121 lines
4.3 KiB
Nix
121 lines
4.3 KiB
Nix
# Pull everywhere; enable push only on the host that runs `nixos-rebuild --target-host` (needs sops `cachix/auth-token`).
|
|
{ inputs, ... }: {
|
|
flake.nixosModules.systemCachingCachix =
|
|
{ config, lib, pkgs, ... }:
|
|
let
|
|
cfg = config.chiasson.system.caching.cachix;
|
|
in
|
|
{
|
|
imports = [ inputs.sops-nix.nixosModules.sops ];
|
|
|
|
options.chiasson.system.caching.cachix = with lib; {
|
|
enable = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "Enable Cachix cache integration for this host.";
|
|
};
|
|
|
|
cacheName = mkOption {
|
|
type = types.str;
|
|
default = "";
|
|
example = "chiasson-nixosnew";
|
|
description = "Your Cachix cache name (from app.cachix.org). Leave empty to disable.";
|
|
};
|
|
publicKey = mkOption {
|
|
type = types.str;
|
|
default = "";
|
|
example = "chiasson-nixosnew.cachix.org-1:xxxx=";
|
|
description = "Public key for the cache (shown on the cache page).";
|
|
};
|
|
enablePush = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "Push every build to Cachix (enable only on the machine that runs nixos-rebuild --target-host).";
|
|
};
|
|
pushExcludePatterns = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [ ];
|
|
example = [ "wallpaper" "hm_wallpapers" ".iso" "-source" "large-assets" ];
|
|
description = "Substring patterns: store paths containing any of these are not pushed to Cachix (saves cache space for heavy outputs).";
|
|
};
|
|
};
|
|
|
|
config = let
|
|
enabled = cfg.enable && cfg.cacheName != "" && cfg.publicKey != "";
|
|
cacheUrl = "https://${cfg.cacheName}.cachix.org";
|
|
in
|
|
lib.mkMerge [
|
|
(lib.mkIf enabled {
|
|
nix.settings = {
|
|
substituters = lib.mkAfter [ cacheUrl ];
|
|
trusted-public-keys = lib.mkAfter [ cfg.publicKey ];
|
|
};
|
|
})
|
|
(lib.mkIf (enabled && cfg.enablePush) {
|
|
nix.settings.post-build-hook = pkgs.writeShellScript "upload-to-cachix" ''
|
|
set -eu
|
|
set -f
|
|
token_path="${config.sops.secrets."cachix/auth-token".path}"
|
|
if [ ! -r "$token_path" ]; then
|
|
echo "cachix: skipping push (token not readable at $token_path)" >&2
|
|
exit 0
|
|
fi
|
|
export PATH="${lib.makeBinPath [ pkgs.cachix ]}:$PATH"
|
|
export CACHIX_AUTH_TOKEN=$(cat "$token_path")
|
|
|
|
push_paths=""
|
|
skipped_roots=0
|
|
pushed_roots=0
|
|
for path in $OUT_PATHS; do
|
|
skip=0
|
|
skip_reason=""
|
|
|
|
closure_paths="$(nix-store -qR "$path" 2>/dev/null || true)"
|
|
for candidate in "$path" $closure_paths; do
|
|
while IFS= read -r pat; do
|
|
pat="$(printf '%s' "$pat" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
|
|
[ -z "$pat" ] && continue
|
|
case "$candidate" in
|
|
*"$pat"*)
|
|
skip=1
|
|
skip_reason="$pat ($candidate)"
|
|
break
|
|
;;
|
|
esac
|
|
done << 'EXCLUDE_PATTERNS'
|
|
${lib.concatStringsSep "\n" cfg.pushExcludePatterns}
|
|
EXCLUDE_PATTERNS
|
|
if [ "$skip" -eq 1 ]; then
|
|
break
|
|
fi
|
|
done
|
|
|
|
if [ "$skip" -eq 0 ]; then
|
|
push_paths="$push_paths $path"
|
|
pushed_roots=$((pushed_roots + 1))
|
|
else
|
|
skipped_roots=$((skipped_roots + 1))
|
|
echo "cachix: skipping root $path (matches exclude pattern via $skip_reason)" >&2
|
|
fi
|
|
done
|
|
|
|
echo "cachix: root paths selected for push: $pushed_roots, skipped: $skipped_roots" >&2
|
|
|
|
if [ -n "$push_paths" ]; then
|
|
if ! cachix push ${lib.escapeShellArg cfg.cacheName} $push_paths; then
|
|
echo "cachix: push failed (build succeeded; check token/network)" >&2
|
|
fi
|
|
fi
|
|
exit 0
|
|
'';
|
|
|
|
sops.secrets."cachix/auth-token" = {
|
|
owner = "root";
|
|
group = "root";
|
|
mode = "0400";
|
|
};
|
|
})
|
|
];
|
|
};
|
|
}
|