Preface

I do not know if this is a documentation issue, bug, or something different. Nevertheless it took me close to a day to get my nix working again - and I do not know if I solved the problem correctly.

Scenario

I'm running macOS Mojave 10.14.6 (18G1012) with a working single-user nix install and using darwin-nix. Before updating to macOS Catalina I wanted to switch to multi-user nix for all it's advantages.

Steps

I did not figure out how to convert from single to multi-user so the only viable solution I found was to remove my old installation and reinstall with bash <(curl https://nixos.org/nix/install) --daemon - after all my whole configuration is declaratively stored in my darwin-configuration.nix file.

I first tried the recommendations from that script if you run it with an existing install. After removing these nix related files, the installation went through and suggested I could run nix-shell -p nix-info --run "nix-info -m" in a new shell. But that failed with varying results between:

$ nix-shell -p nix-info --run "nix-info -m"
error (ignored): unable to download [...]: Problem with the SSL CA cert (path? access rights?) (77)
$ nix-shell -p nix-info --run "nix-info -m"
error: unexpected end-of-file

Now I tried several things and found many different potential reasons - not all documented. But to name a few:

• clean macOS user account
• trying to remove all traces of nix with a script expelledboy wrote
• as root lead to another error:

$ sudo nix-shell -p nix-info --run "nix-info -m"
Password:
error: file 'nixpkgs' was not found in the Nix search path (add it using $NIX_PATH or -I), at (string):1:13

• multiple variations of reboots and uninstall and reinstalls.
• Trying to set NIX_SSL_CERT_FILE despite the file did not exist.
• Finding someone with a virtually identical problem, who did not share his solution, because it was unrelated to the OPs question.

all without success.

Solution (working, but is it correct?)

The break through was, when I found expipiplus1's tutorial how to convert a nix single-user install into multi-user one:

There he linked NIX_SSL_CERT_FILE to /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt for the deamon on linux. This file did exist and so I tried:

$ sudo launchctl setenv NIX_SSL_CERT_FILE /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt
$ sudo launchctl kickstart -k system/org.nixos.nix-daemon
$ nix-shell -p nix-info --run "nix-info -m"
[...]
 - system: `"x86_64-darwin"`
 - host os: `Darwin 18.7.0, macOS `
 - multi-user?: `yes`
 - sandbox: `no`
 - version: `nix-env (Nix) 2.3.1`
 - channels(root): `"nixpkgs-20.03pre204216.cc6cf0a96a6"`
 - nixpkgs: `/nix/var/nix/profiles/per-user/root/channels/nixpkgs`

and it worked. But I have my doubts that this is the correct way, since I found this comment on discourse:

Another option to consider is to change the Nix single-user install script to set up the default profile to include the cacert package. The downside here is it would likely never get updated again unless the user intentionally mucks with the default profile.

Context

$  nix --version
nix (Nix) 2.3.1