beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move nix-cache's binary cache signing key into sops
Check NixOS configurations / eval-hosts (push) Failing after 10m50s
Details

Browse Source 
nix-serve's secretKeyFile was a manual, undocumented-outside-a-comment
`nix-store --generate-binary-cache-key` step per host -- easy to miss on
a fresh nix-cache instance (as lxc-nix-cache testing just found: systemd
fails the unit with EXIT_CREDENTIALS when LoadCredential can't find the
source file, which nginx then reports as a 502 from clients). It also
can't be regenerated per-host safely: modules/nix-cache/client.nix
hardcodes every client's trust in one specific public key, so every
nix-cache instance has to share the exact same keypair.

Sourced from secrets/nix-cache.yaml's new cache-priv-key entry instead,
via the same sops-nix pattern every other secret in this repo already
uses. Verified the added value derives to the exact public key
modules/nix-cache/client.nix already trusts before committing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot
This commit is contained in:
beatzaplenty
2026-07-20 09:49:30 +10:00
co-authored by Claude Sonnet 5
parent 87eb8f7c39
commit 0e5aa044c0
3 changed files with 42 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/nix-cache/server.nix
+11 -9
View File
@@ -1,18 +1,20 @@
{ config, pkgs, vars, ... }:
{
# Generate the binary cache key pair on the nix-cache host:
# sudo install -d -m 0700 /etc/nix
# sudo nix-store --generate-binary-cache-key nix-cache-1 \
# /etc/nix/cache-priv.pem \
# /etc/nix/cache-pub.pem
# sudo chmod 0600 /etc/nix/cache-priv.pem
# sudo chmod 0644 /etc/nix/cache-pub.pem
# cat /etc/nix/cache-pub.pem
# nix-serve's signing key has to be the *same* key on every host that
# ever plays the nix-cache role -- modules/nix-cache/client.nix hardcodes
# every client's trust in one specific public key ("cache.local-1:..."),
# so a freshly self-generated key here wouldn't be trusted by anyone.
# Managed via sops-nix like every other secret in this repo instead of
# the old manual `nix-store --generate-binary-cache-key` step -- see
# "Binary cache signing key" in docs/nix-cache.md for how to add/rotate
# the value in secrets/nix-cache.yaml.
sops.secrets."cache-priv-key".sopsFile = ../../secrets/nix-cache.yaml;
services = {
nix-serve = {
enable = true;
secretKeyFile = "/etc/nix/cache-priv.pem";
secretKeyFile = config.sops.secrets."cache-priv-key".path;
};
nginx = {