From 160eb3d99de1dd8e4d0542ab02a6831aa31c7204 Mon Sep 17 00:00:00 2001
From: Lily Ballard <lilyball@apple.com>
Date: Mon, 9 Oct 2023 16:08:01 -0700
Subject: [PATCH] linux-builder: avoid /tmp for certs

Fixes #768
---
 modules/nix/linux-builder.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/modules/nix/linux-builder.nix b/modules/nix/linux-builder.nix
index 0d473d3..402b3b5 100644
--- a/modules/nix/linux-builder.nix
+++ b/modules/nix/linux-builder.nix
@@ -10,6 +10,18 @@ let
   builderWithOverrides = cfg.package.override {
     inherit (cfg) modules;
   };
+
+  # create-builder uses TMPDIR to share files with the builder, notably certs.
+  # macOS will clean up files in /tmp automatically that haven't been accessed in 3+ days.
+  # If we let it use /tmp, leaving the computer asleep for 3 days makes the certs vanish.
+  # So we'll use /run/org.nixos.linux-builder instead and clean it up ourselves.
+  script = pkgs.writeShellScript "linux-builder-start" ''
+    export TMPDIR=/run/org.nixos.linux-builder USE_TMPDIR=1
+    rm -rf $TMPDIR
+    mkdir -p $TMPDIR
+    trap "rm -rf $TMPDIR" EXIT
+    ${builderWithOverrides}/bin/create-builder
+  '';
 in
 
 {
@@ -75,7 +87,7 @@ in
       serviceConfig = {
         ProgramArguments = [
           "/bin/sh" "-c"
-          "/bin/wait4path /nix/store &amp;&amp; exec ${builderWithOverrides}/bin/create-builder"
+          "/bin/wait4path /nix/store &amp;&amp; exec ${script}"
         ];
         KeepAlive = true;
         RunAtLoad = true;