Official NixOS Wiki

Binary Cache: Difference between revisions

← Older edit
Axka (talk | contribs)
92 edits
VisualWikitext
fix some syntaxhighlight errors
Axka (talk | contribs)
92 edits
 
Line 112: Line 112:
This tutorial explains how to setup a machine as a binary cache for other machines, serving the nix store on TCP port 80 with signing turned on. It assumes that an {{ic|[[nginx]]}} service is already running, that port 80 is open,<ref group="cf."> {{manual:nixos|sec=#sec-firewall|chapter=11.5. Firewall}}</ref> and that the hostname {{ic|binarycache.example.com}} resolves to the server.<ref group="cf.">{{nixos:option|networking.hostName}}</ref>
This tutorial explains how to setup a machine as a binary cache for other machines, serving the nix store on TCP port 80 with signing turned on. It assumes that an {{ic|[[nginx]]}} service is already running, that port 80 is open,<ref group="cf."> {{manual:nixos|sec=#sec-firewall|chapter=11.5. Firewall}}</ref> and that the hostname {{ic|binarycache.example.com}} resolves to the server.<ref group="cf.">{{nixos:option|networking.hostName}}</ref>


=== 1. Generating a private/public keypair ===
=== 1. Generating a signing key ===


A keypair is necessary to sign Nix packages. Replace <code>binarycache.example.com</code> with your domain.
Follow the generation process at [[Signing store paths#Signing Key]], replacing the example hostname with your own. In this tutorial, {{ic|nix-serve}} signs packages on the fly when it serves them so any [[Nix (package manager)|Nix]] configuration isn't required.
 
{{bc|
cd /var
nix-store --generate-binary-cache-key binarycache.example.com cache-priv-key.pem cache-pub-key.pem
chown nix-serve cache-priv-key.pem
chmod 600 cache-priv-key.pem
cat cache-pub-key.pem
}}
 
The packages can be signed before adding them to the binary cache, or on the fly as they are served.
In this tutorial we'll set up {{ic|nix-serve}} to sign packages on the fly when it serves them.
In this case it is important that only {{ic|nix-serve}} can access the private key.
The location {{ic|/var/cache-priv-key.pem}} is just an example.


=== 2. Activating {{ic|nix-serve}} ===
=== 2. Activating {{ic|nix-serve}} ===


{{ic|nix-serve}} is the service that speaks the binary cache protocol via HTTP.
{{ic|nix-serve}} is the service that serves the binary cache protocol via HTTP.


To start it on NixOS:
To start it on NixOS:
<syntaxhighlight lang="nix">
<syntaxhighlight lang="nix">services.nix-serve = {
services.nix-serve = {
   enable = true;
   enable = true;
   secretKeyFile = "/var/cache-priv-key.pem";
 
};
  # Note: You don't need to give nix-serve ownership of the file because systemd reads it.
</syntaxhighlight>
   secretKeyFile = "/var/secrets/nix-cache-priv-key";
};</syntaxhighlight>


To start it on a non-NixOS machine at boot, add to {{ic|/etc/crontab}}:
To start it on a non-NixOS machine at boot, add to {{ic|/etc/crontab}}:
<syntaxhighlight lang="crontab">
<syntaxhighlight>
NIX_SECRET_KEY_FILE=/var/cache-priv-key.pem
NIX_SECRET_KEY_FILE=/var/secrets/nix-cache-priv-key
@reboot /home/USER/.nix-profile/bin/nix-serve --listen :5000 --error-log /var/log/nix-serve.log --pid /var/run/nix-serve.pid --user USER --daemonize
@reboot /home/USER/.nix-profile/bin/nix-serve --listen :5000 --error-log /var/log/nix-serve.log --pid /var/run/nix-serve.pid --user USER --daemonize
</syntaxhighlight>
</syntaxhighlight>
Line 183: Line 170:
=== 4. Testing ===
=== 4. Testing ===


To apply the previous settings to your NixOS machine, run:
To apply the previous settings to your NixOS machine, run:<syntaxhighlight lang="shell-session">
{{bc|# nixos-rebuild switch}}
# nixos-rebuild switch
 
</syntaxhighlight>Check the general availability:
Check the general availability:
<syntaxhighlight lang="shell-session">
<syntaxhighlight lang="bash">
$ curl http://binarycache.example.com/nix-cache-info
$ curl http://binarycache.example.com/nix-cache-info
StoreDir: /nix/store
StoreDir: /nix/store
Line 195: Line 181:


On the binary cache server, build some package:
On the binary cache server, build some package:
<syntaxhighlight lang="bash">
<syntaxhighlight lang="shell-session">
$ nix-build '<nixpkgs>' -A pkgs.hello
$ nix-build '<nixpkgs>' -A pkgs.hello
/nix/store/gdh8165b7rg4y53v64chjys7mbbw89f9-hello-2.10
/nix/store/gdh8165b7rg4y53v64chjys7mbbw89f9-hello-2.10
Line 201: Line 187:


To verify the signing on the fly, make sure the following request contains a {{ic|Sig:}} line:
To verify the signing on the fly, make sure the following request contains a {{ic|Sig:}} line:
<syntaxhighlight lang="bash">
<syntaxhighlight lang="shell-session">
$ curl http://binarycache.example.com/gdh8165b7rg4y53v64chjys7mbbw89f9.narinfo
$ curl http://binarycache.example.com/gdh8165b7rg4y53v64chjys7mbbw89f9.narinfo
StorePath: /nix/store/gdh8165b7rg4y53v64chjys7mbbw89f9-hello-2.10
StorePath: /nix/store/gdh8165b7rg4y53v64chjys7mbbw89f9-hello-2.10
Retrieved from "https://wiki.nixos.org/wiki/Binary_Cache"