flake.lock: Update

Flake lock file updates:

• Updated input 'nix-index-database':
    'github:Mic92/nix-index-database/68ec961c51f48768f72d2bbdb396ce65a316677e' (2023-04-15)
  → 'github:Mic92/nix-index-database/e3e320b19c192f40a5b98e8776e3870df62dee8a' (2023-04-25)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/8dafae7c03d6aa8c2ae0a0612fbcb47e994e3fb8' (2023-04-22)
  → 'github:NixOS/nixpkgs/297187b30a19f147ef260abb5abd93b0706af238' (2023-04-30)

common/binary-cache.nix

@@ -0,0 +1,17 @@
+{ config, lib, ... }:
+
+{
+  nix = {
+    settings = {
+      substituters = [
+        "http://s0.koi-bebop.ts.net:5000"
+        "https://nix-community.cachix.org"
+        "https://cache.nixos.org/"
+      ];
+      trusted-public-keys = [
+        "s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      ];
+    };
+  };
+}

common/default.nix

@@ -3,6 +3,7 @@
 {
   imports = [
     ./backups.nix
+    ./binary-cache.nix
     ./flakes.nix
     ./auto-update.nix
     ./shell.nix

flake.lock

@@ -171,11 +171,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1681591833,
+        "lastModified": 1682417654,
-        "narHash": "sha256-lW+xOELafAs29yw56FG4MzNOFkh8VHC/X/tRs1wsGn8=",
+        "narHash": "sha256-XtUhq1GTRzV7QebHkxjd7Z58E6lVEk6Iv1/pF/GnBB4=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "68ec961c51f48768f72d2bbdb396ce65a316677e",
+        "rev": "e3e320b19c192f40a5b98e8776e3870df62dee8a",
         "type": "github"
       },
       "original": {
@@ -186,11 +186,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1682133240,
+        "lastModified": 1682818264,
-        "narHash": "sha256-s6yRsI/7V+k/+rckp0+/2cs/UXnea3SEfMpy95QiGcc=",
+        "narHash": "sha256-EPr900C3WaYulOdWRF3BMQrjF2Ao5Jf8xUOnFvZDTXE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8dafae7c03d6aa8c2ae0a0612fbcb47e994e3fb8",
+        "rev": "297187b30a19f147ef260abb5abd93b0706af238",
         "type": "github"
       },
       "original": {

machines/storage/s0/default.nix

@@ -14,6 +14,14 @@
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
   nix.gc.automatic = lib.mkForce false; # allow the nix store to serve as a build cache
 
+  # binary cache
+  services.nix-serve = {
+    enable = true;
+    openFirewall = true;
+    secretKeyFile = "/run/agenix/binary-cache-private-key";
+  };
+  age.secrets.binary-cache-private-key.file = ../../../secrets/binary-cache-private-key.age;
+
   services.iperf3.enable = true;
   services.iperf3.openFirewall = true;
 

machines/storage/s0/properties.nix

@@ -9,6 +9,7 @@
     "storage"
     "server"
     "pia"
+    "binary-cache"
   ];
 
   hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwiXcUFtAvZCayhu4+AIcF+Ktrdgv9ee/mXSIhJbp4q";

secrets/binary-cache-private-key.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 hPp1nw 4fyRGsaEo25EOj/VwPsF0tayghF0URctont4/re6OmY
+rs09DCSb2bd/v45a7ABxfLo+Sz3OPLkRzfnP5Tmgi0g
+-> ssh-ed25519 dMQYog seRjdySBF1GISaSUWqZNvoW4INDUCxvBKJOgvGeyX1Q
+fe6JE5f9A48ujVtuc0QZ7e7pWW+Tu0yyQEyexTvQWAQ
+-> Uqf![<-grease O}' _h*Y~ .@=$H,~W
+jDlO5MEGPDjJ44cAWuJaTeADbG+wz5PTqq9Pw75QV3Exrsb8/PNGOrUZKuSTCCl3
+g/z3ZHelBBqHp16ZTc+LSxDYgvnEfWMPZKo4mxgu
+--- GTBCzHJYUKbpcgq7+0HzBpqvo0F7TNSPjFKqdRDUYDk
+ÈÚú¡T+ñ—êtµ(פÉF	ÆS<C386>/R±+¢¼Š¯‘âLÃÝcÁ‰·‹1
â<>
ÕwÝøº.iFd#TJ±clbâH€5(öï6)®y¯"
Ãà¼Î¿ž<C2BF>±~˺7!Õñ?(Qb
“]x(åÛ°Å1ÿðÃZsaôï<15>ûþåTÁ

secrets/secrets.nix

@@ -19,6 +19,10 @@ with roles;
   "hashed-robots-email-pw.age".publicKeys = email-server;
   "robots-email-pw.age".publicKeys = gitea;
 
+  # nix binary cache
+  # public key: s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU=
+  "binary-cache-private-key.age".publicKeys = binary-cache;
+
   # vpn
   "iodine.age".publicKeys = iodine;
   "pia-login.age".publicKeys = pia;