Add support for hermetic nixos configurations

This change adds a Terraform variable `hermetic` and supporting logic
to the Nix expression evaluated by `nix-instantiate` to better support
users that need to evaluate configurations that supply their own
pinned nixpkgs or wrap eval-modules to customize module special args.

Author: ixmatus

deploy_nixos/main.tf

@@ -93,6 +93,12 @@ variable "target_system" {
   default     = "x86_64-linux"
 }
 
+variable "hermetic" {
+  type        = bool
+  description = "Treat the provided nixos configuration as a hermetic expression and do not evaluate using the ambient system nixpkgs. Useful if you customize eval-modules or use a pinned nixpkgs."
+  default     = false
+}
+
 # --------------------------------------------------------------------------
 
 locals {
@@ -122,7 +128,8 @@ data "external" "nixos-instantiate" {
     var.config_pwd == "" ? "." : var.config_pwd,
     # end of positional arguments
     # start of pass-through arguments
-    "--argstr", "system", var.target_system
+    "--argstr", "system", var.target_system,
+    "--arg", "hermetic", var.hermetic
     ],
     var.extra_eval_args,
   )

deploy_nixos/nixos-instantiate.sh

@@ -8,17 +8,31 @@ config_pwd=$3
 shift 3
 
 # Building the command
+nixExpression=<<EOF
+
+EOF
+
 command=(nix-instantiate --show-trace --expr '
-  { system, configuration, ... }:
+  { system, configuration, hermetic ? false, ... }:
   let
-    os = import <nixpkgs/nixos> { inherit system configuration; };
-    inherit (import <nixpkgs/lib>) concatStringsSep;
+    os =
+      if hermetic
+        then import configuration
+        else import <nixpkgs/nixos> { inherit system configuration; };
+
+    inherit (os.pkgs) lib;
+
   in {
-    substituters = concatStringsSep " " os.config.nix.binaryCaches;
-    trusted-public-keys = concatStringsSep " " os.config.nix.binaryCachePublicKeys;
+    inherit (builtins) currentSystem;
+
+    substituters =
+      lib.concatStringsSep " " os.config.nix.binaryCaches;
+
+    trusted-public-keys =
+      lib.concatStringsSep " " os.config.nix.binaryCachePublicKeys;
+
     drv_path = os.system.drvPath;
     out_path = os.system;
-    inherit (builtins) currentSystem;
   }')
 
 if [[ -f "$config" ]]; then