fix: add --extra-experimental-features nix-command flakes to nix profile add

Instead of downloading at first login, everything is ready at boot:

- iso/build-live-iso.sh:
  * apply-live-settings.sh XDG autostart applies theme/wallpaper/terminal
    via gsettings at first Cinnamon login (reliable vs dconf binary format)
  * /etc/environment: XDG_DATA_DIRS includes nix profile so Cinnamon menu
    shows pre-baked nix apps immediately
  * /etc/profile.d/nix-prebaked.sh: PATH setup for terminal sessions
  * first-login.sh kept at /usr/local/libexec but NOT autostarted (manual
    use for Claude/NVM installs)
  * NIX_PACKAGES_PREBAKE passed to Docker build

- iso/_inner-build-live.sh:
  * Pre-bake nix packages inside Docker before mklive.sh; copy /nix store
    into squashfs overlay; set /etc/skel/.nix-profile → store profile path
  * Cached at /cache/nix-prebake (keyed by package list md5)

- iso/Dockerfile: add rsync (needed by nix prebake)

- packages.live-desktop.list: add vscode + chromium (XBPS, no download)

Makefile

@@ -15,7 +15,7 @@ PROJECT_DIR := $(CURDIR)
 OUT         := $(PROJECT_DIR)/out
 SECRETS     := $(PROJECT_DIR)/secrets.env
 
-.PHONY: all iso live test test-disk test-iso qemu shellcheck clean distclean check-secrets check-docker
+.PHONY: all iso live live-qemu test test-disk test-iso qemu shellcheck clean distclean check-secrets check-docker
 
 all: iso
 
@@ -32,6 +32,11 @@ iso: check-secrets check-docker
 live: check-secrets check-docker
 	$(PROJECT_DIR)/iso/build-live-iso.sh
 
+# Launch the live ISO in QEMU with 12 GB RAM so nix packages fit in the tmpfs.
+# The live session is a pure-RAM tmpfs overlay; Cinnamon + nix need ~7-8 GB total.
+live-qemu:
+	$(PROJECT_DIR)/tests/launch-live-qemu.sh
+
 test-iso: check-secrets check-docker
 	REBUILD_ISO=1 $(PROJECT_DIR)/tests/run-qemu-test.sh
 

config/profiles/stable-cinnamon/packages.live-desktop.list

@@ -114,6 +114,9 @@ gtk-engine-murrine
 dconf
 dconf-editor
 
+# --- code editors / dev tools ---
+vscode
+
 # --- media / utilities ---
 vlc
 flameshot

installer/first-login.sh

@@ -35,8 +35,17 @@ fi
 # --- Nix user packages (google-chrome, spotify, discord, etc.) ---
 # Present when running from the live ISO (written by build-live-iso.sh).
 # In the installed system the packages come from first-boot-nix.sh instead.
+# NOTE: nix packages are intentionally skipped in the live session — they
+# can total 3-4 GB which exceeds the tmpfs overlay on typical hardware.
+# They will be installed on the first login after the system is installed.
 NIX_PACKAGES_FILE="${NIX_PACKAGES_FILE:-/usr/local/libexec/nix-packages.list}"
 if [[ -r "$NIX_PACKAGES_FILE" ]] && command -v nix >/dev/null 2>&1; then
+    remaining=$(df -k /nix 2>/dev/null | awk 'NR==2{print $4}')
+    # Require at least 4GB free in /nix before attempting package install
+    if [[ -n "$remaining" && "$remaining" -lt 4194304 ]]; then
+        echo "==> skipping nix packages in live session (only ${remaining}KB free in /nix)"
+        echo "    packages will be installed on first login after installation"
+    else
         echo "==> installing nix user packages from $NIX_PACKAGES_FILE"
 
         # Source nix profile.d scripts so PATH and env are set.
@@ -71,6 +80,7 @@ if [[ -r "$NIX_PACKAGES_FILE" ]] && command -v nix >/dev/null 2>&1; then
             nix profile add --impure "${pkgs[@]}" 2>&1 || {
                 echo "!! nix profile add failed (partial install may have succeeded)"; }
         fi
+    fi
 fi
 
 # --- NVM (best effort; nvm.sh has unbound vars so isolate it) ---

iso/Dockerfile

@@ -10,7 +10,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
         bash git curl ca-certificates xz-utils tar patch python3 \
         mtools xorriso squashfs-tools dosfstools e2fsprogs \
-        kmod dconf-cli \
+        kmod dconf-cli rsync \
     && rm -rf /var/lib/apt/lists/*
 
 # xbps-static is downloaded into /cache by the host script and added to PATH

iso/_inner-build-live.sh

@@ -38,6 +38,75 @@ fi
 
 cd "$MKLIVE_DIR"
 
+# ── Pre-bake nix packages ────────────────────────────────────────────────
+# Install the nix user packages inside the Docker container and bake the
+# resulting /nix store directly into the squashfs overlay.  The live session
+# then boots with all apps already present — no network downloads needed.
+#
+# The store is cached at /cache/nix-prebake; only rebuilt when the package
+# list changes (checked via an md5 key file).
+if [[ -n "${NIX_PACKAGES_PREBAKE:-}" ]]; then
+    echo ">>> pre-baking nix packages"
+    read -r -a _NIX_PKGS <<< "$NIX_PACKAGES_PREBAKE"
+
+    _NIX_CACHE="$CACHE_DIR/nix-prebake"
+    _CACHE_KEY="$_NIX_CACHE/.done.$(printf '%s\n' "${_NIX_PKGS[@]}" | sort | md5sum | cut -c1-8)"
+
+    mkdir -p "$_NIX_CACHE"
+
+    if [[ -f "$_CACHE_KEY" ]] && [[ -d "$_NIX_CACHE/store" ]] && [[ -f "$_NIX_CACHE/.profile-path" ]]; then
+        echo "    restoring cached nix store ($(du -sh "$_NIX_CACHE/store" 2>/dev/null | cut -f1))"
+        mkdir -p /nix
+        rsync -a "$_NIX_CACHE/" /nix/ 2>&1 | tail -1
+    else
+        echo "    installing nix (single-user, no-daemon)..."
+        rm -rf /nix ~/.nix-profile ~/.nix-defexpr ~/.nix-channels
+        # Pre-create /nix as root so the installer doesn't try 'sudo mkdir'
+        # (sudo isn't installed in this Docker container).
+        mkdir -m 0755 -p /nix
+        # Disable build-users-group so nix doesn't complain about missing nixbld group.
+        export NIX_CONFIG="build-users-group = "
+        curl -fsSL https://nixos.org/nix/install | \
+            NIX_INSTALLER_TRUST_INSTALLER=1 sh -s -- --no-daemon --no-channel-add
+        # shellcheck disable=SC1091
+        . /root/.nix-profile/etc/profile.d/nix.sh 2>/dev/null || true
+        # Explicitly add nix to PATH in case the profile script didn't export it
+        export PATH="/root/.nix-profile/bin:/nix/var/nix/profiles/default/bin:$PATH"
+
+        export NIXPKGS_ALLOW_UNFREE=1
+        echo "    nix profile install: ${_NIX_PKGS[*]}"
+        nix profile add --extra-experimental-features "nix-command flakes" \
+            --impure "${_NIX_PKGS[@]}" 2>&1
+
+        # Save the profile store path so we can restore from cache next time
+        readlink -f /root/.nix-profile > "$_NIX_CACHE/.profile-path"
+
+        # Cache the full /nix store
+        rsync -a /nix/ "$_NIX_CACHE/" 2>&1 | tail -1
+        touch "$_CACHE_KEY"
+        echo "    cached nix store: $(du -sh "$_NIX_CACHE/store" 2>/dev/null | cut -f1)"
+    fi
+
+    # Stage the nix store into the squashfs overlay
+    echo "    staging /nix into overlay ($(du -sh /nix/store 2>/dev/null | cut -f1))"
+    mkdir -p "$INCLUDE_DIR/nix"
+    rsync -a /nix/ "$INCLUDE_DIR/nix/" 2>&1 | tail -1
+
+    # /etc/skel/.nix-profile → the pre-baked store profile path.
+    # dracut's adduser.sh runs 'useradd -m' which copies skel → /home/live,
+    # so the live user gets a ready nix profile from the squashfs store.
+    _STORE_PROFILE=$(cat "$_NIX_CACHE/.profile-path" 2>/dev/null \
+        || readlink -f /root/.nix-profile 2>/dev/null || echo "")
+    if [[ -n "$_STORE_PROFILE" && -d "$_STORE_PROFILE" ]]; then
+        mkdir -p "$INCLUDE_DIR/etc/skel"
+        ln -sf "$_STORE_PROFILE" "$INCLUDE_DIR/etc/skel/.nix-profile"
+        echo "    skel/.nix-profile → $_STORE_PROFILE"
+    else
+        echo "    WARNING: could not determine nix store profile path"
+    fi
+fi
+# ── end nix prebake ──────────────────────────────────────────────────────
+
 _cleanup_mklive_builds() {
     local d sub
     for d in "$MKLIVE_DIR"/mklive-build.*/; do

iso/build-live-iso.sh

@@ -485,58 +485,164 @@ Extensions=any;
 Dependencies=/usr/local/bin/code-open;
 EOF
 
-# ── 3f) first-login autostart + profile.d for the live user ─────────────
+# ── 3f) Live session baked-in configuration ──────────────────────────────
+# No first-login script. Everything is baked in at build time.
+# The apply-settings script runs once at first Cinnamon login to apply
+# gsettings (100% reliable vs dconf system-db binary format variations).
+install -d -m 0755 "$INCLUDE_DIR/usr/local/libexec"
 install -d -m 0755 "$INCLUDE_DIR/etc/xdg/autostart"
+
+# Keep first-login.sh available for MANUAL use (Claude, NVM installs) but
+# do NOT autostart it. User can run it from a terminal if needed.
 if [[ -r "$OVERLAY/first-login.sh" ]]; then
-    install -d -m 0755 "$INCLUDE_DIR/usr/local/libexec"
     install -m 0755 "$OVERLAY/first-login.sh" "$INCLUDE_DIR/usr/local/libexec/first-login.sh"
-    cat > "$INCLUDE_DIR/etc/xdg/autostart/void-live-first-login.desktop" <<EOF
+fi
+
+# apply-settings.sh: runs once at first Cinnamon login, applies theme/wallpaper/
+# terminal via gsettings (writes to user dconf db — always works).
+cat > "$INCLUDE_DIR/usr/local/libexec/apply-live-settings.sh" <<EOF
+#!/bin/bash
+# Baked live-session settings. Runs once at first Cinnamon login.
+DONE="\$HOME/.void-live-settings-done"
+[[ -f "\$DONE" ]] && exit 0
+
+# Wait for D-Bus session bus (LightDM autologin starts it, be safe)
+for _i in \$(seq 15); do
+    [[ -n "\${DBUS_SESSION_BUS_ADDRESS:-}" ]] && break
+    eval "\$(dbus-launch --sh-syntax 2>/dev/null)" || true
+    sleep 0.3
+done
+
+# GTK / Cinnamon DE theme
+gsettings set org.cinnamon.desktop.interface gtk-theme    '${GTK_THEME}'
+gsettings set org.cinnamon.desktop.interface icon-theme   '${ICON_THEME}'
+gsettings set org.gnome.desktop.interface    cursor-theme '${CURSOR_THEME}'
+gsettings set org.cinnamon.theme name                     '${GTK_THEME}'
+
+# Wallpaper (first .jpg found in the backgrounds dir)
+_WP=\$(ls /usr/share/backgrounds/void-installer/*.jpg 2>/dev/null | head -1 || echo '')
+[[ -n "\$_WP" ]] && gsettings set org.cinnamon.desktop.background picture-uri "file://\$_WP"
+[[ -n "\$_WP" ]] && gsettings set org.gnome.desktop.background    picture-uri "file://\$_WP"
+
+# Default terminal
+gsettings set org.cinnamon.desktop.default-applications.terminal exec     '${DEFAULT_TERMINAL:-alacritty}'
+gsettings set org.cinnamon.desktop.default-applications.terminal exec-arg '-e'
+gsettings set org.gnome.desktop.default-applications.terminal    exec     '${DEFAULT_TERMINAL:-alacritty}'
+gsettings set org.gnome.desktop.default-applications.terminal    exec-arg '-e'
+
+# Keyboard layout (Swiss French)
+gsettings set org.gnome.desktop.input-sources sources "[('xkb', '${KEYMAP:-ch+fr_nodeadkeys}')]"
+
+touch "\$DONE"
+EOF
+chmod 0755 "$INCLUDE_DIR/usr/local/libexec/apply-live-settings.sh"
+
+cat > "$INCLUDE_DIR/etc/xdg/autostart/void-live-settings.desktop" <<'DESK'
 [Desktop Entry]
 Type=Application
-Name=Void Live First-Login Setup
+Name=Void Live Apply Settings
-Exec=/usr/local/libexec/first-login.sh
+Exec=/usr/local/libexec/apply-live-settings.sh
 NoDisplay=true
 X-GNOME-Autostart-enabled=true
 OnlyShowIn=X-Cinnamon;
-EOF
+DESK
+
+# /etc/environment: XDG_DATA_DIRS includes the pre-baked nix profile so that
+# Cinnamon's app menu picks up .desktop files from the nix store without
+# requiring any PATH tricks in the graphical session.
+cat > "$INCLUDE_DIR/etc/environment" <<'ENVEOF'
+XDG_DATA_DIRS=/home/live/.nix-profile/share:/usr/local/share:/usr/share
+ENVEOF
+
+# /etc/profile.d: PATH for interactive terminals (alacritty, etc.)
+install -d -m 0755 "$INCLUDE_DIR/etc/profile.d"
+cat > "$INCLUDE_DIR/etc/profile.d/nix-prebaked.sh" <<'NIXEOF'
+# Pre-baked nix profile — set up PATH for interactive shells.
+if [[ -d "${HOME:-}/.nix-profile/bin" ]]; then
+    case ":$PATH:" in
+        *":$HOME/.nix-profile/bin:"*) ;;
+        *) export PATH="$HOME/.nix-profile/bin:$PATH" ;;
+    esac
 fi
+NIXEOF
+
+
+
+# ── 3f-ins) Void Linux installer in live image ───────────────────────────
+# install.sh uses INSTALLER_DIR=$(dirname $0)/lib for its libraries, so we
+# keep the script and lib/ together under /usr/local/lib/void-installer/.
+# SHARE_DIR (/usr/local/share/installer) holds config, packages, profiles.
+install -d -m 0755 "$INCLUDE_DIR/usr/local/lib/void-installer/lib"
+install -d -m 0755 "$INCLUDE_DIR/usr/local/share/installer"
+install -m 0755 "$PROJECT_DIR/installer/install.sh" "$INCLUDE_DIR/usr/local/lib/void-installer/install.sh"
+for f in "$PROJECT_DIR/installer/lib/"*.sh; do
+    install -m 0755 "$f" "$INCLUDE_DIR/usr/local/lib/void-installer/lib/$(basename "$f")"
+done
+# Config and packages — read by install.sh via SHARE_DIR
+install -m 0644 "$PROJECT_DIR/config/install.conf" "$INCLUDE_DIR/usr/local/share/installer/install.conf"
+install -m 0644 "$PROJECT_DIR/config/profiles/stable-cinnamon/packages.list" "$INCLUDE_DIR/usr/local/share/installer/packages.list"
+# Profiles directory (profile.conf + per-profile packages.list)
+if [[ -d "$PROJECT_DIR/config/profiles" ]]; then
+    cp -r "$PROJECT_DIR/config/profiles" "$INCLUDE_DIR/usr/local/share/installer/profiles"
+fi
+# Thin wrapper so the user can type `void-install` from anywhere
+install -d -m 0755 "$INCLUDE_DIR/usr/local/bin"
+cat > "$INCLUDE_DIR/usr/local/bin/void-install" <<'WRAPEOF'
+#!/bin/sh
+exec /usr/local/lib/void-installer/install.sh "$@"
+WRAPEOF
+chmod 0755 "$INCLUDE_DIR/usr/local/bin/void-install"
+# Secrets: read from secrets.env at build time, baked as /etc/installer-secrets.env
+# (the file is .gitignored; if absent the installer prompts interactively)
+_SECRETS_SRC="${SECRETS_ENV:-$PROJECT_DIR/secrets.env}"
+if [[ -r "$_SECRETS_SRC" ]]; then
+    install -d -m 0755 "$INCLUDE_DIR/etc"
+    install -m 0600 "$_SECRETS_SRC" "$INCLUDE_DIR/etc/installer-secrets.env"
+    echo "    baked installer secrets from $_SECRETS_SRC"
+else
+    echo "    WARNING: no secrets.env found — installer will prompt for passwords at runtime"
+fi
+# Desktop launcher — opens alacritty running void-install as root (live user
+# has passwordless sudo configured by mklive).
+install -d -m 0755 "$INCLUDE_DIR/usr/share/applications"
+cat > "$INCLUDE_DIR/usr/share/applications/void-installer.desktop" <<'DESKEOF'
+[Desktop Entry]
+Version=1.0
+Type=Application
+Name=Install Void Linux
+Comment=Install Void Linux to this machine
+Exec=alacritty --title "Void Linux Installer" -e sudo /usr/local/bin/void-install
+Icon=system-software-install
+Terminal=false
+Categories=System;
+StartupNotify=true
+DESKEOF
 
 install -d -m 0755 "$INCLUDE_DIR/etc/profile.d"
-cat > "$INCLUDE_DIR/etc/profile.d/local-bin.sh" <<'EOF'
+cat >> "$INCLUDE_DIR/etc/profile.d/nix-prebaked.sh" <<'EOF'
 case ":$PATH:" in
     *":$HOME/.local/bin:"*) ;;
     *) export PATH="$HOME/.local/bin:$PATH" ;;
 esac
 EOF
 
-# ── 3f-bis) Nix user packages list for first-login.sh ───────────────────
+# nix-packages.list: kept so first-login.sh can still be run manually
-# Write NIX_USER_PACKAGES (from install.conf) as a plain list so
-# first-login.sh can read it without sourcing install.conf.
 install -d -m 0755 "$INCLUDE_DIR/usr/local/libexec"
 {
-    for pkg in "${NIX_USER_PACKAGES[@]}"; do
+    for pkg in "${NIX_USER_PACKAGES[@]}"; do echo "$pkg"; done
-        echo "$pkg"
-    done
 } > "$INCLUDE_DIR/usr/local/libexec/nix-packages.list"
-# Also set the env var so first-login.sh knows where to find it.
 cat > "$INCLUDE_DIR/etc/profile.d/nix-packages-path.sh" <<'EOF'
 export NIX_PACKAGES_FILE=/usr/local/libexec/nix-packages.list
 EOF
 
-# ── 3g) Live-session skel: pre-wire .bash_profile for first-login ────────
+# ── 3g) Skel: .bash_profile sources .bashrc only (no first-login autorun) ──
 install -d -m 0755 "$INCLUDE_DIR/etc/skel"
 cat > "$INCLUDE_DIR/etc/skel/.bash_profile" <<'EOF'
 # Source .bashrc for interactive login shells.
 [[ -f ~/.bashrc ]] && . ~/.bashrc
-
-# Auto-run user environment setup on first interactive login.
-if [[ -z "$_FIRST_LOGIN_RAN" && -x /usr/local/libexec/first-login.sh \
-      && ! -f "$HOME/.first-login-done" ]]; then
-    export _FIRST_LOGIN_RAN=1
-    /usr/local/libexec/first-login.sh 2>&1 | tee -a "$HOME/.first-login.log"
-fi
 EOF
 
+
 # 4) build Docker image
 echo ">>> building docker image $DOCKER_IMAGE"
 if "$DOCKER" buildx version >/dev/null 2>&1; then
@@ -568,6 +674,7 @@ echo ">>> running mklive.sh inside docker — output: $OUT_ISO"
     -e OUT_ISO_REL="${OUT_ISO#$PROJECT_DIR/}" \
     -e BOOT_CMDLINE="${BOOT_CMDLINE:-}" \
     -e INCLUDE_DIR_REL="${INCLUDE_DIR#$PROJECT_DIR/}" \
+    -e NIX_PACKAGES_PREBAKE="${NIX_USER_PACKAGES[*]}" \
     -e HOST_UID="$(id -u)" \
     -e HOST_GID="$(id -g)" \
     "$DOCKER_IMAGE" \

tests/launch-live-qemu.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+# Launch the live desktop ISO under QEMU for interactive testing.
+# Uses 12 GB RAM so nix packages (~4 GB) can install into the tmpfs overlay.
+#
+# Usage:
+#   bash tests/launch-live-qemu.sh                  # uses out/void-live-stable.iso
+#   ISO=out/my.iso bash tests/launch-live-qemu.sh
+#   RAM_MB=16384 bash tests/launch-live-qemu.sh     # override RAM
+
+set -Eeuo pipefail
+
+PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+OUT_DIR="$PROJECT_DIR/out"
+
+ISO="${ISO:-$(ls -t "$OUT_DIR"/void-live-stable*.iso 2>/dev/null | head -1 || true)}"
+[[ -r "$ISO" ]] || { echo "no ISO found — run 'make live' first"; exit 1; }
+
+RAM_MB="${RAM_MB:-12288}"   # 12 GB: Cinnamon ~2.5GB + nix store ~4GB + headroom
+SMP="${SMP:-4}"
+
+OVMF_CODE="${OVMF_CODE:-}"
+OVMF_VARS_TPL="${OVMF_VARS_TPL:-}"
+for c in /usr/share/OVMF/OVMF_CODE.fd /usr/share/edk2-ovmf/x64/OVMF_CODE.fd \
+         /usr/share/edk2/x64/OVMF_CODE.fd /usr/share/qemu/OVMF_CODE.fd; do
+    [[ -z "$OVMF_CODE" && -r "$c" ]] && OVMF_CODE="$c"
+done
+for v in /usr/share/OVMF/OVMF_VARS.fd /usr/share/edk2-ovmf/x64/OVMF_VARS.fd \
+         /usr/share/edk2/x64/OVMF_VARS.fd /usr/share/qemu/OVMF_VARS.fd; do
+    [[ -z "$OVMF_VARS_TPL" && -r "$v" ]] && OVMF_VARS_TPL="$v"
+done
+[[ -r "$OVMF_CODE"     ]] || { echo "OVMF_CODE not found — install ovmf"; exit 1; }
+[[ -r "$OVMF_VARS_TPL" ]] || { echo "OVMF_VARS not found — install ovmf"; exit 1; }
+
+VARS="$OUT_DIR/OVMF_VARS.live.fd"
+[[ -f "$VARS" ]] || cp "$OVMF_VARS_TPL" "$VARS"
+
+mkdir -p "$OUT_DIR"
+
+echo ">>> launching live ISO: $ISO"
+echo "    RAM: ${RAM_MB} MB  CPUs: $SMP"
+echo "    serial: $OUT_DIR/live-serial.sock"
+echo "    monitor: $OUT_DIR/qemu-monitor.sock"
+
+exec qemu-system-x86_64 \
+    -name void-live-test \
+    -machine q35,accel=kvm:tcg \
+    -cpu max \
+    -m "$RAM_MB" \
+    -smp "$SMP" \
+    -drive "if=pflash,format=raw,readonly=on,file=$OVMF_CODE" \
+    -drive "if=pflash,format=raw,file=$VARS" \
+    -cdrom "$ISO" \
+    -boot order=d,menu=off \
+    -netdev user,id=n0 \
+    -device virtio-net-pci,netdev=n0 \
+    -serial "unix:$OUT_DIR/live-serial.sock,server,nowait" \
+    -monitor "unix:$OUT_DIR/qemu-monitor.sock,server,nowait" \
+    -device virtio-vga \
+    -display gtk,gl=off