alt Hacker NewsI am curious about your confidence for NFS for the nix store.
My thoughts, ignoring my technical disagreements, would be that you'd want to setup clients to have a specific set of software per their government role. A nix store could expose more software than you planned on supporting (e.g. forgotten software or licensed software).
You could use multiple shares and limit each configuration to the software required. In this case you would share common configs through modules on the build server. The build server would output updated configs to the proper share paths.
A monolithic configuration may be adequate if each machine role only exposes the software that’s needed in its config. Other software that’s in the store could be hidden in some way, like overlay paths, perhaps. There may be other methods too. There’s a similar discussion here although this is about restricting paths via bubblewrap: https://discourse.nixos.org/t/restricting-nix-store-in-a-mou...
Most licensed software wouldn’t be an issue as long as the user doesn’t have license access, I’m assuming the license server would grant or deny access based on the user/user role. Depends on the software I guess.
I wonder if it’s possible to run a bubblewrapped (or similarly restricted) Wayland client and restrict access to store paths that way?