From 8d6ad63094049cbc379af71d09920c34072c5111 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Sun, 19 Jul 2026 15:27:12 +1000 Subject: [PATCH] Wire nix-cache as a substituter into the installer image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Without this the installer only ever sees cache.nixos.org, which doesn't carry sops-install-secrets — it's built straight from the sops-nix flake's own Go source, not part of nixpkgs. Every install had to compile it from scratch, which is what ran an 8GB LXC container's disk out of space (Go toolchain fetch plus a large module tree of small files, all on the same disk that needs to hold the rest of the system). Once sops-install-secrets has been built once anywhere and served via the existing nix-cache/nix-serve setup (naturally happens the next time nix-cache itself gets switched with the sops-nix changes), every future install of any type fetches the pre-built binary instead of rebuilding. Co-Authored-By: Claude Sonnet 5 --- common.nix | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/common.nix b/common.nix index 3cdb883..843b344 100644 --- a/common.nix +++ b/common.nix @@ -5,6 +5,24 @@ time.timeZone = "Australia/Brisbane"; + # Without this, the installer only ever sees cache.nixos.org, which + # doesn't carry sops-install-secrets (it's built straight from the + # sops-nix flake's own Go source, not part of nixpkgs) — every install + # would otherwise compile it from scratch, which is what ran an 8GB LXC + # container's disk out of space. Push a built copy to nix-cache once + # (from a machine with real disk headroom) and every future install, + # of any type, fetches instead of rebuilding. + nix.settings = { + substituters = [ + "http://nix-cache" + "https://cache.nixos.org/" + ]; + trusted-public-keys = [ + "cache.local-1:usoWYanY3Kpq2+kDIS2nhWoLZiRxanmdysdzqCFBHW4=" + "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" + ]; + }; + environment.systemPackages = with pkgs; [ git curl