Use attic as nixos binary cache and update CI accordingly

.gitea/workflows/check-flake.yaml

@@ -15,5 +15,12 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Setup Attic Cache
+        uses: https://github.com/ryanccn/attic-action@v0
+        with:
+          endpoint: ${{ secrets.ATTIC_ENDPOINT }}
+          cache: ${{ secrets.ATTIC_CACHE }}
+          token: ${{ secrets.ATTIC_TOKEN }}
+
       - name: Check Flake
         run: nix flake check --all-systems --print-build-logs --log-format raw --show-trace

common/binary-cache.nix

@@ -6,11 +6,11 @@
       substituters = [
         "https://cache.nixos.org/"
         "https://nix-community.cachix.org"
-        "http://s0.koi-bebop.ts.net:5000"
+        "http://s0.koi-bebop.ts.net:28338/nixos"
       ];
       trusted-public-keys = [
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU="
+        "nixos:IDhKojUaMz+UIiri1/DQk9EpqDokih8dwxmp41uJnls="
       ];
     };
   };

common/default.nix

@@ -63,6 +63,7 @@
     lf
     gnumake
     tree
+    attic
   ];
 
   nixpkgs.config.allowUnfree = true;

common/server/atticd.nix

@@ -0,0 +1,37 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.services.atticd;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.atticd = {
+      credentialsFile = "/run/agenix/atticd-credentials";
+
+      settings = {
+        listen = "[::]:28338";
+
+        chunking = {
+          # Disable chunking for performance (I have plenty of space)
+          nar-size-threshold = 0;
+
+          # Chunking is disabled due to poor performance so these values don't matter but are required anyway.
+          # One day, when I move away from ZFS maybe this will perform well enough.
+          # nar-size-threshold = 64 * 1024; # 64 KiB
+          min-size = 16 * 1024; # 16 KiB
+          avg-size = 64 * 1024; # 64 KiB
+          max-size = 256 * 1024; # 256 KiB
+        };
+
+        # Disable compression for performance (I have plenty of space)
+        compression.type = "none";
+
+        garbage-collection = {
+          default-retention-period = "6 months";
+        };
+      };
+    };
+
+    age.secrets.atticd-credentials.file = ../../secrets/atticd-credentials.age;
+  };
+}

common/server/default.nix

@@ -22,5 +22,6 @@
     ./dashy.nix
     ./librechat.nix
     ./actualbudget.nix
+    ./atticd.nix
   ];
 }

flake.lock

@@ -25,6 +25,36 @@
         "type": "github"
       }
     },
+    "attic": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": [
+          "flake-compat"
+        ],
+        "flake-utils": [
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1717279440,
+        "narHash": "sha256-kH04ReTjxOpQumgWnqy40vvQLSnLGxWP6RF3nq5Esrk=",
+        "owner": "zhaofengli",
+        "repo": "attic",
+        "rev": "717cc95983cdc357bc347d70be20ced21f935843",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zhaofengli",
+        "repo": "attic",
+        "type": "github"
+      }
+    },
     "blobs": {
       "flake": false,
       "locked": {
@@ -41,6 +71,27 @@
         "type": "gitlab"
       }
     },
+    "crane": {
+      "inputs": {
+        "nixpkgs": [
+          "attic",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1717025063,
+        "narHash": "sha256-dIubLa56W9sNNz0e8jGxrX3CAkPXsq7snuFA/Ie6dn8=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "480dff0be03dac0e51a8dfc26e882b0d123a450e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "dailybuild_modules": {
       "inputs": {
         "flake-utils": [
@@ -281,6 +332,7 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "attic": "attic",
         "dailybuild_modules": "dailybuild_modules",
         "deploy-rs": "deploy-rs",
         "flake-compat": "flake-compat",

flake.nix

@@ -75,6 +75,17 @@
       url = "github:Mic92/nix-index-database";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    # Attic
+    attic = {
+      url = "github:zhaofengli/attic";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        nixpkgs-stable.follows = "nixpkgs";
+        flake-utils.follows = "flake-utils";
+        flake-compat.follows = "flake-compat";
+      };
+    };
   };
 
   outputs = { self, nixpkgs, ... }@inputs:
@@ -94,6 +105,7 @@
             agenix.nixosModules.default
             dailybuild_modules.nixosModule
             nix-index-database.nixosModules.nix-index
+            attic.nixosModules.atticd
             self.nixosModules.kernel-modules
             ({ lib, ... }: {
               config = {

machines/storage/s0/default.nix

@@ -10,23 +10,6 @@
 
   # system.autoUpgrade.enable = true;
 
-  nix.gc.automatic = lib.mkForce false; # allow the nix store to serve as a build cache
-
-  # binary cache
-  services.nix-serve = {
-    enable = true;
-    openFirewall = true;
-    secretKeyFile = "/run/agenix/binary-cache-private-key";
-  };
-  age.secrets.binary-cache-private-key.file = ../../../secrets/binary-cache-private-key.age;
-  users.users.cache-push = {
-    isNormalUser = true;
-    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB" ];
-  };
-  nix.settings = {
-    trusted-users = [ "cache-push" ];
-  };
-
   services.iperf3.enable = true;
   services.iperf3.openFirewall = true;
 
@@ -235,4 +218,6 @@
   };
 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
+
+  services.atticd.enable = true;
 }

secrets/atticd-credentials.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 hPp1nw tMy5kLAcQD62yAfEVJ4LQZjs0kkEEQOfM4HN9yj3hBY
+JvlklGTxxfAZbP+alm3nxLxqhmcu2mTKwRU5WaapL9w
+-> ssh-ed25519 w3nu8g ZGzufldXq7kmIpqFecbkpDxiykWZ207k0+09I2dmxEM
+SK25e5HBe4b5reGXXfCjIFbFGzfu32RFjY++/yteRVc
+--- xZOe1syYAcVRDhiNRv+CsfFgoQbiANA6vNCon+5NExc
+-·ñ1Å,C-.M§Áè?ÐêóµµàY|u+
+‹	³Ø<C2B3>÷ŽæÒ¡ôm†Œûäfß]=érøÜüÎAg¤€æSú:Ð8•S¦LiœùªsêÁâ9JŠð<>¸ÏæñÄÐÃ<ûAz¹[ý§xï<78>:‡'U*<2A>wÀ™D/…±VpM~!õ,* ¿”µ¡øk¥Ö´ßEíîïh› {¢p$¾R`ÿ”

secrets/secrets.nix

@@ -20,10 +20,7 @@ with roles;
   "robots-email-pw.age".publicKeys = gitea;
 
   # nix binary cache
-  # public key: s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU=
-  "binary-cache-private-key.age".publicKeys = binary-cache;
-  # public key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB
-  "binary-cache-push-sshkey.age".publicKeys = nobody; # this value is directly given to gitea
+  "atticd-credentials.age".publicKeys = binary-cache;
 
   # vpn
   "iodine.age".publicKeys = iodine;