: docker build and publish
     image: nixpkgs/nix:nixos-21.05
@@ -174,7 +176,7 @@ steps:
       - mkdir -p /kaniko/.docker
       - echo $DOCKER_AUTH > /kaniko/.docker/config.json
       - export CONTAINER_TAG=${DRONE_TAG:-$DRONE_COMMIT}
-      - nix-shell --arg rust false --arg integration false --run "to_docker"
+      - nix-shell --attr release --run "to_docker"
 
 
 trigger:
@@ -210,7 +212,7 @@ steps:
       path: /etc/nix
     commands:
       - cp nix/nix.conf /etc/nix/nix.conf
-      - nix-build --no-build-output --no-out-link shell.nix -A inputDerivation
+      - nix-build --no-build-output --no-out-link shell.nix -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
 
   - name: build
     image: nixpkgs/nix:nixos-21.05
@@ -221,6 +223,7 @@ steps:
       path: /etc/nix
     commands:
       - nix-build --no-build-output --argstr target $TARGET --arg release true --argstr git_version $DRONE_COMMIT
+      - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: integration
     image: nixpkgs/nix:nixos-21.05
@@ -230,7 +233,7 @@ steps:
     - name: nix_config
       path: /etc/nix
     commands:
-      - nix-shell --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
+      - nix-shell --attr integration --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
 
   - name: push static binary
     image: nixpkgs/nix:nixos-21.05
@@ -245,7 +248,7 @@ steps:
       AWS_SECRET_ACCESS_KEY:
         from_secret: garagehq_aws_secret_access_key
     commands:
-      - nix-shell --arg rust false --arg integration false --run "to_s3"
+      - nix-shell --attr release --run "to_s3"
 
   - name: docker build and publish
     image: nixpkgs/nix:nixos-21.05
@@ -264,7 +267,7 @@ steps:
       - mkdir -p /kaniko/.docker
       - echo $DOCKER_AUTH > /kaniko/.docker/config.json
       - export CONTAINER_TAG=${DRONE_TAG:-$DRONE_COMMIT}
-      - nix-shell --arg rust false --arg integration false --run "to_docker"
+      - nix-shell --attr release --run "to_docker"
 
 trigger:
   event:
@@ -299,7 +302,7 @@ steps:
       path: /etc/nix
     commands:
       - cp nix/nix.conf /etc/nix/nix.conf
-      - nix-build --no-build-output --no-out-link ./shell.nix --arg rust false --arg integration false -A inputDerivation
+      - nix-build --no-build-output --no-out-link shell.nix  -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
 
   - name: build
     image: nixpkgs/nix:nixos-21.05
@@ -310,6 +313,7 @@ steps:
       path: /etc/nix
     commands:
       - nix-build --no-build-output --argstr target $TARGET --arg release true --argstr git_version $DRONE_COMMIT
+      - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: push static binary
     image: nixpkgs/nix:nixos-21.05
@@ -324,7 +328,7 @@ steps:
       AWS_SECRET_ACCESS_KEY:
         from_secret: garagehq_aws_secret_access_key
     commands:
-      - nix-shell --arg rust false --arg integration false --run "to_s3"
+      - nix-shell --attr release --run "to_s3"
 
   - name: docker build and publish
     image: nixpkgs/nix:nixos-21.05
@@ -343,7 +347,7 @@ steps:
       - mkdir -p /kaniko/.docker
       - echo $DOCKER_AUTH > /kaniko/.docker/config.json
       - export CONTAINER_TAG=${DRONE_TAG:-$DRONE_COMMIT}
-      - nix-shell --arg rust false --arg integration false --run "to_docker"
+      - nix-shell --attr release --run "to_docker"
 
 trigger:
   event:
@@ -378,7 +382,7 @@ steps:
       path: /etc/nix
     commands:
       - cp nix/nix.conf /etc/nix/nix.conf
-      - nix-build --no-build-output --no-out-link --arg rust false --arg integration false -A inputDerivation
+      - nix-build --no-build-output --no-out-link shell.nix -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
 
   - name: build
     image: nixpkgs/nix:nixos-21.05
@@ -389,6 +393,7 @@ steps:
       path: /etc/nix
     commands:
       - nix-build --no-build-output --argstr target $TARGET --arg release true --argstr git_version $DRONE_COMMIT
+      - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: push static binary
     image: nixpkgs/nix:nixos-21.05
@@ -403,7 +408,7 @@ steps:
       AWS_SECRET_ACCESS_KEY:
         from_secret: garagehq_aws_secret_access_key
     commands:
-      - nix-shell --arg integration false --arg rust false --run "to_s3"
+      - nix-shell --attr release --run "to_s3"
 
   - name: docker build and publish
     image: nixpkgs/nix:nixos-21.05
@@ -422,7 +427,7 @@ steps:
       - mkdir -p /kaniko/.docker
       - echo $DOCKER_AUTH > /kaniko/.docker/config.json
       - export CONTAINER_TAG=${DRONE_TAG:-$DRONE_COMMIT}
-      - nix-shell --arg rust false --arg integration false --run "to_docker"
+      - nix-shell --attr release --run "to_docker"
 
 trigger:
   event:
@@ -455,7 +460,7 @@ steps:
         from_secret: garagehq_aws_secret_access_key
     commands:
       - mkdir -p /etc/nix && cp nix/nix.conf /etc/nix/nix.conf
-      - nix-shell --arg integration false --arg rust false --run "refresh_index"
+      - nix-shell --attr release --run "refresh_index"
 
 depends_on:
   - release-linux-x86_64
@@ -473,6 +478,6 @@ node:
 
 ---
 kind: signature
-hmac: 3fc19d6f9a3555519c8405e3281b2e74289bb802f644740d5481d53df3a01fa4
+hmac: 60fad5d78c12616be848aae35703f250300abab5f2eda08eb48fe3afd6cc58c8
 
 ...
diff --git a/script/not-dynamic.sh b/script/not-dynamic.sh
new file mode 100755
index 00000000..b9a13070
--- /dev/null
+++ b/script/not-dynamic.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -e
+
+if [ "$#" -ne 1 ]; then
+    echo "[fail] usage: $0 binary"
+    exit 2
+fi
+
+if file $1 | grep 'dynamically linked' 2>&1; then
+    echo "[fail] $1 is dynamic"
+    exit 1
+fi
+echo "[ok] $1 is probably static"
diff --git a/shell.nix b/shell.nix
index 13ea4a0e..eaedb6b8 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,8 +1,5 @@
 {
   system ? builtins.currentSystem,
-  rust ? true,
-  integration ? true,
-  release ? true,
 }:
 
 with import ./nix/common.nix;
@@ -16,9 +13,59 @@ let
   winscp = (import ./nix/winscp.nix) pkgs;
 
 in
+  {
 
-pkgs.mkShell {
-  shellHook = ''
+    /* --- Rust Shell ---
+     * Use it to compile Garage
+     */
+    rust = pkgs.mkShell {
+      shellHook = ''
+function refresh_toolchain {
+  nix copy \
+    --to 's3://nix?endpoint=garage.deuxfleurs.fr&region=garage&secret-key=/etc/nix/signing-key.sec' \
+    $(nix-store -qR \
+      $(nix-build --quiet --no-build-output --no-out-link nix/toolchain.nix))
+}
+      '';
+
+      nativeBuildInputs = [
+        pkgs.rustPlatform.rust.rustc
+        pkgs.rustPlatform.rust.cargo
+        pkgs.clippy
+        pkgs.rustfmt
+        pkgs.perl
+        pkgs.protobuf
+        pkgs.pkg-config
+        pkgs.openssl
+        pkgs.file
+        cargo2nix.packages.x86_64-linux.cargo2nix
+      ];
+    };
+
+    /* --- Integration shell ---
+     * Use it to test Garage with common S3 clients
+     */
+    integration = pkgs.mkShell {
+      nativeBuildInputs = [
+        winscp
+        pkgs.s3cmd
+        pkgs.awscli2
+        pkgs.minio-client
+        pkgs.rclone
+        pkgs.socat
+        pkgs.psmisc
+        pkgs.which
+        pkgs.openssl
+        pkgs.curl
+        pkgs.jq
+      ];
+    };
+
+    /* --- Release shell ---
+     * A shell built to make releasing easier
+     */
+    release = pkgs.mkShell {
+      shellHook = ''
 function to_s3 {
   aws \
       --endpoint-url https://garage.deuxfleurs.fr \
@@ -62,45 +109,12 @@ function refresh_index {
       result/share/_releases.html \
       s3://garagehq.deuxfleurs.fr/
 }
+        '';
+      nativeBuildInputs = [
+        pkgs.awscli2
+        kaniko 
+      ];
+    };
+  }
 
-function refresh_toolchain {
-  nix copy \
-    --to 's3://nix?endpoint=garage.deuxfleurs.fr&region=garage&secret-key=/etc/nix/signing-key.sec' \
-    $(nix-store -qR \
-      $(nix-build --quiet --no-build-output --no-out-link nix/toolchain.nix))
-}
-  '';
 
-  nativeBuildInputs = 
-   (if rust then [
-     pkgs.rustPlatform.rust.rustc
-     pkgs.rustPlatform.rust.cargo
-     pkgs.clippy
-     pkgs.rustfmt
-     pkgs.perl
-     pkgs.protobuf
-     pkgs.pkg-config
-     pkgs.openssl
-     cargo2nix.packages.x86_64-linux.cargo2nix
-    ] else [])
-   ++
-   (if integration then [
-     winscp
-     pkgs.s3cmd
-     pkgs.awscli2
-     pkgs.minio-client
-     pkgs.rclone
-     pkgs.socat
-     pkgs.psmisc
-     pkgs.which
-     pkgs.openssl
-     pkgs.curl
-     pkgs.jq
-    ] else [])
-   ++
-   (if release then [ 
-     pkgs.awscli2
-     kaniko 
-    ] else [])
-   ;
-}
-- 
2.43.4


From 9c9e4833750c19b5fb04a5241df4fd77be6fff78 Mon Sep 17 00:00:00 2001
From: Quentin Dufour <quentin@deuxfleurs.fr>
Date: Sat, 23 Jul 2022 12:02:40 +0200
Subject: [PATCH 2/7] Put log-lines in nix.conf

---
 .drone.yml   | 2 +-
 nix/nix.conf | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.drone.yml b/.drone.yml
index 01adc278..34a6eda7 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -46,7 +46,7 @@ steps:
     - name: nix_config
       path: /etc/nix
     commands:
-      - nix-build --no-build-output --option log-lines 100 --argstr target x86_64-unknown-linux-musl --arg release false --argstr git_version $DRONE_COMMIT
+      - nix-build --no-build-output --argstr target x86_64-unknown-linux-musl --arg release false --argstr git_version $DRONE_COMMIT
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: unit + func tests
diff --git a/nix/nix.conf b/nix/nix.conf
index 871efb10..5a9de951 100644
--- a/nix/nix.conf
+++ b/nix/nix.conf
@@ -2,3 +2,4 @@ substituters = https://cache.nixos.org https://nix.web.deuxfleurs.fr
 trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix.web.deuxfleurs.fr:eTGL6kvaQn6cDR/F9lDYUIP9nCVR/kkshYfLDJf1yKs=
 max-jobs = auto
 cores = 4
+log-lines = 200
-- 
2.43.4


From a49d0ea19f000036ad39b7d6a1134bbd0d07ab1d Mon Sep 17 00:00:00 2001
From: Quentin Dufour <quentin@deuxfleurs.fr>
Date: Sat, 23 Jul 2022 12:17:41 +0200
Subject: [PATCH 3/7] Fix: compile aarch64+armv6 as static binaries

---
 default.nix | 56 +++++++++++++++++++++++++++--------------------------
 1 file changed, 29 insertions(+), 27 deletions(-)

diff --git a/default.nix b/default.nix
index de996ac1..296c7592 100644
--- a/default.nix
+++ b/default.nix
@@ -56,45 +56,47 @@ in let
   */
   overrides = pkgs.rustBuilder.overrides.all ++ [
     /*
-     [1] We need to alter Nix hardening to be able to statically compile: PIE,
+     [1] We need to alter Nix hardening to make static binaries: PIE,
      Position Independent Executables seems to be supported only on amd64. Having
-     this flags set either make our executables crash or compile as dynamic on many platforms.
-     In the following section codegenOpts, we reactive it for the supported targets
-     (only amd64 curently) through the `-static-pie` flag. PIE is a feature used
-     by ASLR, which helps mitigate security issues.
-     Learn more about Nix Hardening: https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/cc-wrapper/add-hardening.sh
-
-     [2] We want to inject the git version while keeping the build deterministic.
-     As we do not want to consider the .git folder as part of the input source,
-     we ask the user (the CI often) to pass the value to Nix.
+     this flag set either 1. make our executables crash or 2. compile as dynamic on some platforms.
+     Here, we deactivate it. Later (find `codegenOpts`), we reactivate it for supported targets
+     (only amd64 curently) through the `-static-pie` flag.
+     PIE is a feature used by ASLR, which helps mitigate security issues.
+     Learn more about Nix Hardening at: https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/cc-wrapper/add-hardening.sh
     */
+    (pkgs.rustBuilder.rustLib.makeOverride {
+      name = "garage";
+      overrideAttrs = drv: { hardeningDisable = [ "pie" ]; };
+    })
+
     (pkgs.rustBuilder.rustLib.makeOverride {
       name = "garage_rpc";
+
+      /*
+       [2] We want to inject the git version while keeping the build deterministic.
+       As we do not want to consider the .git folder as part of the input source,
+       we ask the user (the CI often) to pass the value to Nix.
+      */
       overrideAttrs = drv:
-        /* [1] */ { hardeningDisable = [ "pie" ]; }
-        //
-        /* [2] */ (if git_version != null then {
+        (if git_version != null then {
           preConfigure = ''
             ${drv.preConfigure or ""}
             export GIT_VERSION="${git_version}"
           '';
         } else {});
+
+      /*
+       [3] We ship some parts of the code disabled by default by putting them behind a flag.
+       It speeds up the compilation (when the feature is not required) and released crates have less dependency by default (less attack surface, disk space, etc.).
+       But we want to ship these additional features when we release Garage.
+       In the end, we chose to exclude all features from debug builds while putting (all of) them in the release builds.
+       Currently, the only feature of Garage is kubernetes-discovery from the garage_rpc crate.
+      */
+      overrideArgs = old: {
+        features = if release then [ "kubernetes-discovery" ] else [];
+      };
     })
 
-    /*
-     We ship some parts of the code disabled by default by putting them behind a flag.
-     It speeds up the compilation (when the feature is not required) and released crates have less dependency by default (less attack surface, disk space, etc.).
-     But we want to ship these additional features when we release Garage.
-     In the end, we chose to exclude all features from debug builds while putting (all of) them in the release builds.
-     Currently, the only feature of Garage is kubernetes-discovery from the garage_rpc crate.
-    */
-    (pkgs.rustBuilder.rustLib.makeOverride {
-      name = "garage_rpc";
-      overrideArgs = old:
-        {
-          features = if release then [ "kubernetes-discovery" ] else [];
-        };
-    })
   ];
 
   packageFun = import ./Cargo.nix;
-- 
2.43.4


From 96561c48a154a7617cf2766bdee70d581be67b93 Mon Sep 17 00:00:00 2001
From: Quentin Dufour <quentin@deuxfleurs.fr>
Date: Sun, 24 Jul 2022 11:08:02 +0200
Subject: [PATCH 4/7] Bump Nix image to 22.05

---
 .drone.yml   | 83 ++++++++++++++++++++++++----------------------------
 nix/nix.conf |  2 ++
 2 files changed, 40 insertions(+), 45 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 34a6eda7..726387a4 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -16,19 +16,30 @@ environment:
   HOME: /drone/garage
 
 steps:
-  - name: setup nix
-    image: nixpkgs/nix:nixos-21.05
+  - name: nix maintainance
+    image: nixpkgs/nix:nixos-22.05
+    volumes:
+    - name: nix_store
+      path: /mnt
+    - name: nix_config
+      path: /etc/nix
+    commands:
+    - "[ -d /mnt/store/3vpyn2qz5ay057nq9x68sh0r328d77ng-nix-2.8.1/ ] || (mkdir -p /mnt/store && cp -r /nix/store/* /mnt/store/)"
+    - "[ -d /mnt/var/ ] || cp -r /nix/var /mnt/"
+    - cp nix/nix.conf /etc/nix/nix.conf
+
+  - name: warmup cache
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
     - name: nix_config
       path: /etc/nix
     commands:
-      - cp nix/nix.conf /etc/nix/nix.conf
       - nix-build --no-build-output --no-out-link shell.nix -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
 
   - name: code quality
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -39,7 +50,7 @@ steps:
       - nix-shell --attr rust --run "cargo clippy -- --deny warnings"
 
   - name: build
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -50,7 +61,7 @@ steps:
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: unit + func tests
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     environment:
       GARAGE_TEST_INTEGRATION_EXE: result/bin/garage
     volumes:
@@ -75,7 +86,7 @@ steps:
       - ./result/bin/integration-*
 
   - name: smoke-test
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -93,9 +104,6 @@ trigger:
   - tag
   - cron
 
-node:
-  nix: 1
-
 ---
 kind: pipeline
 type: docker
@@ -113,7 +121,7 @@ environment:
 
 steps:
   - name: setup nix
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -124,7 +132,7 @@ steps:
       - nix-build --no-build-output --no-out-link shell.nix -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
 
   - name: build
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -135,7 +143,7 @@ steps:
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: integration
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -145,7 +153,7 @@ steps:
       - nix-shell --attr integration --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
 
   - name: push static binary
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -160,7 +168,7 @@ steps:
       - nix-shell --attr release --run "to_s3"
 
   - name: docker build and publish
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -184,9 +192,6 @@ trigger:
   - promote
   - cron
 
-node:
-  nix: 1
-
 ---
 kind: pipeline
 type: docker
@@ -204,7 +209,7 @@ environment:
 
 steps:
   - name: setup nix
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -215,7 +220,7 @@ steps:
       - nix-build --no-build-output --no-out-link shell.nix -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
 
   - name: build
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -226,7 +231,7 @@ steps:
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: integration
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -236,7 +241,7 @@ steps:
       - nix-shell --attr integration --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
 
   - name: push static binary
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -251,7 +256,7 @@ steps:
       - nix-shell --attr release --run "to_s3"
 
   - name: docker build and publish
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -274,9 +279,6 @@ trigger:
   - promote
   - cron
 
-node:
-  nix: 1
-
 ---
 kind: pipeline
 type: docker
@@ -294,7 +296,7 @@ environment:
 
 steps:
   - name: setup nix
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -305,7 +307,7 @@ steps:
       - nix-build --no-build-output --no-out-link shell.nix  -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
 
   - name: build
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -316,7 +318,7 @@ steps:
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: push static binary
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -331,7 +333,7 @@ steps:
       - nix-shell --attr release --run "to_s3"
 
   - name: docker build and publish
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -354,9 +356,6 @@ trigger:
   - promote
   - cron
 
-node:
-  nix: 1
-
 ---
 kind: pipeline
 type: docker
@@ -374,7 +373,7 @@ environment:
 
 steps:
   - name: setup nix
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -385,7 +384,7 @@ steps:
       - nix-build --no-build-output --no-out-link shell.nix -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
 
   - name: build
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -396,7 +395,7 @@ steps:
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: push static binary
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -411,7 +410,7 @@ steps:
       - nix-shell --attr release --run "to_s3"
 
   - name: docker build and publish
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -434,9 +433,6 @@ trigger:
   - promote
   - cron
 
-node:
-  nix: 1
-
 ---
 kind: pipeline
 type: docker
@@ -449,7 +445,7 @@ volumes:
 
 steps:
   - name: refresh-index
-    image: nixpkgs/nix:nixos-21.05
+    image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
       path: /nix
@@ -473,11 +469,8 @@ trigger:
   - promote
   - cron
 
-node:
-  nix: 1
-
 ---
 kind: signature
-hmac: 60fad5d78c12616be848aae35703f250300abab5f2eda08eb48fe3afd6cc58c8
+hmac: 12b06094741a9b6da448e3a176d2fc37b2c261ab87acefa60a070e67a55352b0
 
 ...
diff --git a/nix/nix.conf b/nix/nix.conf
index 5a9de951..f3defe69 100644
--- a/nix/nix.conf
+++ b/nix/nix.conf
@@ -3,3 +3,5 @@ trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDS
 max-jobs = auto
 cores = 4
 log-lines = 200
+filter-syscalls = false
+sandbox = false
-- 
2.43.4


From 5fb858424793de8dc35dce8deaa8981a384e064f Mon Sep 17 00:00:00 2001
From: Quentin Dufour <quentin@deuxfleurs.fr>
Date: Mon, 25 Jul 2022 14:58:47 +0200
Subject: [PATCH 5/7] Refactor default.nix to follow Nix Flakes patterns

---
 .drone.yml      |  87 +++++++++++---------------
 default.nix     | 159 +++++++-----------------------------------------
 nix/compile.nix | 140 ++++++++++++++++++++++++++++++++++++++++++
 nix/nix.conf    |   2 +
 4 files changed, 200 insertions(+), 188 deletions(-)
 create mode 100644 nix/compile.nix

diff --git a/.drone.yml b/.drone.yml
index 726387a4..f76e162d 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -36,7 +36,7 @@ steps:
     - name: nix_config
       path: /etc/nix
     commands:
-      - nix-build --no-build-output --no-out-link shell.nix -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
+      - nix-build --no-build-output --no-out-link shell.nix -A rust.inputDerivation -A integration.inputDerivation
 
   - name: code quality
     image: nixpkgs/nix:nixos-22.05
@@ -57,7 +57,7 @@ steps:
     - name: nix_config
       path: /etc/nix
     commands:
-      - nix-build --no-build-output --argstr target x86_64-unknown-linux-musl --arg release false --argstr git_version $DRONE_COMMIT
+      - nix-build --no-build-output --attr pkgs.amd64.debug --argstr git_version $DRONE_COMMIT
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: unit + func tests
@@ -70,12 +70,7 @@ steps:
     - name: nix_config
       path: /etc/nix
     commands:
-      - |
-        nix-build \
-          --no-build-output \
-          --option log-lines 100 \
-          --argstr target x86_64-unknown-linux-musl \
-          --argstr compileMode test
+      - nix-build --no-build-output --attr test.amd64
       - ./result/bin/garage_api-*
       - ./result/bin/garage_model-*
       - ./result/bin/garage_rpc-*
@@ -93,7 +88,7 @@ steps:
     - name: nix_config
       path: /etc/nix
     commands:
-      - nix-build --no-build-output --argstr target x86_64-unknown-linux-musl --arg release false --argstr git_version $DRONE_COMMIT
+      - nix-build --no-build-output --attr pkgs.amd64.debug --argstr git_version $DRONE_COMMIT
       - nix-shell --attr integration --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
 
 trigger:
@@ -107,7 +102,7 @@ trigger:
 ---
 kind: pipeline
 type: docker
-name: release-linux-x86_64
+name: release-linux-amd64
 
 volumes:
 - name: nix_store
@@ -116,20 +111,18 @@ volumes:
 - name: nix_config
   temp: {}
 
-environment:
-  TARGET: x86_64-unknown-linux-musl
-
 steps:
-  - name: setup nix
+  - name: nix maintainance
     image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
-      path: /nix
+      path: /mnt
     - name: nix_config
       path: /etc/nix
     commands:
-      - cp nix/nix.conf /etc/nix/nix.conf
-      - nix-build --no-build-output --no-out-link shell.nix -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
+    - "[ -d /mnt/store/3vpyn2qz5ay057nq9x68sh0r328d77ng-nix-2.8.1/ ] || (mkdir -p /mnt/store && cp -r /nix/store/* /mnt/store/)"
+    - "[ -d /mnt/var/ ] || cp -r /nix/var /mnt/"
+    - cp nix/nix.conf /etc/nix/nix.conf
 
   - name: build
     image: nixpkgs/nix:nixos-22.05
@@ -139,7 +132,7 @@ steps:
     - name: nix_config
       path: /etc/nix
     commands:
-      - nix-build --no-build-output --argstr target $TARGET --arg release true --argstr git_version $DRONE_COMMIT
+      - nix-build --no-build-output --attr pkgs.amd64.release --argstr git_version $DRONE_COMMIT
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: integration
@@ -195,7 +188,7 @@ trigger:
 ---
 kind: pipeline
 type: docker
-name: release-linux-i686
+name: release-linux-i386
 
 volumes:
 - name: nix_store
@@ -204,20 +197,18 @@ volumes:
 - name: nix_config
   temp: {}
 
-environment:
-  TARGET: i686-unknown-linux-musl
-
 steps:
-  - name: setup nix
+  - name: nix maintainance
     image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
-      path: /nix
+      path: /mnt
     - name: nix_config
       path: /etc/nix
     commands:
-      - cp nix/nix.conf /etc/nix/nix.conf
-      - nix-build --no-build-output --no-out-link shell.nix -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
+    - "[ -d /mnt/store/3vpyn2qz5ay057nq9x68sh0r328d77ng-nix-2.8.1/ ] || (mkdir -p /mnt/store && cp -r /nix/store/* /mnt/store/)"
+    - "[ -d /mnt/var/ ] || cp -r /nix/var /mnt/"
+    - cp nix/nix.conf /etc/nix/nix.conf
 
   - name: build
     image: nixpkgs/nix:nixos-22.05
@@ -227,7 +218,7 @@ steps:
     - name: nix_config
       path: /etc/nix
     commands:
-      - nix-build --no-build-output --argstr target $TARGET --arg release true --argstr git_version $DRONE_COMMIT
+      - nix-build --no-build-output --attr pkgs.i386.release --argstr git_version $DRONE_COMMIT
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: integration
@@ -282,7 +273,7 @@ trigger:
 ---
 kind: pipeline
 type: docker
-name: release-linux-aarch64
+name: release-linux-arm64
 
 volumes:
 - name: nix_store
@@ -291,20 +282,18 @@ volumes:
 - name: nix_config
   temp: {}
 
-environment:
-  TARGET: aarch64-unknown-linux-musl
-
 steps:
-  - name: setup nix
+  - name: nix maintainance
     image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
-      path: /nix
+      path: /mnt
     - name: nix_config
       path: /etc/nix
     commands:
-      - cp nix/nix.conf /etc/nix/nix.conf
-      - nix-build --no-build-output --no-out-link shell.nix  -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
+    - "[ -d /mnt/store/3vpyn2qz5ay057nq9x68sh0r328d77ng-nix-2.8.1/ ] || (mkdir -p /mnt/store && cp -r /nix/store/* /mnt/store/)"
+    - "[ -d /mnt/var/ ] || cp -r /nix/var /mnt/"
+    - cp nix/nix.conf /etc/nix/nix.conf
 
   - name: build
     image: nixpkgs/nix:nixos-22.05
@@ -314,7 +303,7 @@ steps:
     - name: nix_config
       path: /etc/nix
     commands:
-      - nix-build --no-build-output --argstr target $TARGET --arg release true --argstr git_version $DRONE_COMMIT
+      - nix-build --no-build-output --attr pkgs.arm64.release --argstr git_version $DRONE_COMMIT
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: push static binary
@@ -359,7 +348,7 @@ trigger:
 ---
 kind: pipeline
 type: docker
-name: release-linux-armv6l
+name: release-linux-arm
 
 volumes:
 - name: nix_store
@@ -368,20 +357,18 @@ volumes:
 - name: nix_config
   temp: {}
 
-environment:
-  TARGET: armv6l-unknown-linux-musleabihf
-
 steps:
-  - name: setup nix
+  - name: nix maintainance
     image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
-      path: /nix
+      path: /mnt
     - name: nix_config
       path: /etc/nix
     commands:
-      - cp nix/nix.conf /etc/nix/nix.conf
-      - nix-build --no-build-output --no-out-link shell.nix -A rust.inputDerivation -A integration.inputDerivation -A release.inputDerivation
+    - "[ -d /mnt/store/3vpyn2qz5ay057nq9x68sh0r328d77ng-nix-2.8.1/ ] || (mkdir -p /mnt/store && cp -r /nix/store/* /mnt/store/)"
+    - "[ -d /mnt/var/ ] || cp -r /nix/var /mnt/"
+    - cp nix/nix.conf /etc/nix/nix.conf
 
   - name: build
     image: nixpkgs/nix:nixos-22.05
@@ -391,7 +378,7 @@ steps:
     - name: nix_config
       path: /etc/nix
     commands:
-      - nix-build --no-build-output --argstr target $TARGET --arg release true --argstr git_version $DRONE_COMMIT
+      - nix-build --no-build-output --attr pkgs.arm.release --argstr git_version $DRONE_COMMIT
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: push static binary
@@ -459,10 +446,10 @@ steps:
       - nix-shell --attr release --run "refresh_index"
 
 depends_on:
-  - release-linux-x86_64
-  - release-linux-i686
-  - release-linux-aarch64
-  - release-linux-armv6l
+  - release-linux-amd64
+  - release-linux-i386
+  - release-linux-arm64
+  - release-linux-arm
 
 trigger:
   event:
@@ -471,6 +458,6 @@ trigger:
 
 ---
 kind: signature
-hmac: 12b06094741a9b6da448e3a176d2fc37b2c261ab87acefa60a070e67a55352b0
+hmac: 9789d5fd470fc4273adcfd05946833268d1e466462c5f36abeb8f607d62fdb4b
 
 ...
diff --git a/default.nix b/default.nix
index 296c7592..5634f0af 100644
--- a/default.nix
+++ b/default.nix
@@ -1,149 +1,32 @@
 {
   system ? builtins.currentSystem,
-  release ? false,
-  target ? "x86_64-unknown-linux-musl",
-  compileMode ? null,
   git_version ? null,
 }:
 
 with import ./nix/common.nix;
 
-let
-  crossSystem = { config = target; };
-in let
-  log = v: builtins.trace v v;
+let 
+  compile = import ./nix/compile.nix;
+  build_debug_and_release = (target: {
+    debug = (compile { inherit target; release = false; }).workspace.garage { compileMode = "build"; }; 
+    release = (compile { inherit target; release = true; }).workspace.garage { compileMode = "build"; }; 
+  });
 
-  pkgs = import pkgsSrc {
-    inherit system crossSystem;
-    overlays = [ cargo2nixOverlay ];
+in {
+  pkgs = {
+    amd64 = build_debug_and_release "x86_64-unknown-linux-musl";
+    i386 = build_debug_and_release "i686-unknown-linux-musl";
+    arm64 = build_debug_and_release "aarch64-unknown-linux-musl";
+    arm = build_debug_and_release "armv6l-unknown-linux-musleabihf";
   };
-
-
-  /*
-   Rust and Nix triples are not the same. Cargo2nix has a dedicated library
-   to convert Nix triples to Rust ones. We need this conversion as we want to
-   set later options linked to our (rust) target in a generic way. Not only
-   the triple terminology is different, but also the "roles" are named differently.
-   Nix uses a build/host/target terminology where Nix's "host" maps to Cargo's "target".
-  */
-  rustTarget = log (pkgs.rustBuilder.rustLib.rustTriple pkgs.stdenv.hostPlatform);
-
-  /*
-   Cargo2nix is built for rustOverlay which installs Rust from Mozilla releases.
-   We want our own Rust to avoid incompatibilities, like we had with musl 1.2.0.
-   rustc was built with musl < 1.2.0 and nix shipped musl >= 1.2.0 which lead to compilation breakage.
-   So we want a Rust release that is bound to our Nix repository to avoid these problems.
-   See here for more info: https://musl.libc.org/time64.html
-   Because Cargo2nix does not support the Rust environment shipped by NixOS,
-   we emulate the structure of the Rust object created by rustOverlay.
-   In practise, rustOverlay ships rustc+cargo in a single derivation while
-   NixOS ships them in separate ones. We reunite them with symlinkJoin.
-   */
-  rustChannel = pkgs.symlinkJoin {
-    name ="rust-channel";
-    paths = [ 
-      pkgs.rustPlatform.rust.rustc
-      pkgs.rustPlatform.rust.cargo
-    ];
-  };
-
-  /*
-   Cargo2nix provides many overrides by default, you can take inspiration from them:
-   https://github.com/cargo2nix/cargo2nix/blob/master/overlay/overrides.nix
-
-   You can have a complete list of the available options by looking at the overriden object, mkcrate:
-   https://github.com/cargo2nix/cargo2nix/blob/master/overlay/mkcrate.nix
-  */
-  overrides = pkgs.rustBuilder.overrides.all ++ [
-    /*
-     [1] We need to alter Nix hardening to make static binaries: PIE,
-     Position Independent Executables seems to be supported only on amd64. Having
-     this flag set either 1. make our executables crash or 2. compile as dynamic on some platforms.
-     Here, we deactivate it. Later (find `codegenOpts`), we reactivate it for supported targets
-     (only amd64 curently) through the `-static-pie` flag.
-     PIE is a feature used by ASLR, which helps mitigate security issues.
-     Learn more about Nix Hardening at: https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/cc-wrapper/add-hardening.sh
-    */
-    (pkgs.rustBuilder.rustLib.makeOverride {
-      name = "garage";
-      overrideAttrs = drv: { hardeningDisable = [ "pie" ]; };
-    })
-
-    (pkgs.rustBuilder.rustLib.makeOverride {
-      name = "garage_rpc";
-
-      /*
-       [2] We want to inject the git version while keeping the build deterministic.
-       As we do not want to consider the .git folder as part of the input source,
-       we ask the user (the CI often) to pass the value to Nix.
-      */
-      overrideAttrs = drv:
-        (if git_version != null then {
-          preConfigure = ''
-            ${drv.preConfigure or ""}
-            export GIT_VERSION="${git_version}"
-          '';
-        } else {});
-
-      /*
-       [3] We ship some parts of the code disabled by default by putting them behind a flag.
-       It speeds up the compilation (when the feature is not required) and released crates have less dependency by default (less attack surface, disk space, etc.).
-       But we want to ship these additional features when we release Garage.
-       In the end, we chose to exclude all features from debug builds while putting (all of) them in the release builds.
-       Currently, the only feature of Garage is kubernetes-discovery from the garage_rpc crate.
-      */
-      overrideArgs = old: {
-        features = if release then [ "kubernetes-discovery" ] else [];
+  test = {
+    amd64 = let
+        pkgs = import pkgsSrc { };
+        rustPkgs = compile { target = "x86_64-unknown-linux-musl"; }; 
+      in
+      pkgs.symlinkJoin {
+        name ="garage-tests";
+        paths = builtins.map (key: rustPkgs.workspace.${key} { compileMode = "test"; }) (builtins.attrNames rustPkgs.workspace);
       };
-    })
-
-  ];
-
-  packageFun = import ./Cargo.nix;
-
-  /*
-    We compile fully static binaries with musl to simplify deployment on most systems.
-    When possible, we reactivate PIE hardening (see above).
-
-    Also, if you set the RUSTFLAGS environment variable, the following parameters will
-    be ignored.
-
-    For more information on static builds, please refer to Rust's RFC 1721.
-    https://rust-lang.github.io/rfcs/1721-crt-static.html#specifying-dynamicstatic-c-runtime-linkage
-  */
-
-  codegenOpts = {
-   "armv6l-unknown-linux-musleabihf" = [ "target-feature=+crt-static" "link-arg=-static" ]; /* compile as dynamic with static-pie */
-   "aarch64-unknown-linux-musl" = [ "target-feature=+crt-static" "link-arg=-static" ]; /* segfault with static-pie */
-   "i686-unknown-linux-musl" = [ "target-feature=+crt-static" "link-arg=-static" ]; /* segfault with static-pie */
-   "x86_64-unknown-linux-musl" = [ "target-feature=+crt-static" "link-arg=-static-pie" ];
   };
-
-  /*
-   The following definition is not elegant as we use a low level function of Cargo2nix
-   that enables us to pass our custom rustChannel object. We need this low level definition
-   to pass Nix's Rust toolchains instead of Mozilla's one.
-
-   target is mandatory but must be kept to null to allow cargo2nix to set it to the appropriate value
-   for each crate.
-  */ 
-  rustPkgs = pkgs.rustBuilder.makePackageSet {
-    inherit packageFun rustChannel release codegenOpts;
-    packageOverrides = overrides;
-    target = null;
-
-    buildRustPackages = pkgs.buildPackages.rustBuilder.makePackageSet {
-      inherit rustChannel packageFun codegenOpts;
-      packageOverrides = overrides;
-      target = null;
-    };
-  };
-
-
-in
-  if compileMode == "test"
-    then pkgs.symlinkJoin {
-      name ="garage-tests";
-      paths = builtins.map (key: rustPkgs.workspace.${key} { inherit compileMode; }) (builtins.attrNames rustPkgs.workspace);
-    }
-    else rustPkgs.workspace.garage { inherit compileMode; }
+}
diff --git a/nix/compile.nix b/nix/compile.nix
new file mode 100644
index 00000000..972e2f2e
--- /dev/null
+++ b/nix/compile.nix
@@ -0,0 +1,140 @@
+{
+  system ? builtins.currentSystem,
+  target ? "x86_64-unknown-linux-musl",
+  release ? false,
+  git_version ? null,
+}:
+
+with import ./common.nix;
+
+let
+  crossSystem = { config = target; };
+
+  log = v: builtins.trace v v;
+
+  pkgs = import pkgsSrc {
+    inherit system crossSystem;
+    overlays = [ cargo2nixOverlay ];
+  };
+
+
+  /*
+   Rust and Nix triples are not the same. Cargo2nix has a dedicated library
+   to convert Nix triples to Rust ones. We need this conversion as we want to
+   set later options linked to our (rust) target in a generic way. Not only
+   the triple terminology is different, but also the "roles" are named differently.
+   Nix uses a build/host/target terminology where Nix's "host" maps to Cargo's "target".
+  */
+  rustTarget = log (pkgs.rustBuilder.rustLib.rustTriple pkgs.stdenv.hostPlatform);
+
+  /*
+   Cargo2nix is built for rustOverlay which installs Rust from Mozilla releases.
+   We want our own Rust to avoid incompatibilities, like we had with musl 1.2.0.
+   rustc was built with musl < 1.2.0 and nix shipped musl >= 1.2.0 which lead to compilation breakage.
+   So we want a Rust release that is bound to our Nix repository to avoid these problems.
+   See here for more info: https://musl.libc.org/time64.html
+   Because Cargo2nix does not support the Rust environment shipped by NixOS,
+   we emulate the structure of the Rust object created by rustOverlay.
+   In practise, rustOverlay ships rustc+cargo in a single derivation while
+   NixOS ships them in separate ones. We reunite them with symlinkJoin.
+   */
+  rustChannel = pkgs.symlinkJoin {
+    name ="rust-channel";
+    paths = [ 
+      pkgs.rustPlatform.rust.rustc
+      pkgs.rustPlatform.rust.cargo
+    ];
+  };
+
+  /*
+   Cargo2nix provides many overrides by default, you can take inspiration from them:
+   https://github.com/cargo2nix/cargo2nix/blob/master/overlay/overrides.nix
+
+   You can have a complete list of the available options by looking at the overriden object, mkcrate:
+   https://github.com/cargo2nix/cargo2nix/blob/master/overlay/mkcrate.nix
+  */
+  overrides = pkgs.rustBuilder.overrides.all ++ [
+    /*
+     [1] We need to alter Nix hardening to make static binaries: PIE,
+     Position Independent Executables seems to be supported only on amd64. Having
+     this flag set either 1. make our executables crash or 2. compile as dynamic on some platforms.
+     Here, we deactivate it. Later (find `codegenOpts`), we reactivate it for supported targets
+     (only amd64 curently) through the `-static-pie` flag.
+     PIE is a feature used by ASLR, which helps mitigate security issues.
+     Learn more about Nix Hardening at: https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/cc-wrapper/add-hardening.sh
+    */
+    (pkgs.rustBuilder.rustLib.makeOverride {
+      name = "garage";
+      overrideAttrs = drv: { hardeningDisable = [ "pie" ]; };
+    })
+
+    (pkgs.rustBuilder.rustLib.makeOverride {
+      name = "garage_rpc";
+
+      /*
+       [2] We want to inject the git version while keeping the build deterministic.
+       As we do not want to consider the .git folder as part of the input source,
+       we ask the user (the CI often) to pass the value to Nix.
+      */
+      overrideAttrs = drv:
+        (if git_version != null then {
+          preConfigure = ''
+            ${drv.preConfigure or ""}
+            export GIT_VERSION="${git_version}"
+          '';
+        } else {});
+
+      /*
+       [3] We ship some parts of the code disabled by default by putting them behind a flag.
+       It speeds up the compilation (when the feature is not required) and released crates have less dependency by default (less attack surface, disk space, etc.).
+       But we want to ship these additional features when we release Garage.
+       In the end, we chose to exclude all features from debug builds while putting (all of) them in the release builds.
+       Currently, the only feature of Garage is kubernetes-discovery from the garage_rpc crate.
+      */
+      overrideArgs = old: {
+        features = if release then [ "kubernetes-discovery" ] else [];
+      };
+    })
+
+  ];
+
+  packageFun = import ../Cargo.nix;
+
+  /*
+    We compile fully static binaries with musl to simplify deployment on most systems.
+    When possible, we reactivate PIE hardening (see above).
+
+    Also, if you set the RUSTFLAGS environment variable, the following parameters will
+    be ignored.
+
+    For more information on static builds, please refer to Rust's RFC 1721.
+    https://rust-lang.github.io/rfcs/1721-crt-static.html#specifying-dynamicstatic-c-runtime-linkage
+  */
+
+  codegenOpts = {
+   "armv6l-unknown-linux-musleabihf" = [ "target-feature=+crt-static" "link-arg=-static" ]; /* compile as dynamic with static-pie */
+   "aarch64-unknown-linux-musl" = [ "target-feature=+crt-static" "link-arg=-static" ]; /* segfault with static-pie */
+   "i686-unknown-linux-musl" = [ "target-feature=+crt-static" "link-arg=-static" ]; /* segfault with static-pie */
+   "x86_64-unknown-linux-musl" = [ "target-feature=+crt-static" "link-arg=-static-pie" ];
+  };
+
+in
+  /*
+   The following definition is not elegant as we use a low level function of Cargo2nix
+   that enables us to pass our custom rustChannel object. We need this low level definition
+   to pass Nix's Rust toolchains instead of Mozilla's one.
+
+   target is mandatory but must be kept to null to allow cargo2nix to set it to the appropriate value
+   for each crate.
+  */ 
+  pkgs.rustBuilder.makePackageSet {
+    inherit packageFun rustChannel release codegenOpts;
+    packageOverrides = overrides;
+    target = null;
+
+    buildRustPackages = pkgs.buildPackages.rustBuilder.makePackageSet {
+      inherit rustChannel packageFun codegenOpts;
+      packageOverrides = overrides;
+      target = null;
+    };
+  }
diff --git a/nix/nix.conf b/nix/nix.conf
index f3defe69..de2ede71 100644
--- a/nix/nix.conf
+++ b/nix/nix.conf
@@ -5,3 +5,5 @@ cores = 4
 log-lines = 200
 filter-syscalls = false
 sandbox = false
+keep-outputs = true
+keep-derivations = true
-- 
2.43.4


From fcb04843f7619d767c3c865e4795fb3468653e28 Mon Sep 17 00:00:00 2001
From: Quentin Dufour <quentin@deuxfleurs.fr>
Date: Mon, 25 Jul 2022 18:10:34 +0200
Subject: [PATCH 6/7] Run clippy in nix, leveraging nix caching ability

---
 .drone.yml      |  32 ++++-------
 default.nix     |  17 +++---
 nix/common.nix  |   8 +--
 nix/compile.nix | 149 ++++++++++++++++++++++++++++++++++++++----------
 nix/nix.conf    |   2 +-
 shell.nix       |  14 ++---
 6 files changed, 148 insertions(+), 74 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index f76e162d..6d76b51d 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -16,7 +16,7 @@ environment:
   HOME: /drone/garage
 
 steps:
-  - name: nix maintainance
+  - name: nix maintenance
     image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
@@ -28,17 +28,7 @@ steps:
     - "[ -d /mnt/var/ ] || cp -r /nix/var /mnt/"
     - cp nix/nix.conf /etc/nix/nix.conf
 
-  - name: warmup cache
-    image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
-    commands:
-      - nix-build --no-build-output --no-out-link shell.nix -A rust.inputDerivation -A integration.inputDerivation
-
-  - name: code quality
+  - name: check formatting
     image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
@@ -47,7 +37,6 @@ steps:
       path: /etc/nix
     commands:
       - nix-shell --attr rust --run "cargo fmt -- --check"
-      - nix-shell --attr rust --run "cargo clippy -- --deny warnings"
 
   - name: build
     image: nixpkgs/nix:nixos-22.05
@@ -57,8 +46,7 @@ steps:
     - name: nix_config
       path: /etc/nix
     commands:
-      - nix-build --no-build-output --attr pkgs.amd64.debug --argstr git_version $DRONE_COMMIT
-      - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
+      - nix-build --no-build-output --attr clippy.amd64 --argstr git_version $DRONE_COMMIT
 
   - name: unit + func tests
     image: nixpkgs/nix:nixos-22.05
@@ -80,7 +68,7 @@ steps:
       - ./result/bin/garage-*
       - ./result/bin/integration-*
 
-  - name: smoke-test
+  - name: integration tests
     image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
@@ -88,7 +76,7 @@ steps:
     - name: nix_config
       path: /etc/nix
     commands:
-      - nix-build --no-build-output --attr pkgs.amd64.debug --argstr git_version $DRONE_COMMIT
+      - nix-build --no-build-output --attr clippy.amd64 --argstr git_version $DRONE_COMMIT
       - nix-shell --attr integration --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
 
 trigger:
@@ -112,7 +100,7 @@ volumes:
   temp: {}
 
 steps:
-  - name: nix maintainance
+  - name: nix maintenance
     image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
@@ -198,7 +186,7 @@ volumes:
   temp: {}
 
 steps:
-  - name: nix maintainance
+  - name: nix maintenance
     image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
@@ -283,7 +271,7 @@ volumes:
   temp: {}
 
 steps:
-  - name: nix maintainance
+  - name: nix maintenance
     image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
@@ -358,7 +346,7 @@ volumes:
   temp: {}
 
 steps:
-  - name: nix maintainance
+  - name: nix maintenance
     image: nixpkgs/nix:nixos-22.05
     volumes:
     - name: nix_store
@@ -458,6 +446,6 @@ trigger:
 
 ---
 kind: signature
-hmac: 9789d5fd470fc4273adcfd05946833268d1e466462c5f36abeb8f607d62fdb4b
+hmac: 0a72ff9a422018b7b06754bd5b9561d3f4bb0d5af28a20ec365c719ee263378a
 
 ...
diff --git a/default.nix b/default.nix
index 5634f0af..4d7558c5 100644
--- a/default.nix
+++ b/default.nix
@@ -6,11 +6,16 @@
 with import ./nix/common.nix;
 
 let 
+  pkgs = import pkgsSrc { };
   compile = import ./nix/compile.nix;
   build_debug_and_release = (target: {
     debug = (compile { inherit target; release = false; }).workspace.garage { compileMode = "build"; }; 
     release = (compile { inherit target; release = true; }).workspace.garage { compileMode = "build"; }; 
   });
+  test = (rustPkgs: pkgs.symlinkJoin {
+    name ="garage-tests";
+    paths = builtins.map (key: rustPkgs.workspace.${key} { compileMode = "test"; }) (builtins.attrNames rustPkgs.workspace);
+  });
 
 in {
   pkgs = {
@@ -20,13 +25,9 @@ in {
     arm = build_debug_and_release "armv6l-unknown-linux-musleabihf";
   };
   test = {
-    amd64 = let
-        pkgs = import pkgsSrc { };
-        rustPkgs = compile { target = "x86_64-unknown-linux-musl"; }; 
-      in
-      pkgs.symlinkJoin {
-        name ="garage-tests";
-        paths = builtins.map (key: rustPkgs.workspace.${key} { compileMode = "test"; }) (builtins.attrNames rustPkgs.workspace);
-      };
+    amd64 = test (compile { target = "x86_64-unknown-linux-musl"; });
+  };
+  clippy = {
+    amd64 = (compile { compiler = "clippy"; }).workspace.garage { compileMode = "build"; } ;
   };
 }
diff --git a/nix/common.nix b/nix/common.nix
index 5cd15c8a..8396a6de 100644
--- a/nix/common.nix
+++ b/nix/common.nix
@@ -4,18 +4,16 @@ rec {
    */
   pkgsSrc = fetchTarball {
     # As of 2021-10-04
-    url ="https://github.com/NixOS/nixpkgs/archive/b27d18a412b071f5d7991d1648cfe78ee7afe68a.tar.gz";
+    url = "https://github.com/NixOS/nixpkgs/archive/b27d18a412b071f5d7991d1648cfe78ee7afe68a.tar.gz";
     sha256 = "1xy9zpypqfxs5gcq5dcla4bfkhxmh5nzn9dyqkr03lqycm9wg5cr";
   };
   cargo2nixSrc = fetchGit {
     # As of 2022-03-17
     url = "https://github.com/superboum/cargo2nix";
-    ref = "main";
-    rev = "bcbf3ba99e9e01a61eb83a24624419c2dd9dec64";
+    ref = "dedup_propagate";
+    rev = "486675c67249e735dd7eb68e1b9feac9db102be7";
   };
 
-
-
   /*
    * Shared objects
    */
diff --git a/nix/compile.nix b/nix/compile.nix
index 972e2f2e..49f7c1d6 100644
--- a/nix/compile.nix
+++ b/nix/compile.nix
@@ -1,6 +1,7 @@
 {
   system ? builtins.currentSystem,
-  target ? "x86_64-unknown-linux-musl",
+  target ? null,
+  compiler ? "rustc",
   release ? false,
   git_version ? null,
 }:
@@ -8,16 +9,14 @@
 with import ./common.nix;
 
 let
-  crossSystem = { config = target; };
-
   log = v: builtins.trace v v;
 
   pkgs = import pkgsSrc {
-    inherit system crossSystem;
+    inherit system; 
+    ${ if target == null then null else "crossSystem" } = { config = target; };
     overlays = [ cargo2nixOverlay ];
   };
 
-
   /*
    Rust and Nix triples are not the same. Cargo2nix has a dedicated library
    to convert Nix triples to Rust ones. We need this conversion as we want to
@@ -38,13 +37,58 @@ let
    In practise, rustOverlay ships rustc+cargo in a single derivation while
    NixOS ships them in separate ones. We reunite them with symlinkJoin.
    */
-  rustChannel = pkgs.symlinkJoin {
-    name ="rust-channel";
-    paths = [ 
-      pkgs.rustPlatform.rust.rustc
-      pkgs.rustPlatform.rust.cargo
-    ];
-  };
+  rustChannel = {
+    rustc = pkgs.symlinkJoin {
+      name = "rust-channel";
+      paths = [ 
+        pkgs.rustPlatform.rust.cargo
+        pkgs.rustPlatform.rust.rustc
+      ];
+    };
+    clippy = pkgs.symlinkJoin {
+      name = "clippy-channel";
+      paths = [ 
+        pkgs.rustPlatform.rust.cargo
+        pkgs.rustPlatform.rust.rustc
+        pkgs.clippy
+      ];
+    };
+  }.${compiler};
+
+  clippyBuilder = pkgs.writeScriptBin "clippy" ''
+    #!${pkgs.stdenv.shell}
+    . ${cargo2nixSrc + "/overlay/utils.sh"}
+    isBuildScript=
+    args=("$@")
+    for i in "''${!args[@]}"; do
+      if [ "xmetadata=" = "x''${args[$i]::9}" ]; then
+        args[$i]=metadata=$NIX_RUST_METADATA
+      elif [ "x--crate-name" = "x''${args[$i]}" ] && [ "xbuild_script_" = "x''${args[$i+1]::13}" ]; then
+        isBuildScript=1
+      fi
+    done
+    if [ "$isBuildScript" ]; then
+      args+=($NIX_RUST_BUILD_LINK_FLAGS)
+    else
+      args+=($NIX_RUST_LINK_FLAGS)
+    fi
+    touch invoke.log
+    echo "''${args[@]}" >>invoke.log
+
+    exec ${rustChannel}/bin/clippy-driver --deny warnings "''${args[@]}"
+  '';
+
+  buildEnv = (drv: {
+    rustc = drv.setBuildEnv;
+    clippy = ''
+      ${drv.setBuildEnv or "" }
+      echo
+      echo --- BUILDING WITH CLIPPY ---
+      echo 
+
+      export RUSTC=${clippyBuilder}/bin/clippy
+    '';
+  }.${compiler});
 
   /*
    Cargo2nix provides many overrides by default, you can take inspiration from them:
@@ -55,47 +99,90 @@ let
   */
   overrides = pkgs.rustBuilder.overrides.all ++ [
     /*
-     [1] We need to alter Nix hardening to make static binaries: PIE,
+     [1] We add some logic to compile our crates with clippy, it provides us many additional lints
+
+     [2] We need to alter Nix hardening to make static binaries: PIE,
      Position Independent Executables seems to be supported only on amd64. Having
      this flag set either 1. make our executables crash or 2. compile as dynamic on some platforms.
      Here, we deactivate it. Later (find `codegenOpts`), we reactivate it for supported targets
      (only amd64 curently) through the `-static-pie` flag.
      PIE is a feature used by ASLR, which helps mitigate security issues.
      Learn more about Nix Hardening at: https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/cc-wrapper/add-hardening.sh
+
+     [3] We want to inject the git version while keeping the build deterministic.
+     As we do not want to consider the .git folder as part of the input source,
+     we ask the user (the CI often) to pass the value to Nix.
+
+     [4] We ship some parts of the code disabled by default by putting them behind a flag.
+     It speeds up the compilation (when the feature is not required) and released crates have less dependency by default (less attack surface, disk space, etc.).
+     But we want to ship these additional features when we release Garage.
+     In the end, we chose to exclude all features from debug builds while putting (all of) them in the release builds.
+     Currently, the only feature of Garage is kubernetes-discovery from the garage_rpc crate.
     */
     (pkgs.rustBuilder.rustLib.makeOverride {
       name = "garage";
-      overrideAttrs = drv: { hardeningDisable = [ "pie" ]; };
+      overrideAttrs = drv: { 
+        /* [1] */ setBuildEnv = (buildEnv drv);
+        /* [2] */ hardeningDisable = [ "pie" ];
+      };
     })
 
     (pkgs.rustBuilder.rustLib.makeOverride {
       name = "garage_rpc";
-
-      /*
-       [2] We want to inject the git version while keeping the build deterministic.
-       As we do not want to consider the .git folder as part of the input source,
-       we ask the user (the CI often) to pass the value to Nix.
-      */
       overrideAttrs = drv:
         (if git_version != null then {
-          preConfigure = ''
+          /* [3] */ preConfigure = ''
             ${drv.preConfigure or ""}
             export GIT_VERSION="${git_version}"
           '';
-        } else {});
-
-      /*
-       [3] We ship some parts of the code disabled by default by putting them behind a flag.
-       It speeds up the compilation (when the feature is not required) and released crates have less dependency by default (less attack surface, disk space, etc.).
-       But we want to ship these additional features when we release Garage.
-       In the end, we chose to exclude all features from debug builds while putting (all of) them in the release builds.
-       Currently, the only feature of Garage is kubernetes-discovery from the garage_rpc crate.
-      */
+        } else {})
+        // {
+          /* [1] */ setBuildEnv = (buildEnv drv);
+        };
       overrideArgs = old: {
-        features = if release then [ "kubernetes-discovery" ] else [];
+        /* [4] */ features = if release then [ "kubernetes-discovery" ] else [];
       };
     })
 
+    (pkgs.rustBuilder.rustLib.makeOverride {
+      name = "garage_db";
+      overrideAttrs = drv: { /* [1] */ setBuildEnv = (buildEnv drv); };
+    })
+
+    (pkgs.rustBuilder.rustLib.makeOverride {
+      name = "garage_util";
+      overrideAttrs = drv: { /* [1] */ setBuildEnv = (buildEnv drv); };
+    })
+
+    (pkgs.rustBuilder.rustLib.makeOverride {
+      name = "garage_table";
+      overrideAttrs = drv: { /* [1] */ setBuildEnv = (buildEnv drv); };
+    })
+
+    (pkgs.rustBuilder.rustLib.makeOverride {
+      name = "garage_block";
+      overrideAttrs = drv: { /* [1] */ setBuildEnv = (buildEnv drv); };
+    })
+
+    (pkgs.rustBuilder.rustLib.makeOverride {
+      name = "garage_model";
+      overrideAttrs = drv: { /* [1] */ setBuildEnv = (buildEnv drv); };
+    })
+
+    (pkgs.rustBuilder.rustLib.makeOverride {
+      name = "garage_api";
+      overrideAttrs = drv: { /* [1] */ setBuildEnv = (buildEnv drv); };
+    })
+
+    (pkgs.rustBuilder.rustLib.makeOverride {
+      name = "garage_web";
+      overrideAttrs = drv: { /* [1] */ setBuildEnv = (buildEnv drv); };
+    })
+
+    (pkgs.rustBuilder.rustLib.makeOverride {
+      name = "k2v-client";
+      overrideAttrs = drv: { /* [1] */ setBuildEnv = (buildEnv drv); };
+    })
   ];
 
   packageFun = import ../Cargo.nix;
diff --git a/nix/nix.conf b/nix/nix.conf
index de2ede71..6abf96b3 100644
--- a/nix/nix.conf
+++ b/nix/nix.conf
@@ -1,7 +1,7 @@
 substituters = https://cache.nixos.org https://nix.web.deuxfleurs.fr
 trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix.web.deuxfleurs.fr:eTGL6kvaQn6cDR/F9lDYUIP9nCVR/kkshYfLDJf1yKs=
 max-jobs = auto
-cores = 4
+cores = 0
 log-lines = 200
 filter-syscalls = false
 sandbox = false
diff --git a/shell.nix b/shell.nix
index eaedb6b8..ea5d6356 100644
--- a/shell.nix
+++ b/shell.nix
@@ -29,16 +29,16 @@ function refresh_toolchain {
       '';
 
       nativeBuildInputs = [
-        pkgs.rustPlatform.rust.rustc
+        #pkgs.rustPlatform.rust.rustc
         pkgs.rustPlatform.rust.cargo
-        pkgs.clippy
+        #pkgs.clippy
         pkgs.rustfmt
-        pkgs.perl
-        pkgs.protobuf
-        pkgs.pkg-config
-        pkgs.openssl
+        #pkgs.perl
+        #pkgs.protobuf
+        #pkgs.pkg-config
+        #pkgs.openssl
         pkgs.file
-        cargo2nix.packages.x86_64-linux.cargo2nix
+        #cargo2nix.packages.x86_64-linux.cargo2nix
       ];
     };
 
-- 
2.43.4


From a184f0d0b5f1d84524f7ba7302a4919567acec56 Mon Sep 17 00:00:00 2001
From: Quentin Dufour <quentin@deuxfleurs.fr>
Date: Thu, 28 Jul 2022 11:41:56 +0200
Subject: [PATCH 7/7] Migrate to nix-daemon builders

---
 .drone.yml | 207 ++++-------------------------------------------------
 1 file changed, 13 insertions(+), 194 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 6d76b51d..0c8a9221 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -2,49 +2,17 @@
 kind: pipeline
 name: default
 
-workspace:
-  base: /drone/garage
-
-volumes:
-- name: nix_store
-  host:
-    path: /var/lib/drone/nix
-- name: nix_config
-  temp: {}
-
-environment:
-  HOME: /drone/garage
+node:
+  nix-daemon: 1
 
 steps:
-  - name: nix maintenance
-    image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /mnt
-    - name: nix_config
-      path: /etc/nix
-    commands:
-    - "[ -d /mnt/store/3vpyn2qz5ay057nq9x68sh0r328d77ng-nix-2.8.1/ ] || (mkdir -p /mnt/store && cp -r /nix/store/* /mnt/store/)"
-    - "[ -d /mnt/var/ ] || cp -r /nix/var /mnt/"
-    - cp nix/nix.conf /etc/nix/nix.conf
-
   - name: check formatting
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     commands:
       - nix-shell --attr rust --run "cargo fmt -- --check"
 
   - name: build
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     commands:
       - nix-build --no-build-output --attr clippy.amd64 --argstr git_version $DRONE_COMMIT
 
@@ -52,11 +20,6 @@ steps:
     image: nixpkgs/nix:nixos-22.05
     environment:
       GARAGE_TEST_INTEGRATION_EXE: result/bin/garage
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     commands:
       - nix-build --no-build-output --attr test.amd64
       - ./result/bin/garage_api-*
@@ -70,11 +33,6 @@ steps:
 
   - name: integration tests
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     commands:
       - nix-build --no-build-output --attr clippy.amd64 --argstr git_version $DRONE_COMMIT
       - nix-shell --attr integration --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
@@ -92,54 +50,23 @@ kind: pipeline
 type: docker
 name: release-linux-amd64
 
-volumes:
-- name: nix_store
-  host:
-    path: /var/lib/drone/nix
-- name: nix_config
-  temp: {}
+node:
+  nix-daemon: 1
 
 steps:
-  - name: nix maintenance
-    image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /mnt
-    - name: nix_config
-      path: /etc/nix
-    commands:
-    - "[ -d /mnt/store/3vpyn2qz5ay057nq9x68sh0r328d77ng-nix-2.8.1/ ] || (mkdir -p /mnt/store && cp -r /nix/store/* /mnt/store/)"
-    - "[ -d /mnt/var/ ] || cp -r /nix/var /mnt/"
-    - cp nix/nix.conf /etc/nix/nix.conf
-
   - name: build
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     commands:
       - nix-build --no-build-output --attr pkgs.amd64.release --argstr git_version $DRONE_COMMIT
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: integration
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     commands:
       - nix-shell --attr integration --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
 
   - name: push static binary
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     environment:
       AWS_ACCESS_KEY_ID:
         from_secret: garagehq_aws_access_key_id
@@ -150,11 +77,6 @@ steps:
 
   - name: docker build and publish
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     environment:
       DOCKER_AUTH:
         from_secret: docker_auth
@@ -178,54 +100,23 @@ kind: pipeline
 type: docker
 name: release-linux-i386
 
-volumes:
-- name: nix_store
-  host:
-    path: /var/lib/drone/nix
-- name: nix_config
-  temp: {}
+node:
+  nix-daemon: 1
 
 steps:
-  - name: nix maintenance
-    image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /mnt
-    - name: nix_config
-      path: /etc/nix
-    commands:
-    - "[ -d /mnt/store/3vpyn2qz5ay057nq9x68sh0r328d77ng-nix-2.8.1/ ] || (mkdir -p /mnt/store && cp -r /nix/store/* /mnt/store/)"
-    - "[ -d /mnt/var/ ] || cp -r /nix/var /mnt/"
-    - cp nix/nix.conf /etc/nix/nix.conf
-
   - name: build
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     commands:
       - nix-build --no-build-output --attr pkgs.i386.release --argstr git_version $DRONE_COMMIT
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: integration
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     commands:
       - nix-shell --attr integration --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
 
   - name: push static binary
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     environment:
       AWS_ACCESS_KEY_ID:
         from_secret: garagehq_aws_access_key_id
@@ -236,11 +127,6 @@ steps:
 
   - name: docker build and publish
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     environment:
       DOCKER_AUTH:
         from_secret: docker_auth
@@ -263,44 +149,18 @@ kind: pipeline
 type: docker
 name: release-linux-arm64
 
-volumes:
-- name: nix_store
-  host:
-    path: /var/lib/drone/nix
-- name: nix_config
-  temp: {}
+node:
+  nix-daemon: 1
 
 steps:
-  - name: nix maintenance
-    image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /mnt
-    - name: nix_config
-      path: /etc/nix
-    commands:
-    - "[ -d /mnt/store/3vpyn2qz5ay057nq9x68sh0r328d77ng-nix-2.8.1/ ] || (mkdir -p /mnt/store && cp -r /nix/store/* /mnt/store/)"
-    - "[ -d /mnt/var/ ] || cp -r /nix/var /mnt/"
-    - cp nix/nix.conf /etc/nix/nix.conf
-
   - name: build
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     commands:
       - nix-build --no-build-output --attr pkgs.arm64.release --argstr git_version $DRONE_COMMIT
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: push static binary
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     environment:
       AWS_ACCESS_KEY_ID:
         from_secret: garagehq_aws_access_key_id
@@ -311,11 +171,6 @@ steps:
 
   - name: docker build and publish
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     environment:
       DOCKER_AUTH:
         from_secret: docker_auth
@@ -338,44 +193,18 @@ kind: pipeline
 type: docker
 name: release-linux-arm
 
-volumes:
-- name: nix_store
-  host:
-    path: /var/lib/drone/nix
-- name: nix_config
-  temp: {}
+node:
+  nix-daemon: 1
 
 steps:
-  - name: nix maintenance
-    image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /mnt
-    - name: nix_config
-      path: /etc/nix
-    commands:
-    - "[ -d /mnt/store/3vpyn2qz5ay057nq9x68sh0r328d77ng-nix-2.8.1/ ] || (mkdir -p /mnt/store && cp -r /nix/store/* /mnt/store/)"
-    - "[ -d /mnt/var/ ] || cp -r /nix/var /mnt/"
-    - cp nix/nix.conf /etc/nix/nix.conf
-
   - name: build
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     commands:
       - nix-build --no-build-output --attr pkgs.arm.release --argstr git_version $DRONE_COMMIT
       - nix-shell --attr rust --run "./script/not-dynamic.sh result/bin/garage"
 
   - name: push static binary
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     environment:
       AWS_ACCESS_KEY_ID:
         from_secret: garagehq_aws_access_key_id
@@ -386,11 +215,6 @@ steps:
 
   - name: docker build and publish
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
-    - name: nix_config
-      path: /etc/nix
     environment:
       DOCKER_AUTH:
         from_secret: docker_auth
@@ -413,17 +237,12 @@ kind: pipeline
 type: docker
 name: refresh-release-page
 
-volumes:
-- name: nix_store
-  host:
-    path: /var/lib/drone/nix
+node:
+  nix-daemon: 1
 
 steps:
   - name: refresh-index
     image: nixpkgs/nix:nixos-22.05
-    volumes:
-    - name: nix_store
-      path: /nix
     environment:
       AWS_ACCESS_KEY_ID:
         from_secret: garagehq_aws_access_key_id
@@ -446,6 +265,6 @@ trigger:
 
 ---
 kind: signature
-hmac: 0a72ff9a422018b7b06754bd5b9561d3f4bb0d5af28a20ec365c719ee263378a
+hmac: 8495114848396ebb492831fc9bd37b353e1a4add9d72c0a123d109490a5b0db0
 
 ...
-- 
2.43.4