1
0
Fork 0

Merge branch 'main' of ssh://code.8bitbuddhism.com/aires/nix-configuration

This commit is contained in:
Aires 2024-05-24 18:23:43 -04:00
commit 41fc33fcfc
5 changed files with 54 additions and 7 deletions

View file

@ -249,11 +249,11 @@
"nix-secrets": {
"flake": false,
"locked": {
"lastModified": 1716565755,
"narHash": "sha256-J5TSspiAn+bA2LXSwVGKvzdEentj0w4qFqSwpHRbDsA=",
"lastModified": 1716585945,
"narHash": "sha256-OxYcOt2ZshJ+VYXSrYb7Wc36cvWd7YjwSFzaDWNqkMU=",
"ref": "refs/heads/main",
"rev": "d926175d96d4eec4e564727a6b4fad6d79be4db5",
"revCount": 38,
"rev": "6c78f91590beb0f486a024b277d8e732f797d29c",
"revCount": 39,
"type": "git",
"url": "file:///home/aires/Development/nix-configuration/nix-secrets"
},

View file

@ -10,6 +10,7 @@ let
subdomains = [
config.secrets.services.airsonic.url
config.secrets.services.cache.url
config.secrets.services.forgejo.url
config.secrets.services.gremlin-lab.url
];
@ -51,6 +52,10 @@ in
home = "/storage/services/airsonic-advanced";
};
boinc.enable = true;
cache = {
enable = true;
secretKeyFile = "/storage/services/nix-cache/cache-priv-key.pem";
};
duplicacy-web = {
enable = true;
autostart = false;

View file

@ -16,8 +16,14 @@
];
# Use Lix instead of Nix
extra-substituters = [ "https://cache.lix.systems" ];
trusted-public-keys = [ "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=" ];
extra-substituters = [
"https://cache.lix.systems"
config.secrets.services.cache.url
];
trusted-public-keys = [
"cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
"${config.secrets.services.cache.url}:mTYvveYNhoXttGOxJj2uP0MQ/ZPJce5hY+xSvOxswls=%"
];
# Only allow these users to use Nix
allowed-users = [

View file

@ -0,0 +1,36 @@
# Serves a binary cache for Nix packages
{ config, lib, ... }:
let
cfg = config.host.services.cache;
in
{
options = {
host.services.cache = {
enable = lib.mkEnableOption (lib.mdDoc "Enables binary cache hosting.");
secretKeyFile = lib.mkOption {
default = "/var/cache-priv-key.pem";
type = lib.types.str;
description = "Where the signing key lives.";
};
};
};
config = lib.mkIf cfg.enable {
services = {
nix-serve = {
enable = true;
secretKeyFile = cfg.secretKeyFile;
};
nginx.virtualHosts."${config.secrets.services.cache.url}" = {
useACMEHost = config.secrets.networking.primaryDomain;
forceSSL = true;
locations."/" = {
proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
extraConfig = "proxy_ssl_server_name on;";
};
};
};
};
}

@ -1 +1 @@
Subproject commit d926175d96d4eec4e564727a6b4fad6d79be4db5
Subproject commit 6c78f91590beb0f486a024b277d8e732f797d29c