Skip to content

nixos-rebuild NixOS Rebuild

man nixos-rebuild

VM

nixos-rebuild build-vm --flake .#console-vm

Local

nixos-rebuild switch --flake .#myhostname

Or, historically: Edit /etc/nixos/configuration.nix and sudo nixos-rebuild switch.

Remote

See also nixos-anywhere.

Images

nixos-rebuild build-image --flake .#myhostname

Troubleshooting

It lacks a signature by a trusted key

copying path '/nix/store/0ffsqaf744z1mdv0w0ind94ipk4mm71r-nix.conf' to 'ssh://ixo'...
error: cannot add path '/nix/store/0ffsqaf744z1mdv0w0ind94ipk4mm71r-nix.conf' because it lacks a
signature by a trusted key

This happens when your user is not in nix.settings.trusted-users at first.

Read-only file system

/etc/nix/nix.conf: Read-only file system

This initial problem can be worked around by using --build-host $HOSTNEW --use-remote-sudo --ask-sudo-password.

sudo: a password is required

sudo: a terminal is required to read the password; either use ssh's -t option or configure an askpass helper
sudo: a password is required
error: while running command with remote sudo, did you forget to use --ask-sudo-password?

This can be worked around by adding --use-remote-sudo --ask-sudo-password (and then entering the password when prompted).

Live activation / user unit failure on switch (Activation (test) failed)

When nrs (nh os switch) fails during user/systemd unit activation (e.g. warning: the following user units failed: gnome-session@gnome.target), the build itself succeeded but live unit restarting failed.

To make the new configuration active on next boot without failing on live unit restarts, use boot instead of switch:

nh os boot .

Hash mismatch in fixed-output derivation

error: hash mismatch in fixed-output derivation '...':
           specified: sha256-lYsHQut0bb3laihMRIFi+gDiN2dAJCAa+sGDi4oTmjA=
                 got: sha256-okBp6jj+lEZNqrsEEoaMBA7ei4C9OTFNntiXAcb+4Z8=

Fixed-output derivations (such as pkgs.caddy.withPlugins, buildGoModule.vendorHash, or fetchFromGitHub) require Nix to know the content hash in advance to guarantee reproducibility and allow network access during the build.

This mismatch occurs when:

  • An upstream dependency, plugin version, or downloaded archive content changed.
  • Nixpkgs or Go toolchain updates change the generated go.sum or vendored source structure.

How to fix:

  1. Locate where the fixed-output derivation is defined (e.g. package = pkgs.caddy.withPlugins { ... hash = "..."; }; in modules/services/caddy.nix).
  2. Update the hash (or vendorHash) attribute to the got: hash reported by Nix.
  3. Re-run nix build or nh os switch (or verify with nix develop --command nix-fast-build --fail-fast --flake .#checks.x86_64-linux).

Alternatives