Persist files added to /etc past system updates for SteamOS 3.6+

[5310]

Description

As of SteamOS 3.6, only files under /etc specifically allowed are persisted during system updates.

The Determinate Systems installer has a Planner target for the Steam Deck, and performs the Nixpkgs setup as a multi-user installation. However, it does not currently create the allowlist needed for the install to survive system updates and breaks as a result.

This PR adds in this allowlist for the Determinate Systems installer as helpfully defined in this comment on NixOS/nix#7173.

Checklist

• Formatted with cargo fmt
• Built with nix build
• Ran flake checks with nix flake check
• Added or updated relevant tests (leave unchecked if not applicable)
• Added or updated relevant documentation (leave unchecked if not applicable)
• Linked to related issues (leave unchecked if not applicable)

Validating with install.determinate.systems

If a maintainer has added the upload to s3 label to this PR, it will become available for installation via install.determinate.systems:

curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix/pr/$PR_NUMBER | sh -s -- install

[cole-h]

Thanks for this PR! Got a couple comments for you, but otherwise LGTM!

[cole-h]

Also, do you know of a way to "mimic" one of these breaking-updates? Does SteamOS have a command that I can run that will do this (even if there is no update available)?

[5310]

Also, do you know of a way to "mimic" one of these breaking-updates?

I was told I could try to switch to the beta channel to simulate an update, but I really didn't want to do that on my Deck 😅.

Especially not after manually reinstalling Nixpkgs the last time.

[cole-h]

Thanks, that helped me reproduce the issue! I had to move your addition outside of the block it was in (since that branch is only taken on old SteamOS versions that didn't have the Nix offload path) but after that it survived an update to the beta channel (and prior to adding this file, did not).

EDIT: note to myself (or anybody who stumbles here in the future):

If you come across the error ERROR: Could not set subvolume flags: Read-only file system after running steamos-readonly disable inside of the steamos-chroot shell, you may need to remount / as rw (mount -o remount,rw /) inside that chroot before trying again. At least, that fixed it for me.

[bertogg]

Also, do you know of a way to "mimic" one of these breaking-updates?

I was told I could try to switch to the beta channel to simulate an update, but I really didn't want to do that on my Deck 😅.

For this kind of tests it's handy to have a SteamOS VM, you can install Nix there, switch between branches and OS versions and reproduce the problem (the steamos-atomupd-client command-line tool can be used for that purpose).

Here's how to create one:
https://blogs.igalia.com/berto/2022/07/05/running-the-steam-decks-os-in-a-virtual-machine-using-qemu/