Optionally make the Nix store read-only to enforce immutability

This will be the default once Nix 1.2 is released.

1 files changed, 11 insertions, 0 deletions

diff --git a/modules/services/misc/nix-daemon.nix b/modules/services/misc/nix-daemon.nix
index cf2d0f52d86..7e52686f32f 100644
--- a/modules/services/misc/nix-daemon.nix
+++ b/modules/services/misc/nix-daemon.nix
@@ -183,6 +183,17 @@ in
           you should increase this value.
         '';
       };
+
+      readOnlyStore = mkOption {
+        default = false;
+        description = ''
+          If set, NixOS will enforce the immutability of the Nix store
+          by making <filename>/nix/store</filename> a read-only bind
+          mount.  Nix will automatically make the store writable when
+          needed.
+        '';
+      };
+
     };
   };