Wroclaw/nixos-configuration
1
0
Fork 0
Code Issues Pull requests Activity

nixos/nix-binary-cache: create nix cache signing key if doesn't exists

Browse source
This commit is contained in:
Wroclaw 2025-02-24 12:54:04 +01:00
parent 37801ab26f
commit e4d8bfada5
1 changed files with 44 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
nix-os/services/nix-binary-cache.nix
View file

@ -1,11 +1,54 @@
{ pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
{
options = {
services.nix-serve = {
keyName = lib.mkOption {
type = lib.types.str;
default = config.networking.fqdnOrHostName;
defaultText = "config.networking.fqdnOrHostName";
description = "Name of the key when generating (usually domain name)";
};
publicKeyFile = lib.mkOption {
type = lib.types.path;
default = "/var/cache-pub-key.pem";
description = "Path to the public key file";
};
};
};
config = {
services.nix-serve = {
enable = true;
package = pkgs.nix-serve-ng;
secretKeyFile = "/var/cache-priv-key.pem";
};
systemd.services.nix-serve-generate-key = let
inherit (config.services.nix-serve) keyName secretKeyFile publicKeyFile;
in {
description = "Ensure existence of nix binary cache signing key";
wantedBy = [ config.systemd.services.nix-serve.name ];
script = ''
if [ -f ${secretKeyFile} ]; then
echo "File ${secretKeyFile} already exists, nothing to do" >&2
exit 0
fi
if [ -a ${secretKeyFile} ]; then
echo "File ${secretKeyFile} is not a regular file" >&2
exit 1
fi
echo "Generating nix binary cache signing key" >&2
touch ${secretKeyFile}
chmod 600 ${secretKeyFile}
mkdir -p $(dirname ${secretKeyFile})
${lib.getExe' pkgs.nix "nix-store"} --generate-binary-cache-key \
${keyName} ${secretKeyFile} ${publicKeyFile}
'';
restartIfChanged = true;
};
};
}