Support installing Nix on macOS on AWS EC2, without requiring a manual full-disk-access approval

src/action/common/configure_init_service.rs

@@ -275,7 +275,7 @@ impl Action for ConfigureInitService {
                         })?;
                 }
 
-                crate::action::macos::retry_bootstrap(&domain, &service, &service_dest)
+                crate::action::macos::retry_bootstrap(domain, service, service_dest)
                     .await
                     .map_err(Self::error)?;
 

src/action/macos/bootstrap_launchctl_service.rs

@@ -118,7 +118,7 @@ impl Action for BootstrapLaunchctlService {
         }
 
         if !*is_present {
-            crate::action::macos::retry_bootstrap(DARWIN_LAUNCHD_DOMAIN, &service, &path)
+            crate::action::macos::retry_bootstrap(DARWIN_LAUNCHD_DOMAIN, service, path)
                 .await
                 .map_err(Self::error)?;
         }

src/action/macos/create_determinate_nix_volume.rs

@@ -31,6 +31,7 @@ pub struct CreateDeterminateNixVolume {
     disk: PathBuf,
     name: String,
     case_sensitive: bool,
+    use_ec2_instance_store: bool,
     create_directory: StatefulAction<CreateDirectory>,
     create_or_append_synthetic_conf: StatefulAction<CreateOrInsertIntoFile>,
     create_synthetic_objects: StatefulAction<CreateSyntheticObjects>,
@@ -51,6 +52,7 @@ impl CreateDeterminateNixVolume {
         name: String,
         case_sensitive: bool,
         force: bool,
+        use_ec2_instance_store: bool,
     ) -> Result<StatefulAction<Self>, ActionError> {
         let disk = disk.as_ref();
         let create_or_append_synthetic_conf = CreateOrInsertIntoFile::plan(
@@ -87,6 +89,7 @@ impl CreateDeterminateNixVolume {
         let setup_volume_daemon = CreateDeterminateVolumeService::plan(
             VOLUME_MOUNT_SERVICE_DEST,
             VOLUME_MOUNT_SERVICE_NAME,
+            use_ec2_instance_store,
         )
         .await
         .map_err(Self::error)?;
@@ -106,6 +109,7 @@ impl CreateDeterminateNixVolume {
             disk: disk.to_path_buf(),
             name,
             case_sensitive,
+            use_ec2_instance_store,
             create_directory,
             create_or_append_synthetic_conf,
             create_synthetic_objects,
@@ -219,7 +223,7 @@ impl Action for CreateDeterminateNixVolume {
             .map_err(Self::error)?;
 
         let mut command = Command::new("/usr/local/bin/determinate-nixd");
-        command.args(["--stop-after", "mount", "daemon"]);
+        command.args(["init", "--stop-after", "mount"]);
         command.stderr(std::process::Stdio::piped());
         command.stdout(std::process::Stdio::piped());
         tracing::trace!(command = ?command.as_std(), "Mounting /nix");

src/action/macos/create_determinate_volume_service.rs

@@ -22,19 +22,22 @@ pub struct CreateDeterminateVolumeService {
     path: PathBuf,
     mount_service_label: String,
     needs_bootout: bool,
+    use_ec2_instance_store: bool,
 }
 
 impl CreateDeterminateVolumeService {
     #[tracing::instrument(level = "debug", skip_all)]
     pub async fn plan(
         path: impl AsRef<Path>,
         mount_service_label: impl Into<String>,
+        use_ec2_instance_store: bool,
     ) -> Result<StatefulAction<Self>, ActionError> {
         let path = path.as_ref().to_path_buf();
         let mount_service_label = mount_service_label.into();
         let mut this = Self {
             path,
             mount_service_label,
+            use_ec2_instance_store,
             needs_bootout: false,
         };
 
@@ -67,9 +70,10 @@ impl CreateDeterminateVolumeService {
             let discovered_plist: LaunchctlMountPlist =
                 plist::from_file(&this.path).map_err(Self::error)?;
 
-            let expected_plist = generate_mount_plist(&this.mount_service_label)
-                .await
-                .map_err(Self::error)?;
+            let expected_plist =
+                generate_mount_plist(&this.mount_service_label, use_ec2_instance_store)
+                    .await
+                    .map_err(Self::error)?;
             if discovered_plist != expected_plist {
                 tracing::trace!(
                     ?discovered_plist,
@@ -131,15 +135,16 @@ impl Action for CreateDeterminateVolumeService {
             path,
             mount_service_label,
             needs_bootout,
+            use_ec2_instance_store,
         } = self;
 
         if *needs_bootout {
-            crate::action::macos::retry_bootout(DARWIN_LAUNCHD_DOMAIN, &mount_service_label, &path)
+            crate::action::macos::retry_bootout(DARWIN_LAUNCHD_DOMAIN, mount_service_label, path)
                 .await
                 .map_err(Self::error)?;
         }
 
-        let generated_plist = generate_mount_plist(mount_service_label)
+        let generated_plist = generate_mount_plist(mount_service_label, *use_ec2_instance_store)
             .await
             .map_err(Self::error)?;
 
@@ -180,18 +185,18 @@ impl Action for CreateDeterminateVolumeService {
 /// This function must be able to operate at both plan and execute time.
 async fn generate_mount_plist(
     mount_service_label: &str,
+    use_ec2_instance_store: bool,
 ) -> Result<LaunchctlMountPlist, ActionErrorKind> {
+    let mut arguments = vec!["/usr/local/bin/determinate-nixd".into(), "init".into()];
+    if use_ec2_instance_store {
+        arguments.push("--keep-mounted".into());
+    }
     let mount_plist = LaunchctlMountPlist {
         run_at_load: true,
         label: mount_service_label.into(),
-        program_arguments: vec![
-            "/usr/local/bin/determinate-nixd".into(),
-            "--stop-after".into(),
-            "mount".into(),
-            "daemon".into(),
-        ],
-        standard_out_path: "/var/log/determinate-nixd-mount.log".into(),
-        standard_error_path: "/var/log/determinate-nixd-mount.log".into(),
+        program_arguments: arguments,
+        standard_out_path: "/var/log/determinate-nix-init.log".into(),
+        standard_error_path: "/var/log/determinate-nix-init.log".into(),
     };
 
     Ok(mount_plist)

src/action/macos/create_nix_hook_service.rs

@@ -127,7 +127,7 @@ impl Action for CreateNixHookService {
         } = self;
 
         if *needs_bootout {
-            crate::action::macos::retry_bootout(DARWIN_LAUNCHD_DOMAIN, &service_label, &path)
+            crate::action::macos::retry_bootout(DARWIN_LAUNCHD_DOMAIN, service_label, path)
                 .await
                 .map_err(Self::error)?;
         }

src/action/macos/create_volume_service.rs

@@ -186,7 +186,7 @@ impl Action for CreateVolumeService {
         } = self;
 
         if *needs_bootout {
-            crate::action::macos::retry_bootout(DARWIN_LAUNCHD_DOMAIN, &mount_service_label, &path)
+            crate::action::macos::retry_bootout(DARWIN_LAUNCHD_DOMAIN, mount_service_label, path)
                 .await
                 .map_err(Self::error)?;
         }

src/os/darwin/diskutil.rs

@@ -36,3 +36,19 @@ pub struct DiskUtilApfsListVolume {
     pub name: Option<String>,
     pub encryption: bool,
 }
+
+#[derive(serde::Deserialize, Clone, Debug)]
+#[serde(rename_all = "PascalCase")]
+pub struct DiskUtilList {
+    pub all_disks_and_partitions: Vec<DiskUtilListDisk>,
+}
+
+#[derive(serde::Deserialize, Clone, Debug)]
+#[serde(rename_all = "PascalCase")]
+pub struct DiskUtilListDisk {
+    #[serde(rename = "OSInternal")]
+    pub os_internal: bool,
+    pub device_identifier: String,
+    #[serde(rename = "Size")]
+    pub size_bytes: u64,
+}