Rebase to flake parts #9

2026-05-10 01:45:16 -03:00
parent 34b89af77f
commit f02606902c
46 changed files with 2382 additions and 166 deletions
@@ -0,0 +1,120 @@
+# Pull everywhere; enable push only on the host that runs `nixos-rebuild --target-host` (needs sops `cachix/auth-token`).
+{ inputs, ... }: {
+  flake.nixosModules.systemCachingCachix =
+    { config, lib, pkgs, ... }:
+    let
+      cfg = config.chiasson.system.caching.cachix;
+    in
+    {
+      imports = [ inputs.sops-nix.nixosModules.sops ];
+
+      options.chiasson.system.caching.cachix = with lib; {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable Cachix cache integration for this host.";
+        };
+
+        cacheName = mkOption {
+          type = types.str;
+          default = "";
+          example = "chiasson-nixosnew";
+          description = "Your Cachix cache name (from app.cachix.org). Leave empty to disable.";
+        };
+        publicKey = mkOption {
+          type = types.str;
+          default = "";
+          example = "chiasson-nixosnew.cachix.org-1:xxxx=";
+          description = "Public key for the cache (shown on the cache page).";
+        };
+        enablePush = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Push every build to Cachix (enable only on the machine that runs nixos-rebuild --target-host).";
+        };
+        pushExcludePatterns = mkOption {
+          type = types.listOf types.str;
+          default = [ ];
+          example = [ "wallpaper" "hm_wallpapers" ".iso" "-source" "large-assets" ];
+          description = "Substring patterns: store paths containing any of these are not pushed to Cachix (saves cache space for heavy outputs).";
+        };
+      };
+
+      config = let
+        enabled = cfg.enable && cfg.cacheName != "" && cfg.publicKey != "";
+        cacheUrl = "https://${cfg.cacheName}.cachix.org";
+      in
+      lib.mkMerge [
+        (lib.mkIf enabled {
+          nix.settings = {
+            substituters = lib.mkAfter [ cacheUrl ];
+            trusted-public-keys = lib.mkAfter [ cfg.publicKey ];
+          };
+        })
+        (lib.mkIf (enabled && cfg.enablePush) {
+          nix.settings.post-build-hook = pkgs.writeShellScript "upload-to-cachix" ''
+            set -eu
+            set -f
+            token_path="${config.sops.secrets."cachix/auth-token".path}"
+            if [ ! -r "$token_path" ]; then
+              echo "cachix: skipping push (token not readable at $token_path)" >&2
+              exit 0
+            fi
+            export PATH="${lib.makeBinPath [ pkgs.cachix ]}:$PATH"
+            export CACHIX_AUTH_TOKEN=$(cat "$token_path")
+
+            push_paths=""
+            skipped_roots=0
+            pushed_roots=0
+            for path in $OUT_PATHS; do
+              skip=0
+              skip_reason=""
+
+              closure_paths="$(nix-store -qR "$path" 2>/dev/null || true)"
+              for candidate in "$path" $closure_paths; do
+                while IFS= read -r pat; do
+                  pat="$(printf '%s' "$pat" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+                  [ -z "$pat" ] && continue
+                  case "$candidate" in
+                    *"$pat"*)
+                      skip=1
+                      skip_reason="$pat ($candidate)"
+                      break
+                      ;;
+                  esac
+                done << 'EXCLUDE_PATTERNS'
+            ${lib.concatStringsSep "\n" cfg.pushExcludePatterns}
+            EXCLUDE_PATTERNS
+                if [ "$skip" -eq 1 ]; then
+                  break
+                fi
+              done
+
+              if [ "$skip" -eq 0 ]; then
+                push_paths="$push_paths $path"
+                pushed_roots=$((pushed_roots + 1))
+              else
+                skipped_roots=$((skipped_roots + 1))
+                echo "cachix: skipping root $path (matches exclude pattern via $skip_reason)" >&2
+              fi
+            done
+
+            echo "cachix: root paths selected for push: $pushed_roots, skipped: $skipped_roots" >&2
+
+            if [ -n "$push_paths" ]; then
+              if ! cachix push ${lib.escapeShellArg cfg.cacheName} $push_paths; then
+                echo "cachix: push failed (build succeeded; check token/network)" >&2
+              fi
+            fi
+            exit 0
+          '';
+
+          sops.secrets."cachix/auth-token" = {
+            owner = "root";
+            group = "root";
+            mode = "0400";
+          };
+        })
+      ];
+    };
+}
@@ -0,0 +1,9 @@
+# `system.caching.*` — Attic + Cachix; exported again as `nixosModules.systemCaching`.
+{ self, ... }: {
+  flake.nixosModules.systemCaching = {
+    imports = [
+      self.nixosModules.systemCachingAttic
+      self.nixosModules.systemCachingCachix
+    ];
+  };
+}