Add nix-cache client config script for non-NixOS Debian machines #17

2026-07-20T15:10:22Z

beatzaplenty commented

2026-07-20 15:10:22 +00:00

Summary

New scripts/configure-nix-cache-client.sh: the non-NixOS equivalent of modules/nix-cache/client.nix/remote-builder-client.nix -- run as root on a plain Debian machine with the Nix package manager installed to add nix-cache as a substituter in /etc/nix/nix.conf (via extra-substituters/extra-trusted-public-keys, layering on top of existing config instead of clobbering it), with https://cache.nixos.org/ kept as fallback if nix-cache is unreachable. If /root/.ssh/nixremote is already installed, also configures it as a distributed-build machine and trusts nix-cache's SSH host key. Idempotent (marker-block replace on re-run).
Wired into scripts/create-proxmox-resource.sh: the first time it bootstraps Nix tooling on a fresh Proxmox node (not on every run, and not inside codex-setup.sh/codex-maintenance.sh themselves), it now also runs this script there, non-fatally, so the node substitutes from / can offload builds to nix-cache on every subsequent run.
CLAUDE.md updated to document both.

Test plan

bash -n on both changed/new scripts
Exercised configure-nix-cache-client.sh against a scratch /etc-style dir: no-remote-builder-key path, full remote-builder path, and a second run to confirm the marker block replaces in place rather than duplicating (nix.conf block + known_hosts line both stayed single-copy)
Not run against a real Debian/Proxmox host (needs operator's own SSH/root access per repo safety rules)

🤖 Generated with Claude Code

## Summary - New `scripts/configure-nix-cache-client.sh`: the non-NixOS equivalent of `modules/nix-cache/client.nix`/`remote-builder-client.nix` -- run as root on a plain Debian machine with the Nix package manager installed to add nix-cache as a substituter in `/etc/nix/nix.conf` (via `extra-substituters`/`extra-trusted-public-keys`, layering on top of existing config instead of clobbering it), with `https://cache.nixos.org/` kept as fallback if nix-cache is unreachable. If `/root/.ssh/nixremote` is already installed, also configures it as a distributed-build machine and trusts nix-cache's SSH host key. Idempotent (marker-block replace on re-run). - Wired into `scripts/create-proxmox-resource.sh`: the first time it bootstraps Nix tooling on a fresh Proxmox node (not on every run, and not inside `codex-setup.sh`/`codex-maintenance.sh` themselves), it now also runs this script there, non-fatally, so the node substitutes from / can offload builds to nix-cache on every subsequent run. - CLAUDE.md updated to document both. ## Test plan - [x] `bash -n` on both changed/new scripts - [x] Exercised `configure-nix-cache-client.sh` against a scratch `/etc`-style dir: no-remote-builder-key path, full remote-builder path, and a second run to confirm the marker block replaces in place rather than duplicating (nix.conf block + known_hosts line both stayed single-copy) - [ ] Not run against a real Debian/Proxmox host (needs operator's own SSH/root access per repo safety rules) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

beatzaplenty added 2 commits 2026-07-20 15:10:28 +00:00

Add script to configure nix-cache as substituter/remote builder on Debian clients 23b910a011

Non-NixOS machines with just the Nix package manager installed have no
module system to pick up modules/nix-cache/client.nix, so this edits
/etc/nix/nix.conf directly (extra-substituters/extra-trusted-public-keys,
plus the SSH remote-builder config once the nixremote key is installed),
falling back to cache.nixos.org when nix-cache is unreachable.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Wire configure-nix-cache-client.sh into create-proxmox-resource.sh's tooling bootstrap

Check NixOS configurations / eval-hosts (pull_request) Failing after 11m15s

Details

af0fe5bdfd

Run it once, right after a node's first-time Nix bootstrap (not on every
invocation, and not inside codex-setup.sh/codex-maintenance.sh themselves),
so a freshly-bootstrapped Proxmox node substitutes from and can offload
builds to nix-cache on every subsequent run. Non-fatal on failure -- the
build still proceeds, just without nix-cache.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

beatzaplenty marked the pull request as work in progress 2026-07-20 15:13:52 +00:00

beatzaplenty marked the pull request as ready for review 2026-07-20 15:14:43 +00:00

beatzaplenty merged commit 03137eef9a into main

2026-07-20 15:14:59 +00:00

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#17