···11+---
22+title: "How to fix terraform and nix flakes"
33+date: 2023-10-27
44+tags:
55+ - nix
66+ - terraform
77+ - enshittification
88+hero:
99+ ai: Furryrock
1010+ file: coffee-birb
1111+ prompt: A pink haired avali wearing a sweater and sweatpants drinking coffee indoors.
1212+---
1313+1414+Recently Terraform [changed licenses](https://www.theregister.com/2023/08/11/hashicorp_bsl_licence/) to the Business Source License. This is a non-free license in the eyes of Nix, so now whenever you update your project flakes, you get greeted by this lovely error:
1515+1616+```
1717+error: Package ‘terraform-1.6.2’ in /nix/store/z1nvpjx9vd4151vx2krxzmx2p1a36pf9-source/pkgs/applications/networking/cluster/terraform/default.nix:52 has an unfree license (‘bsl11’), refusing to evaluate.
1818+1919+a) To temporarily allow unfree packages, you can use an environment variable
2020+ for a single invocation of the nix tools.
2121+2222+ $ export NIXPKGS_ALLOW_UNFREE=1
2323+2424+ Note: For `nix shell`, `nix build`, `nix develop` or any other Nix 2.4+
2525+ (Flake) command, `--impure` must be passed in order to read this
2626+ environment variable.
2727+2828+b) For `nixos-rebuild` you can set
2929+ { nixpkgs.config.allowUnfree = true; }
3030+ in configuration.nix to override this.
3131+3232+Alternatively you can configure a predicate to allow specific packages:
3333+ {
3434+ nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
3535+ "terraform"
3636+ ];
3737+ }
3838+3939+c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
4040+ { allowUnfree = true; }
4141+to ~/.config/nixpkgs/config.nix.
4242+```
4343+4444+The extra fun part is that when you're using a flake with a per-project version of nixpkgs, none of those workarounds work. Here's what you have to do instead:
4545+4646+In your flake you'll usually have an import of nixpkgs like this:
4747+4848+```nix
4949+let
5050+ pkgs = import nixpkgs { inherit system; };
5151+in
5252+ crimes_etc
5353+```
5454+5555+Or like this:
5656+5757+```nix
5858+let
5959+ pkgs = nixpkgs.legacyPackages.${system};
6060+in
6161+ different_crimes_etc
6262+```
6363+6464+You'll want to change that to this:
6565+6666+```nix
6767+let
6868+ pkgs = import nixpkgs { inherit system; config.allowUnfree = true; };
6969+in
7070+ working_crimes_etc
7171+```
7272+7373+This allows you to bypass the license check for all packages in nixpkgs so that things Just Work™. If you want to only do this for terraform, you can make a separate instance of nixpkgs to pull out only terraform, but I think that overall it's probably easier to just eliminate the problem entirely.
7474+7575+I hope this helps you out!
7676+7777+<XeblogConv name="Cadey" mood="coffee">
7878+ Don't you love the intersection of computers and capitalism? It's the best.
7979+</XeblogConv>
8080+<XeblogConv name="Aoi" mood="coffee">
8181+ Tell me about it.
8282+</XeblogConv>