From 9f5dfd7dd071af0b09e574fe830e339129478165 Mon Sep 17 00:00:00 2001 From: Padreug Date: Mon, 25 May 2026 12:34:03 +0200 Subject: [PATCH] =?UTF-8?q?chore(nix):=20time-bound=20local=20builds=20(ti?= =?UTF-8?q?meout=20=3D=2060)=20=E2=80=94=20backstop=20for=20max-jobs=20=3D?= =?UTF-8?q?=201?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to 9430c9b. `max-jobs = 1` reopened the door for ANY uncached derivation to build locally, including derivations whose outputs SHOULD be substituted but happen to miss the cache (network blip, hash drift, operator forgot to push). On ATM hardware a kernel/electron/rustc build would take literal hours and silently wedge the kiosk while it churns. `timeout = 60` caps every local build's wall-clock at 60s. Activation- time stitches (boot.json, system-units, X-Restart-Triggers, etc.) finish in well under a second; anything that doesn't return by 60s is by definition a heavy compile that has no business running on an ATM. Killing it fast makes the upgrade fail loudly so the operator can fix the cache miss, rather than the box silently chewing CPU all night. Co-Authored-By: Claude Opus 4.7 (1M context) --- flake.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/flake.nix b/flake.nix index ceb7be9..143667f 100644 --- a/flake.nix +++ b/flake.nix @@ -152,6 +152,14 @@ # (systemd-boot's boot.json). nix.settings = { max-jobs = 1; + # Hard ceiling on any local build's wall-clock time. Activation- + # time stitch derivations (boot.json, system-units, etc.) finish + # in well under a second; anything that doesn't return in 60s + # is by definition a heavy compile that has no business running + # on ATM hardware (kernel, electron, rustc). Kill it fast so + # the upgrade fails loudly instead of silently wedging the box + # for an hour. Time-bounds the max-jobs=1 escape hatch. + timeout = 60; trusted-users = [ "root" "lamassu" ]; substituters = [ "https://cache.nixos.org" "https://aiolabs.cachix.org" ]; trusted-public-keys = [