nixos-install: fix missing initrd.secrets paths

When installing NixOS in the target filesystem /mnt, paths relative to
configuration.nix in `initrd.secrets` are turned by Nix into absolute
paths that reference /mnt. While building the system derivation works,
installing the bootloader fails because the latter process takes place
inside the chroot environment where /mnt does not exist.

Ideally, we would also build the system within chroot, but this greatly
complicates the matter as it requires  manually copying over Nix, its
runtime dependencies and all channels. Possibly, this would also break
several assumptions users have about how nixos-install works.

A simpler and safer (but less neat) solution is to temporarily bind
mount all mount points in /mnt under /mnt/mnt to keep the paths
functional while the bootloader is being installed.
This is essentially the workaround described in issue #73404.

1 files changed, 9 insertions, 0 deletions

diff --git a/nixos/modules/installer/tools/nixos-install.sh b/nixos/modules/installer/tools/nixos-install.sh
index e7cf52f5e32b..7247451a85d9 100644
--- a/nixos/modules/installer/tools/nixos-install.sh
+++ b/nixos/modules/installer/tools/nixos-install.sh
@@ -188,6 +188,15 @@ nix-env --store "$mountPoint" "${extraBuildFlags[@]}" \
 mkdir -m 0755 -p "$mountPoint/etc"
 touch "$mountPoint/etc/NIXOS"
 
+# Create a bind mount for each of the mount points inside the target file
+# system. This preserves the validity of their absolute paths after changing
+# the root with `nixos-enter`.
+# Without this the bootloader installation may fail due to options that
+# contain paths referenced during evaluation, like initrd.secrets.
+mount --rbind --mkdir "$mountPoint" "$mountPoint$mountPoint"
+mount --make-rslave "$mountPoint$mountPoint"
+trap 'umount -R "$mountPoint$mountPoint" && rmdir "$mountPoint$mountPoint"' EXIT
+
 # Switch to the new system configuration.  This will install Grub with
 # a menu default pointing at the kernel/initrd/etc of the new
 # configuration.