aires/nix-configuration
aires/nix-configuration
1
0
Fork 0
Code Actions Activity

Enable binary cache on Haven

Browse source
This commit is contained in:
Aires 2024-05-24 17:33:37 -04:00
parent af16b29c16
commit 792e04f826
6 changed files with 59 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
flake.lock
View file

@ -249,11 +249,11 @@
"nix-secrets": {
"flake": false,
"locked": {
"lastModified": 1716565755,
"narHash": "sha256-J5TSspiAn+bA2LXSwVGKvzdEentj0w4qFqSwpHRbDsA=",
"lastModified": 1716585945,
"narHash": "sha256-OxYcOt2ZshJ+VYXSrYb7Wc36cvWd7YjwSFzaDWNqkMU=",
"ref": "refs/heads/main",
"rev": "d926175d96d4eec4e564727a6b4fad6d79be4db5",
"revCount": 38,
"rev": "6c78f91590beb0f486a024b277d8e732f797d29c",
"revCount": 39,
"type": "git",
"url": "file:///home/aires/Development/nix-configuration/nix-secrets"
},
@ -264,16 +264,16 @@
},
"nixos-hardware": {
"locked": {
"lastModified": 1716522390,
"narHash": "sha256-m7PeeSOk/Lov702wXTmImwrK/YZXb7ymYgkeoBLvsJg=",
"lastModified": 1716214200,
"narHash": "sha256-ivQlBlSxC1mrBepFc3CeqUqFcsoQelpgxseA7YYtyAw=",
"owner": "8bitbuddhist",
"repo": "nixos-hardware",
"rev": "98564f268e74658d3620bd8eac09d8a0cd211671",
"rev": "704f05a3c8f8beb1d08837f43670c44946faad66",
"type": "github"
},
"original": {
"owner": "8bitbuddhist",
"ref": "lenovo-16ARHA7-remove-speaker-fix",
"ref": "surface-pro-9-disable-psr",
"repo": "nixos-hardware",
"type": "github"
}

2
flake.nix
View file

@ -25,7 +25,7 @@
nix-flatpak.url = "github:gmodena/nix-flatpak/v0.4.1";
# Hardware configurations
nixos-hardware.url = "github:8bitbuddhist/nixos-hardware/lenovo-16ARHA7-remove-speaker-fix";
nixos-hardware.url = "github:8bitbuddhist/nixos-hardware/surface-pro-9-disable-psr";
# Home-manager
home-manager = {

5
hosts/Haven/default.nix
View file

@ -10,6 +10,7 @@ let
subdomains = [
config.secrets.services.airsonic.url
config.secrets.services.cache.url
config.secrets.services.forgejo.url
config.secrets.services.gremlin-lab.url
];
@ -51,6 +52,10 @@ in
home = "/storage/services/airsonic-advanced";
};
boinc.enable = true;
cache = {
enable = true;
secretKeyFile = "/storage/services/nix-cache/cache-priv-key.pem";
};
duplicacy-web = {
enable = true;
autostart = false;

10
modules/base/nix.nix
View file

@ -16,8 +16,14 @@
];
# Use Lix instead of Nix
extra-substituters = [ "https://cache.lix.systems" ];
trusted-public-keys = [ "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=" ];
extra-substituters = [
"https://cache.lix.systems"
config.secrets.services.cache.url
];
trusted-public-keys = [
"cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
"${config.secrets.services.cache.url}:mTYvveYNhoXttGOxJj2uP0MQ/ZPJce5hY+xSvOxswls=%"
];
# Only allow these users to use Nix
allowed-users = [

36
modules/services/cache.nix Normal file
View file

@ -0,0 +1,36 @@
# Serves a binary cache for Nix packages
{ config, lib, ... }:
let
cfg = config.host.services.cache;
in
{
options = {
host.services.cache = {
enable = lib.mkEnableOption (lib.mdDoc "Enables binary cache hosting.");
secretKeyFile = lib.mkOption {
default = "/var/cache-priv-key.pem";
type = lib.types.str;
description = "Where the signing key lives.";
};
};
};
config = lib.mkIf cfg.enable {
services = {
nix-serve = {
enable = true;
secretKeyFile = cfg.privateKeyFile;
};
nginx.virtualHosts."${config.secrets.services.cache.url}" = {
useACMEHost = config.secrets.networking.primaryDomain;
forceSSL = true;
locations."/" = {
proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
extraConfig = "proxy_ssl_server_name on;";
};
};
};
};
}

2
nix-secrets

@ -1 +1 @@
Subproject commit d926175d96d4eec4e564727a6b4fad6d79be4db5
Subproject commit 6c78f91590beb0f486a024b277d8e732f797d29c