Add binary cache hosted on fuuko
See machines/fuuko/services/binary-cache.nix for limitations.pull/52/head
parent
07d4260b95
commit
8d9e3af211
GPG Key ID:
8D3C82F9F309F8EC
|
|
@ -6,6 +6,7 @@
|
|||
../../users/simon
|
||||
|
||||
./services/ankisyncd.nix
|
||||
./services/binary-cache.nix
|
||||
./services/dnsmasq.nix
|
||||
./services/drone
|
||||
./services/gitea.nix
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
drone-rpc-environment: ENC[AES256_GCM,data:2Alck43ZrOFzhY7fKonIyboROD5qGuKkalTXlUZM0vBYTNeFLblU4u4tIIaA4t9nNO4=,iv:EakQQ/8pVZlIzM9PbNB0EGzSW46t/dWbxOtQo6uVAhs=,tag:NEhSgzkx8AxIjqtGetGG9w==,type:str]
|
||||
drone-server-environment: ENC[AES256_GCM,data:73uDSq+u3nGiKhLqdhdegTIvec9mF9jxVLJLtCjer5jUiFEZu5PkeYv0AWAyLWbB7s8b0V+4fxNQo/QsAfBWH0eP2TVOAy1TAo/sOso9PEVRaQCdilw39UJBdT8II3dy9YIfGFUXRUXCMU+1xfzUFjhU0s7sc+mYQ4jEj2ZX90UbUDcbgppNjC7KIHo8mQdrxFHeMq+wQpaoncwFMlwwzn8lFlG75+dMnkPGYa4xSqkwjHn2tewLM8f9dCiBQVoMVQCWo+1RieMq2cd3CYEkP7MPl+y3OA==,iv:kggBBXdN01LJ82azzxOZap1lfWglshCjkKqaU+oi+T4=,tag:Zg0Ay2aLGok4fgX3/y4ILA==,type:str]
|
||||
gitea-mail: ENC[AES256_GCM,data:ck4S9YJ1BLUb6+mOrRmg22KWI1xQwsdIw1dowNk1OOk=,iv:+aQiTSGzmBOLYbIVgwH/SIhslKgdJKoL1ZaGAXCeqHY=,tag:H3vCEGMktqAV/9BASVR5tg==,type:str]
|
||||
nix-binary-cache-htpasswd: ENC[AES256_GCM,data:IktPHrrvExeZlCPmP82W9AovC59ILPbMQExVDO7U2S9lJ9cQKP14mQPuYwA+yKTycIdA01MwRDbt/SxhVleZ+aKkyOPwx/iG5B0cQX6cVqQWVTNVmxlW2sjupnnwwibcdikU21CIw6YsDKs7pMqRAfC/U2OJ3POo2qH5GgFY,iv:ofzEQ143HQQGZIEVkdWCrcENz0i6JPljLDGmG0A7aJ8=,tag:a557cdgRD25jWHhZeT+CnQ==,type:str]
|
||||
prometheus-htpasswd: ENC[AES256_GCM,data:eJOWrcTC3YISJJLuQV6sxzD0r8Gr8uoUt48D9sSEHhsbNUUy3pDgIPqJHrkG0ek2sIF6NvpWdDGK1kFcduRAL9h7nLxQLOtf7dxsdObGlPH5nwe6CwdR+1wTE/2WzrsmTGnUrMjMiBgLPV2yRiQg3VJ7W1Me8tHPYHrqYhM=,iv:WvgwIoIfxc3vyjF+znyUzOElv+sd/thoYpxWVaIavx0=,tag:9FnRw7ol++1PCbl1c2IyoA==,type:str]
|
||||
restic-password: ENC[AES256_GCM,data:IVFXmuzzvvqDS0T3P0R5ZMIn2wdkbE1AqwDMkWqMpDdCOVMP4/HhP4jF+tEarq22,iv:Eu6Wspzm0rPl0CuSoYTTLz+MmaEtmwCD57nH2JTBuaA=,tag:tKqt5Z7nF7lLcSsDKS4E3A==,type:str]
|
||||
restic-s3: ENC[AES256_GCM,data:VJ/jgYnUSkbsNMb1ciLiCcRVEpuaznsSFf0QkEnPhTRHpFv4Nt0f8ARnNtG5j3iXSIT4+H2+5HWKXEsjhvL85p0XE3xe4h45xGKnvvVO2obF+b/zsMDdceFJtLbcq+APzPBjchYU,iv:W+80GhAvYD/52dNZsNYiEhiLo4dhO8oxkd+GAbk42NU=,tag:Kj9CaGo/xAmYxdoLE/Lo1Q==,type:str]
|
||||
|
|
@ -13,8 +14,8 @@ sops:
|
|||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
lastmodified: '2021-04-07T10:20:03Z'
|
||||
mac: ENC[AES256_GCM,data:OzXpColS5Di4qRXSdkV5Ue2FqysF/GYzX9kQcEiAOZaDb9uUoKBs8EakZ4pOfcgug2/v1BIQ0aQ/Xf2uCERJzvj3rC+2Gdng0p9AC1aelEIm3vxo4hliKEG1eo5KlIrroTaQlxb1wXGKDabuy+8P57reVbLNQuM9ioQ5teuSWLk=,iv:VksbYHEVP/5zvGCgFg9e3pegDrxljkosVretlvaa6w0=,tag:mafF7XQFchHrSA2n9mE0BQ==,type:str]
|
||||
lastmodified: '2021-04-08T11:39:09Z'
|
||||
mac: ENC[AES256_GCM,data:4Z7Gvr2wi0rIwS8iBlwEfap4aAP1BPMlKX2WwCYPxt6BTnK1LLoZvZq4Wk6R2tm/6PchtJt8YDx5abS+hq4xMS7EmJuvBMFNe1pWGo5xqvzQi+CuBJ7+oTWEURP+vsgYypMgzHh1NjpLXJOZr+F60ZzdeIVRu9qiETDY18o2h08=,iv:Qe/b0lOs0FQr68Ga2rSoh1xYa6V6vWPJOXXNxtJEZNI=,tag:kkJldwps/dC4ozpQ7HQaUw==,type:str]
|
||||
pgp:
|
||||
- created_at: '2021-04-06T11:27:21Z'
|
||||
enc: |
|
||||
|
|
|
|||
|
|
@ -0,0 +1,60 @@
|
|||
# This serves a local binary cache. If the request comes from my home network,
|
||||
# it will set its priority higher than cache.nixos.org (which has a priority of
|
||||
# 40), so local devices get a faster binary cache. If the request coes from
|
||||
# outside my home network, it will set its priority lower, only store paths
|
||||
# exclusive to this cache will be substituted.
|
||||
# This only works well when a host does not change its “location”, since nix
|
||||
# caches binary caches locally (per-user, also for root!) in
|
||||
# ${XDG_CACHE_HOME:-$HOME/.cache}/.cache/nix/binary-cache-v6.sqlite and does
|
||||
# not re-check or invalidate them. Devices that often are not at home should
|
||||
# ensure that the cached priority is 50 to avoid slow substitutions.
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
binaryCachePath = "/data/cache/nix-binary-cache";
|
||||
in
|
||||
{
|
||||
sops.secrets.nix-binary-cache-htpasswd = {
|
||||
owner = "nginx";
|
||||
sopsFile = ../secrets.yaml;
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
appendHttpConfig = ''
|
||||
geo $nix_binary_cache_priority {
|
||||
default 50;
|
||||
|
||||
192.168.100.0/24 30;
|
||||
2001:470:1f0b:abc::/64 30;
|
||||
}
|
||||
'';
|
||||
virtualHosts."nix-cache.sbruder.de" = rec {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
root = binaryCachePath;
|
||||
locations = {
|
||||
"/nix-cache-info" = {
|
||||
return = "200 \"StoreDir: /nix/store\\nPriority: $nix_binary_cache_priority\\n\"";
|
||||
};
|
||||
"/".extraConfig = ''
|
||||
log_not_found off;
|
||||
|
||||
client_max_body_size 5G;
|
||||
|
||||
# WebDAV (for uploading)
|
||||
dav_methods PUT DELETE;
|
||||
create_full_put_path on; # nar/ does not exist by default
|
||||
dav_access user:rw group:r all:r;
|
||||
# same filesystem for temporary files
|
||||
client_body_temp_path ${root}/.upload-tmp;
|
||||
|
||||
limit_except GET {
|
||||
auth_basic "restricted upload";
|
||||
auth_basic_user_file ${config.sops.secrets.nix-binary-cache-htpasswd.path};
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.nginx.serviceConfig.ReadWritePaths = lib.singleton binaryCachePath;
|
||||
}
|
||||
|
|
@ -105,6 +105,9 @@ in
|
|||
allowedUDPPortRanges = lib.singleton { from = 9990; to = 9999; };
|
||||
};
|
||||
|
||||
sops.secrets.binary-cache-secret-key = { };
|
||||
sops.secrets.nix-netrc = { };
|
||||
|
||||
nix = {
|
||||
nixPath = [
|
||||
"/var/src" # pinned nixpkgs and configuration
|
||||
|
|
@ -114,10 +117,21 @@ in
|
|||
# Make sudoers trusted nix users
|
||||
trustedUsers = [ "@wheel" ];
|
||||
|
||||
binaryCaches = [
|
||||
"https://nix-cache.sbruder.de/"
|
||||
];
|
||||
binaryCachePublicKeys = [
|
||||
"nix-cache.sbruder.de-1:bU13eF6IMMW2hgO7StgB6JCAoZPeAQ27NAzV0kru1XM="
|
||||
];
|
||||
|
||||
# On-the-fly optimisation of nix store
|
||||
autoOptimiseStore = true;
|
||||
# Keep output of derivations with gc root
|
||||
extraOptions = lib.optionalString config.sbruder.full ''
|
||||
extraOptions = ''
|
||||
# Binary cache upload
|
||||
secret-key-files = ${config.sops.secrets.binary-cache-secret-key.path}
|
||||
netrc-file = ${config.sops.secrets.nix-netrc.path}
|
||||
'' + lib.optionalString config.sbruder.full ''
|
||||
# Keep output of derivations with gc root
|
||||
keep-outputs = true
|
||||
keep-derivations = true
|
||||
'';
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
binary-cache-secret-key: ENC[AES256_GCM,data:HIx+SJzTeWIOD89xXGHDgVerDLFO0t6/S8E+QTVPtet5SUxiJLs8X+6/FZfm5WiILU6utecSV6+vpDap/yKcuin63OhXeUWbpD3pnOMtIElfs3tR1EUkJ3tiOJFVsThqi9JDNySGlq36ch2MTSfPdQ==,iv:jwwTaktWMPWFnCN3Ur84cgUm1kNZqzEEbyfZ7dIysWA=,tag:qDDpMJDYM8WUTqlJWOzaVg==,type:str]
|
||||
nix-netrc: ENC[AES256_GCM,data:vOcauP7BpcWriA6Q+UO8apdc+zfJej8OQswnaDEfIf2Gi3IbrNaeusGVwtzvRC5DI/Mqdjzmg0+SYvket0X7HSLzAFbML3YDl28btutzby1jpkTKWnJL0Gq3GDG0DgOqzbemQGJDtejI7pTPo6NLtMlmvA==,iv:sISKlZx+pMU7LnaT1ZC6tZo8ITYXpgLwYPpkoG51zks=,tag:u0h9l85CxEi6awwRdFXkog==,type:str]
|
||||
media-proxy-auth: ENC[AES256_GCM,data:KaYd8TCMVlHbgoj1QQfRwTXAK2hJUDr0UJqhTXvILylyR+mdJy7smn5EtFdNNFWZk6eJituvGG7naT2/UiNoYne4ljlJhu/IuObTLY5AI9ELDtYBDQ==,iv:qo6SOaHrWsXfvRwgSKDTSnreOcO9xy3RKrfE2k+VLEg=,tag:SND1zp2Cd2gqQdOVWw2eWw==,type:str]
|
||||
torrent-proxy-auth: ENC[AES256_GCM,data:9XuDRdUjOClPuZFvI7VwYQdbegzg400zfmFmE3qt5kTo6bD7m74V9F3b73aUueqMQ+80PxBc1KusTTlPYy2LAf6mT4PQ2TpqSu0kBXAezfL4e5fxdQ==,iv:26d+hQ9yn5CzDGNZvi9A5bvzgo87IrJHz67xTac4UA4=,tag:5FtjmtIY1gSixu/9UZhBVA==,type:str]
|
||||
restic-s3: ENC[AES256_GCM,data:lRcwoChzSX+ICXyafAtBGjkBTBdzL5v/imUL2yHtApMOe+MkP5CjXr47WoWGt17tdLPVRQ9v7/6jcagTKIk3IfjmhRhMip3CMyPkio62uDxArlaKpi9GoZNQOCt+XHWlpiBJ609H,iv:yrp2QZLXJypWh5XjsAHcpiXEPUcYF8A+mQZ+W2w7zpU=,tag:Xis3NQ2KNQqG+Rmgzpy3Tg==,type:str]
|
||||
|
|
@ -7,8 +9,8 @@ sops:
|
|||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
lastmodified: '2021-04-06T11:12:39Z'
|
||||
mac: ENC[AES256_GCM,data:guWWnJb9153SmSFwvDEqru0GGYUgQCmCtDb/bmKCehUvQ2ecVDulYYKAQ5jq2v3Eo5pfKmdrtIMV/jf6TOwNyEqBuWxU5aUODMheSqYgDNKAcFSvwpdldyVATspt7XT0s0waUbFBPjMOmQC0TEp5rtZXS7PlRT8DgohUlyy6jhI=,iv:Eh3Uwctaw0hrI6Ux2q0WUixZiLF5Fdj3/AVG8PluCHc=,tag:Jo3bzKNQzH7tsatfLphagQ==,type:str]
|
||||
lastmodified: '2021-04-08T14:05:22Z'
|
||||
mac: ENC[AES256_GCM,data:jCe1m/OqWyAWBYXSqk2oHmNkVuMTGVzjBzzD6o2fbo2YmoloUqsYDuGbpThlTxKIl9nL/5UJjKVJ2QMHFrB3+vvg0KH4LxoR9aFtCXFtIbeJcv77x1MT9s+8mrib75B4JulqMhSmnzqQ6bXA8l7tIUhg2ezaGZsT4Q/V1E72aJQ=,iv:hdB4MmgBGUN7HwUMv2Wn7qZ6C5HlBlOjRniJ9qV420s=,tag:dP0FAOf1A9u1H/l0L1ejcA==,type:str]
|
||||
pgp:
|
||||
- created_at: '2021-04-06T11:13:25Z'
|
||||
enc: |
|
||||
|
|
|
|||
Loading…
Reference in New Issue