Optional flake inputs

[RyanGibb]

E.g.

inputs.foo = {
  url = "...";
  optional = true;
};

Use case: I have a private flake input that prevents someone else building the project. However this forms only a small part of the larger project. It would be good for anyone to be able to build the rest without having to access the private input.

[jakehamilton]

This might be a good thing to put through the RFC process. It certainly has a lot of edges that would need to be ironed out.

Though, for your use case today it may make sense to set the input to an empty repository by default and then use --override-input foo=... to map things to use your private data.

[RyanGibb]

This might be a good thing to put through the RFC process. It certainly has a lot of edges that would need to be ironed out.

That sounds like a great idea. Thanks for the suggestion.

Though, for your use case today it may make sense to set the input to an empty repository by default and then use --override-input foo=... to map things to use your private data.

Interesting. Is there a standard way to point to an empty repository (e.g. input = 'null')?

[jakehamilton]

@RyanGibb I don't believe there's a built-in way. However, you could do something like use a subdirectory of your flake or push up an super bare flake repo. I would probably opt for the second so you can do something like:

{
  inputs = {
    secret-stuff.url = "github:ryangibb/empty";
  };
}

That would probably be the cleanest way given the current constraints. Would still be worth bringing up in an RFC if you're interested. I know that I've thought about trying to use private modules in my public flake, but haven't actually tried due to current limitations.

[RyanGibb]

Thanks, @jakehamilton ! I'll have a go at creating an RFC

[RyanGibb]

So I've tried overriding an empty flake input, but it doesn't seem to work:

nix build --override-input cv "git+ssh://[email protected]/RyanGibb/cv.git?ref=main"
warning: Git tree '/home/ryan/projects/gibbr.org' is dirty
warning: not writing modified lock file of flake 'git+file:///home/ryan/projects/gibbr.org':
• Updated input 'cv':
    'path:/nix/store/qlzcbb316lz7b8yygs67zbi8x9w0d4nk-source/flake.nix?lastModified=1&narHash=sha256-TIEAoFhFsRyU0zX8sD6cyMgr3lujKfVnb23wKQSKuKU=' (1970-01-01)
  → 'git+ssh://[email protected]/RyanGibb/cv.git?ref=main&rev=a21b3ad535c7f7ceb5b768c0ccc71d9438fa290e' (2022-10-22)
error: attribute 'defaultPackage' missing

       at /nix/store/y02x767n7ixyfg8d9hcqwifymq9j98zl-source/flake.nix:31:20:

           30|               ${pkgs.rsync}/bin/rsync -a --exclude '*.md' --exclude 'result' --exclude '.*' . $out
           31|               cp ${cv.defaultPackage.${system}}/*.pdf $out/resources/cv.pdf
             |                    ^
           32|             '';
(use '--show-trace' to show detailed location information)

[RyanGibb]

But both of these succeed:

$ nix build "git+ssh://[email protected]/RyanGibb/cv.git?ref=main"
$ nix build "git+ssh://[email protected]/RyanGibb/cv.git?ref=main#defaultPackage.x86_64-linux"

[SuperSandro2000]

Instead of hacking something into flake inputs, could this easily be handled in nix code that the part that requires private code is optional?

[RyanGibb]

I suppose we could possibly write a derivation that is optional, but then we lose the advantages flakes give us for composing projects, like updating the git revision easily.

[RyanGibb]

Ah-ha!

This was failing because I had inputs.cv.flake = false;.

[SuperSandro2000]

I suppose we could possibly write a derivation that is optional, but then we lose the advantages flakes give us for composing projects, like updating the git revision easily.

People that do not have access to the private repo can't update it but it should otherwise work because flakes should be downloaded lazy.

[RyanGibb]

Okay this commit adds this for the repo that takes the private repo as an input: https://github.com/RyanGibb/gibbr.org/commit/86403e25363a391a1033bbdb7e83c16044268a2e

And this commit overrides the private input when deploying it on a NixOS system: RyanGibb/nixos@9d13ca8

[RyanGibb]

People that do not have access to the private repo can't update it but it should otherwise work because flakes should be downloaded lazy.

Oh I see, let me try this.

[RyanGibb]

The only thing is, how can we pass a flag to enable using the private repo?

At the moment I'm checking whether or not to use the private repo flake based on if it contains a defaultPackage (if it's not empty).

[RyanGibb]

#2861 made me realise we can effectively pass an argument by targeting a different derivation: https://github.com/RyanGibb/gibbr.org/commit/a899ee6ca403ce6f71cfbcb20a647bde79652bef.

I think this closes the issue. Thanks @SuperSandro2000!