### Build a Linux Derivation from Nixpkgs

Source: https://docs.determinate.systems/troubleshooting/native-linux-builder

An example command to build a Linux derivation from Nixpkgs using the native Linux builder. This is useful for testing your setup after troubleshooting.

```bash
nix build --print-build-logs --substituters "" \
  "https://flakehub.com/f/DeterminateSystems/minimal-stdenv/0.1#packages.x86_64-linux.default"
```

--------------------------------

### Example Resolved Store Path

Source: https://docs.determinate.systems/flakehub/cli

An example of a Nix store path that has been resolved from a FlakeHub flake reference.

```text
/nix/store/
1ab797rfbdcjzissxrsf25rqy0l8mksq
-
cli-0.1.0

```

--------------------------------

### Check Nix Installation Directory

Source: https://docs.determinate.systems/guides/migrating-from-upstream-nix

List the contents of the `/nix` directory to verify if Nix was installed using the Determinate Nix Installer. The presence of `nix-installer` and `receipt.json` indicates a Determinate Nix installation.

```bash
ls /nix
```

--------------------------------

### Install Determinate Nix

Source: https://docs.determinate.systems/guides/migrating-from-upstream-nix

Execute this command to install Determinate Nix using the Determinate Nix Installer. If issues arise, consider uninstalling and reinstalling Nix.

```bash
curl -fsSL https://install.determinate.systems/nix | \
  sh -s -- install
```

--------------------------------

### Example NixOS flake.nix

Source: https://docs.determinate.systems/guides/nixos-aws

A basic example of a `flake.nix` file that defines a NixOS configuration. This flake can be published to FlakeHub.

```nix
{ 
  inputs.nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0"; # stable Nixpkgs
 
  outputs = 
    { self, ... }@inputs:
    {
      nixosConfigurations.my-nixos-system = inputs.nixpkgs.lib.nixosSystem {
        # system configuration
      };
    };
}
```

--------------------------------

### Install Determinate Nix for Linux

Source: https://docs.determinate.systems/getting-started/individuals

Use this command to install Determinate Nix on Linux systems. Ensure you have curl installed.

```bash
curl -fsSL https://install.determinate.systems/nix | sh -s -- install
```

--------------------------------

### Example Determinate Nixd Configuration

Source: https://docs.determinate.systems/determinate-nix

This is an example of a configuration file for Determinate Nixd, located at `/etc/determinate/config.json`. It shows settings for garbage collection, authentication, and the builder.

```json
{
  "garbageCollector": {
    "strategy": "automatic"
  },
  "authentication": {
    "additionalNetrcSources": [
      "/etc/determinate/netrc.custom"
    ]
  },
  "builder": {
    "state": "enabled",
    "memoryBytes": 8589934592,
    "cpuCount": 1
  }
}
```

--------------------------------

### Buildkite Pipeline for FlakeHub Cache

Source: https://docs.determinate.systems/guides/buildkite

An example Buildkite pipeline configuration for pushing store paths to FlakeHub Cache. It installs Determinate Nix, obtains an OIDC token for FlakeHub authentication, sets up Magic Nix Cache, and builds packages.

```yaml
steps:
  - label: Push store paths to FlakeHub Cache
    env:
      DETERMINATE_NIX_INSTALL_URL: https://install.determinate.systems/nix?ci=buildkite
      MAGIC_NIX_CACHE_CLOSURE_URL: https://install.determinate.systems/magic-nix-cache-closure/branch/main/X64-Linux?ci=buildkite
      MAGIC_NIX_CACHE_LISTEN: 127.0.0.1:37515
    command: |
      echo "Installing Determinate Nix"

      curl --proto '=https' --tlsv1.2 -sSf -L "$${DETERMINATE_NIX_INSTALL_URL}" | \
        sh -s -- install linux \
          --no-confirm \
          --init none

      nohup /usr/local/bin/determinate-nixd daemon &
      export NIX_REMOTE="daemon"

      echo "Waiting for Determinate Nixd status"

      while ! determinate-nixd status &>/dev/null; do
        sleep 0.1;
      done

      echo "Determinate Nix installed"

      # Set PATH to include Nix-created directories and persist that environment variable in a file
      PATH="${PATH}:/root/.nix-profile/bin/"

      echo "Fetching OIDC token for Buildkite"

      buildkite_oidc_token="$(
        buildkite-agent oidc request-token \
        --claim 'organization_id' \
        --claim 'pipeline_id' \
        --audience "api.flakehub.com"
      )"

      echo "Logging in to FlakeHub using OIDC token"

      echo "${buildkite_oidc_token}" | determinate-nixd login token --token-file /dev/stdin

      echo "Installing Magic Nix Cache"

      magic_nix_cache_closure="$(curl -L "$${MAGIC_NIX_CACHE_CLOSURE_URL}" | xz -d | sudo "$(which nix-store)" --import | tail -n1 | head -n1)"
      sudo ln -sf "${magic_nix_cache_closure}/bin/magic-nix-cache" /usr/bin/magic-nix-cache

      magic_nix_cache_startup_file="/tmp/mnc-startup"

      echo "Waiting for Magic Nix Cache to start up"

      nohup magic-nix-cache --listen "$${MAGIC_NIX_CACHE_LISTEN}" --startup-notification-file "${magic_nix_cache_startup_file}" &>/tmp/mnc.log &
      (
        started=0
        for n in {1..6}; do
          if [ -e "${magic_nix_cache_startup_file}" ]; then
            echo "Magic Nix Cache daemon has successfully started up after ${n} attempt(s)"
            started=1
            break
          else
            echo "Waiting on Magic Nix Cache daemon; on attempt ${n}"
            sleep 2
          fi
        done

        if [[ "${started}" != "1" ]]; then
          echo "The Magic Nix Cache daemon did not start up within 60 seconds; exiting"
          exit 1
        fi
      )

      # Build whatever you'd like with Nix
      nix build .#my-package-1
      nix build .#my-package-2

      # Drain Magic Nix Cache
      curl -XPOST "http://$${MAGIC_NIX_CACHE_LISTEN}/api/workflow-finish"

      echo "Store paths successfully pushed to FlakeHub Cache!"
```

--------------------------------

### Example of Nix building from an additional cache

Source: https://docs.determinate.systems/guides/migrate-to-flakehub-cache

This output demonstrates a successful Nix build where the required path is copied from the configured additional cache (`cache.example.com`).

```text
$ nix run
[...]
copying path '/nix/store/px5wm2jf76y9qw277kkfzb76c21zwzg1-rust-std-stable-2024-10-17' from 'https://cache.example.com'...
```

--------------------------------

### Install Determinate Nix in GitHub Actions

Source: https://docs.determinate.systems/guides/github-actions

Use this action to quickly and reliably install Nix in your GitHub Actions workflows. It's a prerequisite for other Determinate Systems actions.

```yaml
on:
  pull_request:
  workflow_dispatch:
  push:
    branches:
      - main
 
jobs:
  nix-ci:
    runs-on: ubuntu-latest
    # Include this block to log in to FlakeHub and access private flakes
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v5
      - uses: DeterminateSystems/determinate-nix-action@v3
      - uses: DeterminateSystems/flakehub-cache-action@main
      - uses: DeterminateSystems/nix-flake-checker-action@main
      - run: nix flake check
```

--------------------------------

### macOS Configuration Profile Example

Source: https://docs.determinate.systems/troubleshooting/suis-premount-dissented

This is an example of a macOS computer-wide configuration profile that restricts media mounting, causing the 'SUIS premount dissented' error.

```xml
<key>PayloadType</key>
<string>com.apple.systemuiserver</string>

<key>PayloadContent</key>
<dict>
    <key>mount-controls</key>
    <dict>
        <key>harddisk-internal</key>
        <array>
            <string>deny</string>
        </array>
    </dict>
</dict>
```

--------------------------------

### Install Determinate via MDM Script

Source: https://docs.determinate.systems/guides/mdm

This shell script automates the download, verification, and installation of Determinate. It checks for existing installations and validates the package signature before proceeding. Run as a non-root user with administrative privileges.

```shell
#!/bin/sh

set -eu

scratch=$(mktemp -p /tmp -d -t determinate.XXXXXXXXXX)
finish() {
  rm -rf "$scratch"
}
trap finish EXIT

realScratch=$(realpath "$scratch")

TEAM_ID="X3JQ4VPJZ6"

(pkgutil --pkg-info-plist systems.determinate.Determinate 2> /dev/null || true) > "$realScratch/installed.plist"

installedVersion=$(defaults read "$realScratch/installed.plist" pkg-version 2> /dev/null|| true)

downloadUrl=$(curl -w "%{{url_effective}}
" -I -L -s -S https://install.determinate.systems/determinate-pkg/stable/Universal -o /dev/null)
currentlyReleased=$(echo "$downloadUrl" | cut -d/ -f6 | sed 's/^v//')

echo "Installed: ${installedVersion:-n/a}"
echo "Current release: $currentlyReleased"

if [ "$installedVersion" = "$currentlyReleased" ]; then
  echo "No update required."
  exit 0
fi

echo "Downloading from $downloadUrl"

curl \
  --proto '=https' \
  --tlsv1.2 \
  -sSf \
  -L "$downloadUrl" \
  -o "$realScratch/Determinate.pkg"

actualTeamId=$(spctl -a -vv -t install "$realScratch/Determinate.pkg" 2>&1 | awk -F '(' '/origin=/ {print $2 }' | tr -d '()')

echo "Expected team ID: $TEAM_ID"
echo "Actual team ID: $actualTeamId"
if [ "$actualTeamId" != "$TEAM_ID" ]; then
  echo "Team ID did not match."
  exit 1
fi

installer -verboseR -pkg "$realScratch/Determinate.pkg" -tgt "/"

echo "Complete"

```

--------------------------------

### Verify Nix Installation and FlakeHub Authentication

Source: https://docs.determinate.systems/guides/deploy-nix-macos-ec2

After installation, run these commands to check if Nix is working correctly and if Determinate Nix is properly authenticated with FlakeHub.

```bash
# Check Nix works
nix --version
 
# Verify FlakeHub authentication
determinate-nixd status
```

--------------------------------

### Generate a nix-darwin configuration using Nix

Source: https://docs.determinate.systems/guides/nix-darwin

Initialize a new nix-darwin configuration using a Determinate Nix flake template. Follow the on-screen instructions to complete the setup.

```bash
nix flake init --template "https://flakehub.com/f/DeterminateSystems/flake-templates/0#nix-darwin"
```

--------------------------------

### Logged in Status Example

Source: https://docs.determinate.systems/flakehub/cli

Example output when logged into FlakeHub, showing login status, GitHub username, and token expiration.

```text
Logged in: true
GitHub user name: my-github-username
Token expires at: 2025-01-22 14:41:48 -08:00
```

--------------------------------

### Example BuiltPathResponseEventV1 JSON

Source: https://docs.determinate.systems/guides/post-build-events

An example JSON event indicating a successful build, including the derivation path and its outputs.

```json
{
  "v": "1",
  "c": "BuiltPathResponseEventV1",
  "drv": "/nix/store/apdrfapx7hrx45az67g1i2k0kvixg1av-hello-2.12.1.drv",
  "outputs": [
    "/nix/store/lwld8afww62dcd97kwdnwwvv0bh5mqf1-hello-2.12.1"
  ]
}
```

--------------------------------

### Uninstall Nix with Determinate Nix Installer

Source: https://docs.determinate.systems/guides/migrating-from-upstream-nix

Use this command to uninstall Nix if it was previously installed with the Determinate Nix Installer. This is typically found in the `/nix` directory.

```bash
/nix/nix-installer uninstall
```

--------------------------------

### Determinate Nix Installer Error: Diskutil Command Failed

Source: https://docs.determinate.systems/troubleshooting/suis-premount-dissented

An error from older versions of the Determinate Nix Installer showing a failed attempt to mount the 'Nix Store' volume via the diskutil command.

```text
Failed to execute command with status 1 `"/usr/sbin/diskutil" "mount" "Nix Store"`, stdout:
      stderr: Volume on disk3s7 failed to mount: "SUIS premount dissented"
```

--------------------------------

### GitLab CI/CD authentication configuration example

Source: https://docs.determinate.systems/determinate-nix

Example configuration for GitLab CI/CD to provide a JWT for FlakeHub authentication. Ensure the environment variable name matches the one used in the `determinate-nixd login` command.

```yaml
job_logging_in_to_flakehub:
  id_tokens:
    FLAKEHUB_GITLAB_CI_TOKEN:
      aud: https://my-audience.dev
```

--------------------------------

### Execute Non-Switch Command with fh apply nixos

Source: https://docs.determinate.systems/flakehub/cli

This example shows how to use `fh apply nixos` to execute a command other than `switch`, such as `boot`, for applying a configuration.

```bash
fh apply nixos "my-org/system-configs/0.1" boot
```

--------------------------------

### Install Determinate Nix on macOS EC2

Source: https://docs.determinate.systems/guides/deploy-nix-macos-ec2

Use this command to install Determinate Nix on an EC2 macOS instance, ensuring it's configured to use the instance store for the Nix store.

```bash
curl -fsSL https://install.determinate.systems/nix | \
  sh -s -- install macos \
  --no-confirm \
  --use-ec2-instance-store
```

--------------------------------

### Bind Determinate Nixd installation to a FlakeHub customer

Source: https://docs.determinate.systems/determinate-nix

Bind your Determinate Nixd installation to a specific FlakeHub customer. Future logins will be validated against this binding.

```bash
determinate-nixd auth bind my-organization
```

--------------------------------

### Basic Nix CI Workflow with DeterminateSystems/ci

Source: https://docs.determinate.systems/guides/github-actions

Configure a GitHub Actions workflow to use the DeterminateSystems/ci action. This setup triggers on pushes to main, tags, and workflow dispatches, and handles pull requests. It requires read permissions for contents and write permissions for ID tokens.

```yaml
on:
  pull_request:
  workflow_dispatch:
  push:
    branches:
      - main
    tags:
      - v?[0-9]+.[0-9]+.[0-9]+*
 
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
 
jobs:
  nix-ci:
    uses: DeterminateSystems/ci/.github/workflows/workflow.yml@main
    permissions:
      id-token: write
      contents: read
```

--------------------------------

### Launch Template User Data for Auto Scaling

Source: https://docs.determinate.systems/guides/deploy-nix-macos-ec2

This script is intended for use as user data in an AWS launch template. It automates the installation of Determinate Nix with EC2 instance store support when new instances are launched.

```bash
#!/bin/bash
curl -fsSL https://install.determinate.systems/nix | \
  sh -s -- install macos \
  --no-confirm \
  --use-ec2-instance-store
```

--------------------------------

### List flakes with the 'python' label

Source: https://docs.determinate.systems/flakehub/cli

This is an example of listing all flakes that have been tagged with the 'python' label.

```bash
fh list label python
```

--------------------------------

### cURL SSE Connection Output with BuiltPathResponseEventV1

Source: https://docs.determinate.systems/guides/post-build-events

Example output from a cURL command listening to the Determinate Nixd event stream, showing a successful build event.

```text
* Couldn't find host localhost in the .netrc file; using defaults
*   Trying /nix/var/determinate/determinate-nixd.socket:0...
* Connected to localhost (/nix/var/determinate/determinate-nixd.socket) port 80
> GET /events HTTP/1.1
> Host: localhost
> User-Agent: curl/8.6.0
> Accept: */*
>
< HTTP/1.1 200 OK
< content-type: text/event-stream
< cache-control: no-cache
< transfer-encoding: chunked
< date: Wed, 28 Aug 2024 02:36:04 GMT
>

: 

data: {"v":"1","c":"BuiltPathResponseEventV1","drv":"/nix/store/apdrfapx7hrx45az67g1i2k0kvixg1av-hello-2.12.1.drv","outputs":["/nix/store/lwld8afww62dcd97kwdnwwvv0bh5mqf1-hello-2.12.1"]}
```

--------------------------------

### Get Nix Store Path Info

Source: https://docs.determinate.systems/flakehub/store-paths

Use `nix path-info` to evaluate a flake reference and get its corresponding Nix store path. This command is useful for understanding how Nix resolves derivations.

```bash
nix path-info "https://flakehub.com/f/NixOS/nixpkgs/*#coreutils"
```

--------------------------------

### Nix Installer Error: Volume Mount Failed

Source: https://docs.determinate.systems/troubleshooting/suis-premount-dissented

A cryptic error message from the nixos.org Nix installer indicating a failure to mount the volume due to 'SUIS premount dissented'.

```text
Volume on disk3s7 failed to mount: "SUIS premount dissented"
```

--------------------------------

### Example Flake for Dev Shell with OpenSSL (FIPS)

Source: https://docs.determinate.systems/secure-packages

This flake uses Determinate Secure Packages with FIPS enabled to output a dev shell with OpenSSL available. It supports multiple architectures.

```nix
{ inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0"; 

 outputs = 
    { self, ... }@inputs:
    let
      supportedSystems = [
        "x86_64-linux" # 64-bit x86 Intel/AMD Linux
        "aarch64-linux" # 64-bit ARM Linux
        "aarch64-darwin" # 64-bit ARM macOS
      ];

      forEachSupportedSystem =
        f:
        inputs.nixpkgs.lib.genAttrs supportedSystems (
          system:
          f { 
            pkgs = import inputs.nixpkgs { inherit system; };
          }
        );
    in
    {
      devShells = forEachSupportedSystem (
        { pkgs }:
        {
          default = pkgs.mkShell { 
            packages = with pkgs; [ 
              openssl
            ];
          };
        }
      );
    };
}

```

--------------------------------

### Authentication status output

Source: https://docs.determinate.systems/guides/resolve-only-deploy

This is an example of the confirmation output after successfully logging into FlakeHub with a token.

```text
Logged in: true
FlakeHub user name: DeterminateSystems
FlakeHub organizations: []
```

--------------------------------

### Check Determinate Nix Version

Source: https://docs.determinate.systems/determinate-nix

Use this command to check the currently installed version of Determinate Nix. If not on the latest version, upgrade instructions will be provided.

```bash
determinate-nixd version
```

--------------------------------

### Example Full Resource Name (FRN) for GCP

Source: https://docs.determinate.systems/guides/log-in-with-gcp

This is an example of the Full Resource Name (FRN) format for GCP-delegated trust relationships. The FRN is used by Determinate Nixd to identify the specific trust relationship.

```text
frn:flakehub:gcp-delegated:DeterminateSystems::dev/ephemeral-vm
```

--------------------------------

### Generate Shell Auto-completion Scripts

Source: https://docs.determinate.systems/determinate-nix

Generate auto-completion scripts for various shells by running the `determinate-nixd completion` command. Example shown for zsh.

```bash
eval "$(determinate-nixd completion zsh)"
```

--------------------------------

### Apply NixOS Configuration from FlakeHub

Source: https://docs.determinate.systems/flakehub/cli

Applies a NixOS configuration by building the derivation and switching to the new system configuration. This method uses `fh resolve` to get the store path.

```bash
# Build the derivation
nix build \
  --max-jobs 0 \
  --profile /nix/var/nix/profiles/system \
  $(fh resolve "my-org/my-nixos-configs#nixosConfigurations.my-dev-workstation")

# Apply the configuration
/nix/var/nix/profiles/system/bin/switch-to-configuration switch
```

--------------------------------

### NixOS Rebuild with Extra Substituters

Source: https://docs.determinate.systems/guides/advanced-installation

Pass these flags during `nixos-rebuild` to configure Nix to use Determinate's binary cache. This avoids building Determinate Nix from source and is essential for initial setup or upgrading to versions before 3.6.0.

```bash
sudo nixos-rebuild \
  --option extra-substituters https://install.determinate.systems \
  --option extra-trusted-public-keys cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM= \
  --flake ... \
  switch

```

--------------------------------

### Buildkite Pipeline for FlakeHub Publishing

Source: https://docs.determinate.systems/guides/buildkite

This pipeline configures environment variables for Determinate Nix and FlakeHub, installs necessary tools, retrieves an OIDC token, and publishes a tagged release to FlakeHub.

```yaml
steps:
  - label: Publish tagged release to FlakeHub
    env:
      DETERMINATE_NIX_INSTALL_URL: https://install.determinate.systems/nix?ci=buildkite
      FLAKEHUB_PUSH_BINARY_URL: https://install.determinate.systems/flakehub-push/branch/main/X64-Linux?ci=buildkite
      # Set these to match your own flake
      FLAKE_ORG: my-org
      FLAKE_NAME: my-flake
      FLAKE_VISIBILITY: unlisted # could also be public or private
    command: |
      echo "Installing Determinate Nix"

      curl --proto '=https' --tlsv1.2 -sSf -L "$${DETERMINATE_NIX_INSTALL_URL}" | \
        sh -s -- install linux \
          --no-confirm \
          --init none

      echo "Determinate Nix installed"

      echo "Installing flakehub-push"

      curl -L "$${FLAKEHUB_PUSH_BINARY_URL}" | sudo tee /usr/bin/flakehub-push &>/dev/null
      sudo chmod +x /usr/bin/flakehub-push

      echo "Fetching OIDC token for Buildkite"

      buildkite_oidc_token="$(
        buildkite-agent oidc request-token \
        --claim 'organization_id' \
        --claim 'pipeline_id' \
        --audience "api.flakehub.com"
      )"

      # Required environment variables for flakehub-push
      export FLAKEHUB_PUSH_OIDC_TOKEN="${buildkite_oidc_token}"
      export FLAKEHUB_PUSH_REPOSITORY="$${FLAKE_ORG}/$${FLAKE_NAME}"

      # Publish the flake if and only if it's a tag reference
      if [[ ! -z "${BUILDKITE_TAG:-""}" ]]; then
        flakehub-push \
          --tag "${BUILDKITE_TAG}" \
          --visibility "$${FLAKE_VISIBILITY}" \
          --include-output-paths

        echo "The flake ${FLAKEHUB_PUSH_REPOSITORY} has been published to FlakeHub with version ${BUILDKITE_TAG}"
      fi
```

--------------------------------

### Publish Flakes to FlakeHub with GitHub Actions

Source: https://docs.determinate.systems/getting-started/individuals

Example GitHub Actions workflow to automatically publish flakes to FlakeHub on every push to the main branch. Requires checkout and Determinate Nix actions.

```yaml
name: Publish every Git push to main to FlakeHub
on:
  push:
    branches:
      - main

jobs:
  flakehub-publish:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v5
      - uses: DeterminateSystems/determinate-nix-action@v3
      - uses: DeterminateSystems/flakehub-push@main
        with:
          rolling: true
          visibility: private
          include-output-paths: true
```

--------------------------------

### Semaphore Pipeline Configuration

Source: https://docs.determinate.systems/guides/semaphore

This configuration sets up a Semaphore pipeline to install Determinate Nix, authenticate with FlakeHub, build packages, and publish flakes. It requires environment variables for FlakeHub and OIDC tokens.

```yaml
version: v1.0
name: Determinate Nix publish and cache pipeline
agent:
  machine:
    type: f1-standard-4
    os_image: ubuntu2404
blocks:
  - name: 
    dependencies: []
    task:
      prologue:
        commands:
          # Get the latest version of the repository's source code from GitHub
          - checkout
 
      jobs:
        - name: Publish flake and cache package
          commands:
          # The flake's repository
          - export FLAKEHUB_PUSH_REPOSITORY="$(echo "${SEMAPHORE_ORGANIZATION_URL}" | cut -d "." -f1 | cut -d '/' -f3)/${SEMAPHORE_PROJECT_NAME}"
 
          # Environment variables for Magic Nix Cache, which automatically pushes Nix artifacts to FlakeHub Cache
          - export MAGIC_NIX_CACHE_CLOSURE_URL="https://install.determinate.systems/magic-nix-cache-closure/branch/main/X64-Linux?ci=semaphore"
          - export MNC_LISTEN="127.0.0.1:37515"
 
          # Install Determinate Nix and start the Nix daemon
          - curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install linux --no-confirm --init systemd
          - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
 
          # Log in using the `determinate-nixd login` command (used by magic-nix-cache, substitutions)
          - echo "${SEMAPHORE_OIDC_TOKEN}" | determinate-nixd login token --token-file /dev/stdin
 
          # Acquire the `flakehub-push` executable
          - curl -L "${FLAKEHUB_PUSH_BINARY_URL}" | sudo tee /usr/bin/flakehub-push &>/dev/null
          - sudo chmod +x /usr/bin/flakehub-push
 
          # Acquire the `magic-nix-cache` executable
          - export MNC_CLSR="$(curl -L "${MAGIC_NIX_CACHE_CLOSURE_URL}" | xz -d | sudo "$(which nix-store)" --import | tail -n1 | head -n1)"
          - sudo ln -sf "${MNC_CLSR}/bin/magic-nix-cache" /usr/bin/magic-nix-cache
          - magic-nix-cache --help
 
          # Stage login credentials for `flakehub-push`
          - export FLAKEHUB_PUSH_OIDC_TOKEN="${SEMAPHORE_OIDC_TOKEN}"
 
          # Start Magic Nix Cache
          - export MNC_STARTUP_FILE="/tmp/mnc-startup"
          - nohup magic-nix-cache --listen "${MNC_LISTEN}" --startup-notification-file "${MNC_STARTUP_FILE}" &>/tmp/mnc.log &
          - |
              (
              STARTED=0
              for n in {1..6};
              do
                if [ -e "${MNC_STARTUP_FILE}" ]; then
                  echo "magic-nix-cache daemon has successfully started up after ${n} attempt(s)"
                  STARTED=1
                  break
                else
                  echo "waiting on magic-nix-cache daemon; on attempt ${n}"
                  sleep 2
                fi
              done
              if [[ "${STARTED}" != "1" ]]; then
                echo "The daemon did not start up within 60 seconds; exiting"
                exit 1
              fi
              ) || true
 
          # Build a package output by the repository's Nix flake
          - nix build ".#packages.x86_64-linux.default"
 
          # Publish a flake release to FlakeHub if and only if it's a tag reference
          - |
            if [[ "${SEMAPHORE_GIT_REF_TYPE}" == "tag" ]]; then
              flakehub-push \
                --tag "$(cat "${SEMAPHORE_GIT_REF}" | cut -d '/' -f2)" \
                --visibility private \
                --include-output-paths
            fi
 
          # Stop Magic Nix Cache
          - curl -XPOST "http://${MNC_LISTEN}/api/workflow-finish"

```

--------------------------------

### Initialize Determinate Nix

Source: https://docs.determinate.systems/determinate-nix

Initialize Determinate Nix after system boot. Use the --keep-mounted flag to ensure the Nix store remains mounted.

```bash
determinate-nixd init
```

```bash
determinate-nixd init \
  --keep-mounted
```

--------------------------------

### Relocate Existing Nix Receipt

Source: https://docs.determinate.systems/guides/migrating-from-upstream-nix

If you previously installed Nix using the Determinate Nix Installer, move the existing receipt file to a different location before proceeding with the new installation. Skip this step if no receipt exists.

```bash
mv /nix/receipt.json /nix/receipt-old.json
```

--------------------------------

### Initialize a New Flake with FlakeHub CLI Tool

Source: https://docs.determinate.systems/getting-started/individuals

Run this command to interactively generate a flake.nix for your project. It uses your responses and the repository's contents to configure the flake.

```bash
nix run "https://flakehub.com/f/DeterminateSystems/fh/0" -- init
```

--------------------------------

### Initialize a New Flake with Determinate Nix Default Template

Source: https://docs.determinate.systems/getting-started/individuals

Use this command to create a new flake.nix and .envrc file in your current directory, turning existing projects into flakes.

```bash
nix flake init
```

--------------------------------

### Apply Home Manager Configuration

Source: https://docs.determinate.systems/flakehub/cli

Applies a Home Manager configuration from a specified output path. If no path is given, it defaults to `homeConfigurations.$(whoami)`.

```bash
fh apply home-manager "my-org/home-configs/0.1#homeConfigurations.standard-home-config"
```

```bash
fh apply home-manager "my-org/home-configs/0.1#homeConfigurations.$(whoami)"
```

```bash
fh apply home-manager "my-org/home-configs/0.1"
```

--------------------------------

### Initialize NixOS Flake Template

Source: https://docs.determinate.systems/guides/advanced-installation

Use this command to generate a new NixOS configuration based on Determinate Nix's flake templates if you don't have an existing configuration.

```bash
nix flake init --template "https://flakehub.com/f/DeterminateSystems/flake-templates/0#nixos"

```

--------------------------------

### Initialize New Flake

Source: https://docs.determinate.systems/flakehub/cli

Generates a new `flake.nix` file based on interactive prompts and repository contents. Use `--root` to specify a different directory.

```bash
fh init
```

--------------------------------

### Example GCP Service Account Identifier

Source: https://docs.determinate.systems/guides/log-in-with-gcp

This is an example of the format for a GCP service account identifier. Ensure you use the actual email address obtained from the metadata API.

```text
123456789-compute@developer.gserviceaccount.com
```

--------------------------------

### Netrc file example for FlakeHub

Source: https://docs.determinate.systems/flakehub/concepts/authentication

This is an example of a netrc file used by Determinate Nix to supply authentication information to FlakeHub services. The 'password' field should contain a FlakeHub-issued JWT.

```shell
machine flakehub.com login flakehub password flakehub1_...
machine api.flakehub.com login flakehub password flakehub1_...
machine cache.flakehub.com login flakehub password flakehub1_...
```

--------------------------------

### Apply Nix-Darwin Configuration

Source: https://docs.determinate.systems/flakehub/cli

Applies a nix-darwin configuration from a specified output path. If no path is given, it defaults to `darwinConfigurations.${devicename}.system`.

```bash
sudo fh apply nix-darwin "my-org/macos-configs/0.1#darwinConfigurations.justme-aarch64-darwin"
```

```bash
sudo fh apply nix-darwin "my-org/macos-configs/0.1#darwinConfigurations.$(scutil --get LocalHostName)"
```

```bash
sudo fh apply nix-darwin "my-org/macos-configs/0.1"
```

--------------------------------

### FlakeHub Login Status

Source: https://docs.determinate.systems/getting-started/individuals

This is an example of the output you will see after successfully logging into FlakeHub via Determinate Nixd.

```text
Logged in: true
FlakeHub user name: my-flakehub-username
FlakeHub organizations: []
Installation is not bound to a FlakeHub customer.
```

--------------------------------

### Build Nix Package

Source: https://docs.determinate.systems/guides/post-build-events

Commands to build a Nix package, which will trigger post-build events if the Determinate Nixd listener is active.

```bash
nix build nixpkgs#hello
```

```bash
nix build nixpkgs#hello --rebuild
```

--------------------------------

### FlakeHub Push Configuration

Source: https://docs.determinate.systems/flakehub/cli

Example GitHub Actions workflow configuration to publish flakes to FlakeHub, including store paths.

```yaml
- name: Publish to FlakeHub
  uses: determinatesystems/flakehub-push@main
  with:
    include-output-paths: true
```

--------------------------------

### Equivalent fh apply nixos Commands

Source: https://docs.determinate.systems/flakehub/cli

These commands demonstrate equivalent ways to apply a NixOS configuration when the flake output path is omitted, defaulting to `nixosConfigurations.$(hostname)`.

```bash
sudo fh apply nixos "my-org/system-configs/0.1#nixosConfigurations.$(hostname)"
```

```bash
sudo fh apply nixos "my-org/system-configs/0.1"
```

--------------------------------

### Apply NixOS configuration to AMI

Source: https://docs.determinate.systems/guides/nixos-aws

A two-command sequence to apply a NixOS configuration to an AMI. First, log in to FlakeHub, then apply the configuration using a resolved store path.

```bash
determinate-nixd login aws
sudo fh apply nixos "my-org/my-flake/*#nixosConfigurations.my-nixos-configuration-output"
```

--------------------------------

### Reset Determinate Nixd binding and authentication

Source: https://docs.determinate.systems/determinate-nix

Undo the binding of a Determinate Nixd installation and reset authentication. This command typically requires root or elevated privileges.

```bash
sudo determinate-nixd auth reset
```

--------------------------------

### Apply Home Manager Configuration

Source: https://docs.determinate.systems/flakehub/store-paths

Apply a Home Manager configuration using `fh apply` with a resolved store path. This is efficient when using FlakeHub Cache, as it bypasses local flake evaluation.

```bash
fh apply home-manager "my-org/my-home-manager-config-flake/*"
```

--------------------------------

### Define Custom Flake Schema

Source: https://docs.determinate.systems/flakehub/concepts/flake-schemas

Example of a flake defining a custom schema for a `superSpecialPackage` output, including version, documentation, and an inventory function to describe package details.

```nix
{
  inputs.nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0";
 
  outputs =
    { ... }@inputs:
    let
      mkChildren = children: { inherit children; };
    in
    {
      superSpecialPackage.x86_64-linux.default = inputs.nixpkgs.legacyPackages.x86_64-linux.hello;
 
      schemas.superSpecialPackage = {
        version = 1;
        doc = "The `superSpecialPackage` output defines a [super special package](https://example.org).";
        inventory =
          output:
          mkChildren (
            builtins.mapAttrs (systemType: packagesForSystem: {
              forSystems = [ systemType ];
              children = builtins.mapAttrs (packageName: package: {
                forSystems = [ systemType ];
                what = "super special package";
                shortDescription = package.meta.description or "";
                derivation = package;
                evalChecks.isDerivation = package.type or null == "derivation" && package ? drvPath;
              }) packagesForSystem;
            }) output
          );
      };
    };
}
```

--------------------------------

### Apply NixOS Configuration from FlakeHub

Source: https://docs.determinate.systems/guides/nixos-isos

Apply a NixOS configuration from FlakeHub using the fh CLI after logging in with `determinate-nixd login`. Ensure you replace placeholders with your specific organization, flake, and configuration details.

```bash
determinate-nixd login

```

```bash
fh apply nixos "my-org/my-flake/*#nixosConfigurations.my-nixos-configuration-output"
```

--------------------------------

### Apply NixOS System Configuration

Source: https://docs.determinate.systems/flakehub/store-paths

Apply a NixOS system configuration using `fh apply` with a resolved store path. This method leverages FlakeHub Cache for efficient deployment without local flake evaluation.

```bash
sudo fh apply nixos "my-org/my-nixos-config-flake/*"
```

--------------------------------

### Add a Flake Input to flake.nix

Source: https://docs.determinate.systems/flakehub/cli

Use `fh add` to add the most current release of a specified flake to your `flake.nix` file and update the `outputs` function. This example adds Nixpkgs.

```bash
fh add nixos/nixpkgs
```

--------------------------------

### Show Flake Outputs for Nixpkgs

Source: https://docs.determinate.systems/flakehub/private-flakes

Access and display the outputs of a public flake, such as Nixpkgs, using the `nix flake show` command. This is a standard way to inspect flake contents.

```bash
nix flake show "https://flakehub.com/f/NixOS/nixpkgs/*"
```

--------------------------------

### Example Wildcard ARNs

Source: https://docs.determinate.systems/guides/log-in-with-aws-sts

Illustrates valid wildcard patterns for ARNs when configuring FlakeHub organization settings. Wildcards are only permitted for the resource part of the ARN and must be the final character.

```text
arn:aws:iam::194722411868:role/github-actions/*
```

```text
arn:aws:iam::194722411868:role/*
```

--------------------------------

### Listen to Determinate Nixd Events with cURL

Source: https://docs.determinate.systems/guides/post-build-events

Use cURL to connect to the Determinate Nixd socket and stream post-build events. This command initiates the SSE connection.

```bash
curl -nLv --unix-socket /nix/var/determinate/determinate-nixd.socket http://localhost/events
```

--------------------------------

### Resolve to an exact version with =

Source: https://docs.determinate.systems/flakehub/concepts/semver

Use the '=' operator to specify an exact version. This command will fail if the specified version does not exist.

```nix
nix flake show "https://flakehub.com/f/DeterminateSystems/fh/=0.1.15"
```

--------------------------------

### Manually Hide nixbld Users on macOS

Source: https://docs.determinate.systems/troubleshooting/macos-visible-nixbld-users

Use this command in the terminal to manually mark `nixbld` users as hidden if the Determinate installer fails to do so. This is an advanced step and requires comfort with the terminal.

```bash
for username in $(dscl . -list /Users | grep '^_nixbld'); do
  dscl . -create "/Users/$username" IsHidden 1
done
```

--------------------------------

### Generate a device token for an organization

Source: https://docs.determinate.systems/determinate-nix

Create a new device token for a specified organization with a given description. The generated token is output to stdout.

```bash
determinate-nixd auth token device create \
  --org my-org \
  --description "Submarine #137"
```

--------------------------------

### Create a netrc file for existing cache authentication

Source: https://docs.determinate.systems/guides/migrate-to-flakehub-cache

Create a netrc file to store credentials for your existing Nix cache. This file should be placed in a stable location outside the Nix store.

```text
machine cache.example.com password password-for-cache-example-com
```

--------------------------------

### Attempt to Apply NixOS with Imprecise Version

Source: https://docs.determinate.systems/guides/resolve-only-deploy

This command demonstrates an attempt to apply a NixOS configuration using a similar but imprecise version requirement (0.1.123). This will likely fail to achieve precise roll-back semantics because it's not an exact match.

```bash
sudo fh apply nixos DeterminateSystems/demo/0.1.123#nixosConfigurations.ethercalc-demo
```

--------------------------------

### Publish flake releases to FlakeHub

Source: https://docs.determinate.systems/guides/determinate-ci

Extend your Determinate CI workflow to publish your flake releases to FlakeHub by specifying the desired visibility. This configuration builds upon the previous example, adding the `visibility` parameter.

```yaml
jobs:
  DeterminateCI:
    uses: DeterminateSystems/ci/.github/workflows/workflow.yml@main
    permissions:
      id-token: write
      contents: read
    with:
      visibility: public
```

--------------------------------

### List all releases for a flake

Source: https://docs.determinate.systems/flakehub/cli

This command lists all available releases for a specified flake. Provide the flake identifier as an argument.

```bash
fh list releases nixos/nixpkgs
```

--------------------------------

### Fetch Flake Output using fh

Source: https://docs.determinate.systems/flakehub/cli

Fetches a flake output for the current system from FlakeHub Cache and creates a symlink to the output in the Nix store. Use this to get specific flake outputs directly.

```bash
# Fetch an output for the current system from FlakeHub Cache
SYSTEM="$(nix eval --impure --expr 'builtins.currentSystem' --raw)"
fh fetch "DeterminateSystems/fh/*#packages.${SYSTEM}.default" ./out

# Run the fh executable using the target link
./out/bin/fh --help
```

--------------------------------

### Check Nix Version

Source: https://docs.determinate.systems/guides/migrating-from-upstream-nix

Run this command to determine if you are currently using Determinate Nix. Versions like 'nix 2.28.3' indicate upstream Nix, while 'nix (Determinate Nix 3.4.2) 2.28.3' indicates Determinate Nix.

```bash
nix --version
```

--------------------------------

### Extract GHES Organization Info with GitHub Actions

Source: https://docs.determinate.systems/guides/github-enterprise-server

Run this workflow in your GHES organization to obtain the JWT issuer and repository owner ID. Ensure `curl`, `jq`, `base64`, and `awk` are installed on your self-hosted runner.

```yaml
on:
  push:
  workflow_dispatch:
 
jobs:
  flakehub-info:
    runs-on: "self-hosted"
    permissions:
      id-token: "write"
    steps:
      - run: |
          curl -fsSL "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=give-me-a-token" -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" | \
            jq -r .value | awk -F. '{print $2}' | base64 -d 2>/dev/null | jq -r '.iss, .repository_owner_id'
```

--------------------------------

### Apply a NixOS Configuration from FlakeHub

Source: https://docs.determinate.systems/flakehub/cli

Apply a NixOS configuration stored in FlakeHub Cache to the current host. This command requires a paid FlakeHub plan.

```bash
sudo fh apply nixos "my-org/system-configs/0.1#nixosConfigurations.staging-box"
```

--------------------------------

### Apply nix-darwin Configuration

Source: https://docs.determinate.systems/flakehub/store-paths

Apply a nix-darwin configuration using `fh apply` with a resolved store path. This method is efficient for deployments using FlakeHub Cache, as it avoids local flake evaluation.

```bash
sudo fh apply nix-darwin "my-org/my-nix-darwin-config-flake/*"
```

--------------------------------

### Build ARM Linux Package on macOS

Source: https://docs.determinate.systems/determinate-nix

Leverage the native Linux builder on macOS to construct ARM Linux packages without additional setup. This feature utilizes macOS's built-in Virtualization framework.

```bash
nix build nixpkgs#legacyPackages.aarch64-linux.ponysay
```

--------------------------------

### Log in to FlakeHub using Determinate Nixd

Source: https://docs.determinate.systems/getting-started/individuals

Authenticate your workstation with FlakeHub using the Determinate Nix daemon. This command initiates a browser-based authentication flow.

```bash
determinate-nixd login
```

--------------------------------

### Resulting flake.nix after adding Nixpkgs input

Source: https://docs.determinate.systems/flakehub/cli

This shows the structure of a `flake.nix` file after using `fh add` to include the Nixpkgs input.

```nix
{
  description = "My new flake.";
 
  inputs.nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.2305.490449";
 
  outputs = { nixpkgs, ... } @ inputs:
    {
      # Fill in your outputs here
    };
}
```