Merge branch 'main' of ssh://code.8bitbuddhism.com/aires/nix-configuration
This commit is contained in:
commit
41fc33fcfc
|
@ -249,11 +249,11 @@
|
|||
"nix-secrets": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1716565755,
|
||||
"narHash": "sha256-J5TSspiAn+bA2LXSwVGKvzdEentj0w4qFqSwpHRbDsA=",
|
||||
"lastModified": 1716585945,
|
||||
"narHash": "sha256-OxYcOt2ZshJ+VYXSrYb7Wc36cvWd7YjwSFzaDWNqkMU=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "d926175d96d4eec4e564727a6b4fad6d79be4db5",
|
||||
"revCount": 38,
|
||||
"rev": "6c78f91590beb0f486a024b277d8e732f797d29c",
|
||||
"revCount": 39,
|
||||
"type": "git",
|
||||
"url": "file:///home/aires/Development/nix-configuration/nix-secrets"
|
||||
},
|
||||
|
|
|
@ -10,6 +10,7 @@ let
|
|||
|
||||
subdomains = [
|
||||
config.secrets.services.airsonic.url
|
||||
config.secrets.services.cache.url
|
||||
config.secrets.services.forgejo.url
|
||||
config.secrets.services.gremlin-lab.url
|
||||
];
|
||||
|
@ -51,6 +52,10 @@ in
|
|||
home = "/storage/services/airsonic-advanced";
|
||||
};
|
||||
boinc.enable = true;
|
||||
cache = {
|
||||
enable = true;
|
||||
secretKeyFile = "/storage/services/nix-cache/cache-priv-key.pem";
|
||||
};
|
||||
duplicacy-web = {
|
||||
enable = true;
|
||||
autostart = false;
|
||||
|
|
|
@ -16,8 +16,14 @@
|
|||
];
|
||||
|
||||
# Use Lix instead of Nix
|
||||
extra-substituters = [ "https://cache.lix.systems" ];
|
||||
trusted-public-keys = [ "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=" ];
|
||||
extra-substituters = [
|
||||
"https://cache.lix.systems"
|
||||
config.secrets.services.cache.url
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
|
||||
"${config.secrets.services.cache.url}:mTYvveYNhoXttGOxJj2uP0MQ/ZPJce5hY+xSvOxswls=%"
|
||||
];
|
||||
|
||||
# Only allow these users to use Nix
|
||||
allowed-users = [
|
||||
|
|
36
modules/services/cache.nix
Normal file
36
modules/services/cache.nix
Normal file
|
@ -0,0 +1,36 @@
|
|||
# Serves a binary cache for Nix packages
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.host.services.cache;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
host.services.cache = {
|
||||
enable = lib.mkEnableOption (lib.mdDoc "Enables binary cache hosting.");
|
||||
secretKeyFile = lib.mkOption {
|
||||
default = "/var/cache-priv-key.pem";
|
||||
type = lib.types.str;
|
||||
description = "Where the signing key lives.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services = {
|
||||
nix-serve = {
|
||||
enable = true;
|
||||
secretKeyFile = cfg.secretKeyFile;
|
||||
};
|
||||
|
||||
nginx.virtualHosts."${config.secrets.services.cache.url}" = {
|
||||
useACMEHost = config.secrets.networking.primaryDomain;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
|
||||
extraConfig = "proxy_ssl_server_name on;";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
|
@ -1 +1 @@
|
|||
Subproject commit d926175d96d4eec4e564727a6b4fad6d79be4db5
|
||||
Subproject commit 6c78f91590beb0f486a024b277d8e732f797d29c
|
Loading…
Reference in a new issue