1
0
Fork 0
nix-configuration/modules/nixos/services/binary-cache/default.nix

66 lines
1.7 KiB
Nix
Raw Normal View History

{
config,
lib,
pkgs,
...
}:
let
cfg = config.aux.system.services.binary-cache;
in
{
options = {
aux.system.services.binary-cache = {
enable = lib.mkEnableOption "Enable a binary cache hosting service.";
secretKeyFile = lib.mkOption {
default = "/var/lib/nix-binary-cache/privkey.pem";
type = lib.types.str;
description = "Where to find the binary cache's private key.";
};
url = lib.mkOption {
default = "";
type = lib.types.str;
description = "The complete URL where the cache is hosted.";
example = "https://cache.example.com";
};
auth = {
password = lib.mkOption {
default = "";
type = lib.types.str;
description = "The password to use for basic authentication for the cache.";
example = "MySuperSecurePassword123";
};
user = lib.mkOption {
default = "cache-user";
type = lib.types.str;
description = "The username to use for basic auth.";
};
};
};
};
config = lib.mkIf cfg.enable {
services = {
nix-serve = {
enable = true;
secretKeyFile = cfg.secretKeyFile;
bindAddress = "127.0.0.1";
};
nginx.virtualHosts."${cfg.url}" = {
2024-12-06 16:16:58 +00:00
useACMEHost = lib.Sapana.getDomainFromURI cfg.url;
forceSSL = true;
basicAuth = {
"${cfg.auth.user}" = cfg.auth.password;
};
locations."/" = {
proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
};
};
};
systemd.services.nginx.wants = [ config.systemd.services.nix-serve.name ];
};
}