Enable binary cache on Haven
This commit is contained in:
parent
af16b29c16
commit
792e04f826
16
flake.lock
16
flake.lock
|
@ -249,11 +249,11 @@
|
||||||
"nix-secrets": {
|
"nix-secrets": {
|
||||||
"flake": false,
|
"flake": false,
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1716565755,
|
"lastModified": 1716585945,
|
||||||
"narHash": "sha256-J5TSspiAn+bA2LXSwVGKvzdEentj0w4qFqSwpHRbDsA=",
|
"narHash": "sha256-OxYcOt2ZshJ+VYXSrYb7Wc36cvWd7YjwSFzaDWNqkMU=",
|
||||||
"ref": "refs/heads/main",
|
"ref": "refs/heads/main",
|
||||||
"rev": "d926175d96d4eec4e564727a6b4fad6d79be4db5",
|
"rev": "6c78f91590beb0f486a024b277d8e732f797d29c",
|
||||||
"revCount": 38,
|
"revCount": 39,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "file:///home/aires/Development/nix-configuration/nix-secrets"
|
"url": "file:///home/aires/Development/nix-configuration/nix-secrets"
|
||||||
},
|
},
|
||||||
|
@ -264,16 +264,16 @@
|
||||||
},
|
},
|
||||||
"nixos-hardware": {
|
"nixos-hardware": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1716522390,
|
"lastModified": 1716214200,
|
||||||
"narHash": "sha256-m7PeeSOk/Lov702wXTmImwrK/YZXb7ymYgkeoBLvsJg=",
|
"narHash": "sha256-ivQlBlSxC1mrBepFc3CeqUqFcsoQelpgxseA7YYtyAw=",
|
||||||
"owner": "8bitbuddhist",
|
"owner": "8bitbuddhist",
|
||||||
"repo": "nixos-hardware",
|
"repo": "nixos-hardware",
|
||||||
"rev": "98564f268e74658d3620bd8eac09d8a0cd211671",
|
"rev": "704f05a3c8f8beb1d08837f43670c44946faad66",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "8bitbuddhist",
|
"owner": "8bitbuddhist",
|
||||||
"ref": "lenovo-16ARHA7-remove-speaker-fix",
|
"ref": "surface-pro-9-disable-psr",
|
||||||
"repo": "nixos-hardware",
|
"repo": "nixos-hardware",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
|
|
|
@ -25,7 +25,7 @@
|
||||||
nix-flatpak.url = "github:gmodena/nix-flatpak/v0.4.1";
|
nix-flatpak.url = "github:gmodena/nix-flatpak/v0.4.1";
|
||||||
|
|
||||||
# Hardware configurations
|
# Hardware configurations
|
||||||
nixos-hardware.url = "github:8bitbuddhist/nixos-hardware/lenovo-16ARHA7-remove-speaker-fix";
|
nixos-hardware.url = "github:8bitbuddhist/nixos-hardware/surface-pro-9-disable-psr";
|
||||||
|
|
||||||
# Home-manager
|
# Home-manager
|
||||||
home-manager = {
|
home-manager = {
|
||||||
|
|
|
@ -10,6 +10,7 @@ let
|
||||||
|
|
||||||
subdomains = [
|
subdomains = [
|
||||||
config.secrets.services.airsonic.url
|
config.secrets.services.airsonic.url
|
||||||
|
config.secrets.services.cache.url
|
||||||
config.secrets.services.forgejo.url
|
config.secrets.services.forgejo.url
|
||||||
config.secrets.services.gremlin-lab.url
|
config.secrets.services.gremlin-lab.url
|
||||||
];
|
];
|
||||||
|
@ -51,6 +52,10 @@ in
|
||||||
home = "/storage/services/airsonic-advanced";
|
home = "/storage/services/airsonic-advanced";
|
||||||
};
|
};
|
||||||
boinc.enable = true;
|
boinc.enable = true;
|
||||||
|
cache = {
|
||||||
|
enable = true;
|
||||||
|
secretKeyFile = "/storage/services/nix-cache/cache-priv-key.pem";
|
||||||
|
};
|
||||||
duplicacy-web = {
|
duplicacy-web = {
|
||||||
enable = true;
|
enable = true;
|
||||||
autostart = false;
|
autostart = false;
|
||||||
|
|
|
@ -16,8 +16,14 @@
|
||||||
];
|
];
|
||||||
|
|
||||||
# Use Lix instead of Nix
|
# Use Lix instead of Nix
|
||||||
extra-substituters = [ "https://cache.lix.systems" ];
|
extra-substituters = [
|
||||||
trusted-public-keys = [ "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=" ];
|
"https://cache.lix.systems"
|
||||||
|
config.secrets.services.cache.url
|
||||||
|
];
|
||||||
|
trusted-public-keys = [
|
||||||
|
"cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
|
||||||
|
"${config.secrets.services.cache.url}:mTYvveYNhoXttGOxJj2uP0MQ/ZPJce5hY+xSvOxswls=%"
|
||||||
|
];
|
||||||
|
|
||||||
# Only allow these users to use Nix
|
# Only allow these users to use Nix
|
||||||
allowed-users = [
|
allowed-users = [
|
||||||
|
|
36
modules/services/cache.nix
Normal file
36
modules/services/cache.nix
Normal file
|
@ -0,0 +1,36 @@
|
||||||
|
# Serves a binary cache for Nix packages
|
||||||
|
{ config, lib, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.host.services.cache;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
options = {
|
||||||
|
host.services.cache = {
|
||||||
|
enable = lib.mkEnableOption (lib.mdDoc "Enables binary cache hosting.");
|
||||||
|
secretKeyFile = lib.mkOption {
|
||||||
|
default = "/var/cache-priv-key.pem";
|
||||||
|
type = lib.types.str;
|
||||||
|
description = "Where the signing key lives.";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = lib.mkIf cfg.enable {
|
||||||
|
services = {
|
||||||
|
nix-serve = {
|
||||||
|
enable = true;
|
||||||
|
secretKeyFile = cfg.privateKeyFile;
|
||||||
|
};
|
||||||
|
|
||||||
|
nginx.virtualHosts."${config.secrets.services.cache.url}" = {
|
||||||
|
useACMEHost = config.secrets.networking.primaryDomain;
|
||||||
|
forceSSL = true;
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
|
||||||
|
extraConfig = "proxy_ssl_server_name on;";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
|
@ -1 +1 @@
|
||||||
Subproject commit d926175d96d4eec4e564727a6b4fad6d79be4db5
|
Subproject commit 6c78f91590beb0f486a024b277d8e732f797d29c
|
Loading…
Reference in a new issue