fix: avoid channel evaluation during prebuilt activation

Use the rebuild binary from the reviewed closure and --no-reexec. The bootstrap nixos-rebuild otherwise evaluates its own package through the old channel before honoring --store-path. The failed attempt made no live changes.
This commit is contained in:
Coding Agent
2026-09-04 23:16:21 +00:00
parent a2843c982f
commit a6cd721bf0
+5 -2
View File
@@ -39,10 +39,13 @@ New source files must be added to Git for flakes to see them. Keep `flake.lock`
Review and activate exactly the built closure: Review and activate exactly the built closure:
```sh ```sh
sudo nixos-rebuild dry-activate --store-path "$(readlink -f result)" built=$(readlink -f result)
sudo nixos-rebuild switch --store-path "$(readlink -f result)" sudo "$built/sw/bin/nixos-rebuild" dry-activate --no-reexec --store-path "$built"
sudo "$built/sw/bin/nixos-rebuild" switch --no-reexec --store-path "$built"
``` ```
Use the rebuild tool from that closure with `--no-reexec`: otherwise the bootstrap tool can try to rebuild itself through the old channel even when `--store-path` is supplied. Capturing `built` also keeps review and activation on the same immutable result.
For initial deployment on a compatible NixOS EC2 base where flakes are not enabled yet, check out this repo and run the build as an existing administrator with the temporary CLI flag: For initial deployment on a compatible NixOS EC2 base where flakes are not enabled yet, check out this repo and run the build as an existing administrator with the temporary CLI flag:
```sh ```sh