Merge branch 'main' of ssh://code.8bitbuddhism.com/aires/nix-configuration

flake.lock

@@ -249,11 +249,11 @@
     "nix-secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1716565755,
+        "lastModified": 1716585945,
-        "narHash": "sha256-J5TSspiAn+bA2LXSwVGKvzdEentj0w4qFqSwpHRbDsA=",
+        "narHash": "sha256-OxYcOt2ZshJ+VYXSrYb7Wc36cvWd7YjwSFzaDWNqkMU=",
         "ref": "refs/heads/main",
-        "rev": "d926175d96d4eec4e564727a6b4fad6d79be4db5",
+        "rev": "6c78f91590beb0f486a024b277d8e732f797d29c",
-        "revCount": 38,
+        "revCount": 39,
         "type": "git",
         "url": "file:///home/aires/Development/nix-configuration/nix-secrets"
       },

hosts/Haven/default.nix

@@ -10,6 +10,7 @@ let
 
   subdomains = [
     config.secrets.services.airsonic.url
+    config.secrets.services.cache.url
     config.secrets.services.forgejo.url
     config.secrets.services.gremlin-lab.url
   ];
@@ -51,6 +52,10 @@ in
         home = "/storage/services/airsonic-advanced";
       };
       boinc.enable = true;
+      cache = {
+        enable = true;
+        secretKeyFile = "/storage/services/nix-cache/cache-priv-key.pem";
+      };
       duplicacy-web = {
         enable = true;
         autostart = false;

modules/base/nix.nix

@@ -16,8 +16,14 @@
       ];
 
       # Use Lix instead of Nix
-      extra-substituters = [ "https://cache.lix.systems" ];
+      extra-substituters = [
-      trusted-public-keys = [ "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=" ];
+        "https://cache.lix.systems"
+        config.secrets.services.cache.url
+      ];
+      trusted-public-keys = [
+        "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
+        "${config.secrets.services.cache.url}:mTYvveYNhoXttGOxJj2uP0MQ/ZPJce5hY+xSvOxswls=%"
+      ];
 
       # Only allow these users to use Nix
       allowed-users = [

modules/services/cache.nix

@@ -0,0 +1,36 @@
+# Serves a binary cache for Nix packages
+{ config, lib, ... }:
+
+let
+  cfg = config.host.services.cache;
+in
+{
+  options = {
+    host.services.cache = {
+      enable = lib.mkEnableOption (lib.mdDoc "Enables binary cache hosting.");
+      secretKeyFile = lib.mkOption {
+        default = "/var/cache-priv-key.pem";
+        type = lib.types.str;
+        description = "Where the signing key lives.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services = {
+      nix-serve = {
+        enable = true;
+        secretKeyFile = cfg.secretKeyFile;
+      };
+
+      nginx.virtualHosts."${config.secrets.services.cache.url}" = {
+        useACMEHost = config.secrets.networking.primaryDomain;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
+          extraConfig = "proxy_ssl_server_name on;";
+        };
+      };
+    };
+  };
+}

nix-secrets

@@ -1 +1 @@
-Subproject commit d926175d96d4eec4e564727a6b4fad6d79be4db5
+Subproject commit 6c78f91590beb0f486a024b277d8e732f797d29c