43 lines
1.1 KiB
Nix
43 lines
1.1 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
let
|
|
cacheKeyDir = "/var/lib/harmonia";
|
|
privKeyPath = "${cacheKeyDir}/cache-priv-key.pem";
|
|
pubKeyPath = "${cacheKeyDir}/cache-pub-key.pem";
|
|
in
|
|
{
|
|
# Generate signing key pair on first boot
|
|
systemd.services.harmonia-setup = {
|
|
description = "Generate Harmonia binary cache signing key";
|
|
wantedBy = [ "multi-user.target" ];
|
|
before = [ "harmonia.service" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
script = ''
|
|
if [ ! -f ${privKeyPath} ]; then
|
|
mkdir -p ${cacheKeyDir}
|
|
${pkgs.nix}/bin/nix-store --generate-binary-cache-key cache.extremist.software-1 ${privKeyPath} ${pubKeyPath}
|
|
chmod 600 ${privKeyPath}
|
|
chmod 644 ${pubKeyPath}
|
|
echo "Signing key generated. Public key:"
|
|
cat ${pubKeyPath}
|
|
fi
|
|
'';
|
|
};
|
|
|
|
# Harmonia binary cache server
|
|
services.harmonia = {
|
|
enable = true;
|
|
signKeyPath = privKeyPath;
|
|
settings.bind = "[::]:5000";
|
|
};
|
|
|
|
# Caddy reverse proxy for the cache
|
|
services.caddy.virtualHosts."cache.extremist.software" = {
|
|
extraConfig = ''
|
|
reverse_proxy localhost:5000
|
|
'';
|
|
};
|
|
}
|