additionalNetrcSources doesn't work on 3.9.0+?

[name-snrl]

Our team uses determinate nix, we also started using private cachix. The configuration steps for our team are as follows:

1. Install nix

curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | \
  sh -s -- install --determinate \
  --extra-conf "trusted-users = $(whoami)" \
  --extra-conf "extra-trusted-public-keys = name.cachix.org-1:key" \
  --extra-conf "extra-substituters = https://name.cachix.org" \
  --extra-conf "lazy-trees = true"

2. Configure cachix

2.1 Add cachix to config (skip on fresh nix installation)

Replace the old value or add the following configuration options to
/etc/nix/nix.custom.conf:

extra-trusted-public-keys = name.cachix.org-1:key
extra-substituters = https://name.cachix.org

2.2 Configure authentification token

sudo sh <<CMD
echo 'machine name.cachix.org password <auth_token>' >/etc/nix/netrc
mkdir -p /etc/determinate
echo '{
  "authentication": {
    "additionalNetrcSources": [
      "/etc/nix/netrc"
    ]
  }
}' >/etc/determinate/config.json
launchctl kickstart -k system/systems.determinate.nix-daemon
CMD

---

However, on some machines determinate daemon doesn't create /nix/var/determinate/netrc. For example, this happens with the following versions:

• nix (Determinate Nix 3.11.2) 2.31.1
• nix (Determinate Nix 3.9.0) 2.30.2

at the same time, everything works correctly with these versions:

• nix (Determinate Nix 3.8.2) 2.30.1
• nix (Determinate Nix 3.7.0) 2.29.1

[name-snrl]

Hello, sorry for bothering, but any comments on this, guys? @grahamc @cole-h @lucperkins

[cole-h]

Thanks for the ping. I just tried this myself on 3.11.2 and could not reproduce.

cole@bjendal ~> cat /etc/nix/netrc
machine foo.cachix.org password bar

cole@bjendal ~> cat /etc/determinate/config.json
{
  "authentication": {
    "additionalNetrcSources": [
      "/etc/nix/netrc"
    ]
  }
}

cole@bjendal ~> cat /nix/var/determinate/netrc | sed 's/flakehub1_.*//'
machine flakehub.com login flakehub password
machine api.flakehub.com login flakehub password
machine cache.flakehub.com login flakehub password
machine foo.cachix.org password bar

---

Could you check your logs to see if there are any errors or otherwise interesting log lines inside there?

• /var/log/determinate-nix-init.log
• /var/log/determinate-nix-daemon.log

[name-snrl]

• /var/log/determinate-nix-init.log

  2025-09-24T03:16:09.389853Z ERROR determinate_nixd: Nix binary did not exist at /run/current-system/sw/bin/nix (NixOS) or /nix/var/nix/profiles/default/bin/nix (Linux and macOS); the determinate-nixd controlled Nix daemon will not work. Please specify the path to the directory containing the `nix` program via the `--nix-bin` flag.
    at src/main.rs:147

  2025-09-24T03:16:09.654701Z  INFO determinate_nixd::nix_conf: Writing the Determinate managed Nix configuration to "/etc/nix/nix.conf"
    at src/nix_conf/mod.rs:379
    in determinate_nixd::nix_conf::write_once with self: ConfigWriter { config: DaemonConfig, include_fhc: No, lazy_trees: Disabled, external_builders: Disabled, parallel_eval_cores: ParallelEvalCores { max_cores: 1 }, nix_conf_dir: "/etc/nix" }
    in determinate_nixd::command::init::execute with args: InitArgs { stop_after: None, keep_mounted: false }, dissenter: Some(DiskArbitrationDissenter)

  2025-09-24T03:16:09.655251Z  INFO determinate_nixd::command::init: Updating Nix's trusted certificates from Keychain
    at src/command/init.rs:72
    in determinate_nixd::command::init::execute with args: InitArgs { stop_after: None, keep_mounted: false }, dissenter: Some(DiskArbitrationDissenter)

  2025-09-24T03:16:09.661714Z  INFO determinate_nixd::command::init: Unlocking and mounting /nix
    at src/command/init.rs:96
    in determinate_nixd::command::init::execute with args: InitArgs { stop_after: None, keep_mounted: false }, dissenter: Some(DiskArbitrationDissenter)

Unlocking any cryptographic user on APFS Volume disk3s7
Unlocked and mounted APFS Volume

• /var/log/determinate-nix-daemon.log

  2025-09-24T14:27:52.462595Z ERROR determinate_nixd::auth: Authentication failure, s: Determinate Nix is logged out.
    at src/auth/mod.rs:284
    in determinate_nixd::auth::try_token_refresh
    in determinate_nixd::auth::work
    in determinate_nixd::command::start_nix_daemon::start_nix_daemon_interior
    in determinate_nixd::command::start_nix_daemon::start_nix_daemon

  2025-09-24T15:27:52.405491Z ERROR determinate_nixd::auth: Authentication failure, s: Determinate Nix is logged out.
    at src/auth/mod.rs:284
    in determinate_nixd::auth::try_token_refresh
    in determinate_nixd::auth::work
    in determinate_nixd::command::start_nix_daemon::start_nix_daemon_interior
    in determinate_nixd::command::start_nix_daemon::start_nix_daemon

other information that could help:

twl@macmini:~/ > ls -l /nix/var/nix/profiles/default/bin           
lrwxr-xr-x  1 root  wheel  57 Jan  1  1970 /nix/var/nix/profiles/default/bin -> /nix/store/21ncb6prn4ij69nhp7g3n8hbkqy5jqji-nix-3.9.0/bin
twl@macmini:~/ > ls -l /nix/var/nix/profiles/default/bin/
total 6656
-r-xr-xr-x  1 root  nixbld  3407520 Jan  1  1970 nix
lrwxr-xr-x  1 root  nixbld        3 Jan  1  1970 nix-build -> nix
lrwxr-xr-x  1 root  nixbld        3 Jan  1  1970 nix-channel -> nix
lrwxr-xr-x  1 root  nixbld        3 Jan  1  1970 nix-collect-garbage -> nix
lrwxr-xr-x  1 root  nixbld        3 Jan  1  1970 nix-copy-closure -> nix
lrwxr-xr-x  1 root  nixbld        3 Jan  1  1970 nix-daemon -> nix
lrwxr-xr-x  1 root  nixbld        3 Jan  1  1970 nix-env -> nix
lrwxr-xr-x  1 root  nixbld        3 Jan  1  1970 nix-hash -> nix
lrwxr-xr-x  1 root  nixbld        3 Jan  1  1970 nix-instantiate -> nix
lrwxr-xr-x  1 root  nixbld        3 Jan  1  1970 nix-prefetch-url -> nix
lrwxr-xr-x  1 root  nixbld        3 Jan  1  1970 nix-shell -> nix
lrwxr-xr-x  1 root  nixbld        3 Jan  1  1970 nix-store -> nix
twl@macmini:~/ > ps aux | grep nixd
root              1859   0.0  0.0 411204000  15856   ??  S     8:27AM   0:00.12 /nix/var/nix/profiles/default/bin/nix-daemon --option json-log-path /var/run/determinate-nixd-logger.socket
root              1851   0.0  0.1 411962992  34864   ??  Ss    8:27AM   0:01.38 /usr/local/bin/determinate-nixd daemon

[cole-h]

If you login with determinate-nixd login, does it work as expected then? There may be a bug where we don't write out the netrc file if we fail to login to FlakeHub.

[name-snrl]

If you login with determinate-nixd login, does it work as expected then?

Yes, now daemon generates /nix/var/determinate/netrc. I also noticed that after removing custom /etc/nix/netrc file specified in additionalNetrcSources option and restarting daemon it doesn't remove record.