This repository has no description
4.2 kB
123 lines
1{
2 config,
3 pkgs,
4 self,
5 ...
6}:
7let
8 # TODO: create this bucket (public) + an application key for it in B2
9 bucket = "lassulus-nix-cache";
10 region = "eu-central-003";
11 endpoint = "s3.${region}.backblazeb2.com";
12
13 vars = config.clan.core.vars.generators;
14in
15{
16 imports = [ self.inputs.niks3.nixosModules.niks3 ];
17
18 # B2 credentials (prompted), the niks3 API token (generated; one copy per
19 # service user that reads it).
20 clan.core.vars.generators.niks3 = {
21 prompts.b2_key_id = {
22 description = "Backblaze B2 keyID with access to the ${bucket} bucket";
23 type = "line";
24 };
25 prompts.b2_application_key = {
26 description = "Backblaze B2 applicationKey for that keyID";
27 type = "hidden";
28 };
29 files."s3-access-key".owner = "niks3";
30 files."s3-secret-key".owner = "niks3";
31 files."api-token".owner = "niks3";
32 files."api-token-grpc".owner = "nix-grpc-daemon";
33 runtimeInputs = [
34 pkgs.coreutils
35 pkgs.openssl
36 ];
37 script = ''
38 tr -d '\n' < "$prompts/b2_key_id" > "$out/s3-access-key"
39 tr -d '\n' < "$prompts/b2_application_key" > "$out/s3-secret-key"
40 openssl rand -hex 32 | tr -d '\n' > "$out/api-token"
41 cp "$out/api-token" "$out/api-token-grpc"
42 '';
43 };
44
45 # Public half is read by configs/default.nix from the vars dir.
46 clan.core.vars.generators.nix-cache-signing = {
47 files."key.sec".owner = "niks3";
48 files."key.pub".secret = false;
49 runtimeInputs = [ pkgs.nix ];
50 script = ''
51 nix --extra-experimental-features nix-command key generate-secret \
52 --key-name cache.lassul.us-1 > "$out/key.sec"
53 nix --extra-experimental-features nix-command key convert-secret-to-public \
54 < "$out/key.sec" > "$out/key.pub"
55 '';
56 };
57
58 services.niks3 = {
59 enable = true;
60 s3 = {
61 inherit endpoint bucket region;
62 accessKeyFile = vars.niks3.files."s3-access-key".path;
63 secretKeyFile = vars.niks3.files."s3-secret-key".path;
64 };
65 apiTokenFile = vars.niks3.files."api-token".path;
66 signKeyFiles = [ vars.nix-cache-signing.files."key.sec".path ];
67 cacheUrl = "https://cache.lassul.us";
68 # The CI build farm (tools/ci-farm) pushes with the job's GitHub OIDC
69 # token. Fork PRs don't get one.
70 oidc.providers.github = {
71 issuer = "https://token.actions.githubusercontent.com";
72 audience = "https://niks3.lassul.us";
73 boundClaims.repository = [ "lassulus/superconfig" ];
74 };
75 nginx = {
76 enable = true;
77 domain = "niks3.lassul.us";
78 };
79 };
80
81 # Reads straight from the public bucket. niks3 uploads the metadata
82 # zstd-compressed with Content-Encoding: zstd; set it here so nix decodes
83 # it whether or not the bucket hands the header back. Same rules as
84 # clan-infra's Fastly config (modules/terranix/cache-new.nix): narinfo, .ls,
85 # realisations/ and log/. NARs (nar/*.nar.zst) are plain objects, nix
86 # decodes them via the narinfo's Compression field.
87 # `resolve`: looked up at runtime via resolved's stub, so an unresolvable
88 # B2 at startup doesn't keep nginx (and every other vhost) from starting.
89 services.nginx.appendHttpConfig = ''
90 upstream cache_lassul_us_b2 {
91 zone cache_lassul_us_b2 64k;
92 resolver 127.0.0.53 ipv6=off;
93 server ${endpoint}:443 resolve;
94 }
95 map $uri $cache_lassul_us_encoding {
96 default "";
97 ~\.(narinfo|ls)$ zstd;
98 ~^/realisations/ zstd;
99 ~^/log/ zstd;
100 }
101 '';
102 services.nginx.virtualHosts."cache.lassul.us" = {
103 enableACME = true;
104 forceSSL = true;
105 locations."/".extraConfig = ''
106 proxy_pass https://cache_lassul_us_b2/${bucket}/;
107 proxy_set_header Host ${endpoint};
108 proxy_ssl_server_name on;
109 proxy_ssl_name ${endpoint};
110 # cache keys never have a query string; don't forward one to S3
111 set $args "";
112 # S3 answers 403 for keys missing from a bucket it won't list
113 proxy_intercept_errors on;
114 error_page 403 =404 @notfound;
115
116 gzip off;
117 proxy_hide_header Content-Encoding;
118 # only sent on 2xx/3xx, and not at all when the map yields ""
119 add_header Content-Encoding $cache_lassul_us_encoding;
120 '';
121 locations."@notfound".return = "404";
122 };
123}