This repository has no description
configs.nix-farm: don't push paths cache.nixos.org serves
Builders pushed every path of a closure, including everything they had
substituted from cache.nixos.org: 9.9 of 10.3 GiB for ignavia. niks3 now
comes from a fork (lassulus/niks3) with `push --ignore-upstream-key`,
and neoprism's daemon and the CI farm pass cache.nixos.org-1 to it.
cache.lassul.us no longer holds complete closures on its own: clients
need cache.nixos.org next to it, which every machine has.
author
lassulus
date
(Oct 12, 2026, 7:28 AM CEST)
commit
738d515d
738d515dc2aec3972e4a8caf408561f49a56851d
parent
2c81e8e8
2c81e8e84ab673f14a056207da33491d9335f5cd
+17
-7
+5
-5
flake.lock
+5
-5
flake.lock
···
561
561
]
562
562
},
563
563
"locked": {
564
-
"lastModified": 1791698001,
565
-
"narHash": "sha256-w2WpjabRT4UeEFKN8r0gm5JHQPZFI4mB3y/fW9t/ve0=",
566
-
"owner": "Mic92",
564
+
"lastModified": 1791782818,
565
+
"narHash": "sha256-a9ps1IFkL2ynoUnKb1t/9VvfMYFMd4oLxq7JlqqotK4=",
566
+
"owner": "lassulus",
567
567
"repo": "niks3",
568
-
"rev": "2d5a6b14e0df5c8fecc27571b79c40563c98ec32",
568
+
"rev": "96bb25d227672be9a1fc46da43baf0d0cc2bebd0",
569
569
"type": "github"
570
570
},
571
571
"original": {
572
-
"owner": "Mic92",
572
+
"owner": "lassulus",
573
573
"repo": "niks3",
574
574
"type": "github"
575
575
}
+5
-2
flake.nix
+5
-2
flake.nix
···
118
118
nix-grpc-store.inputs.nixpkgs.follows = "nixpkgs";
119
119
nix-grpc-store.inputs.niks3.follows = "niks3";
120
120
121
-
# ... and the S3-backed binary cache the outputs land in
122
-
niks3.url = "github:Mic92/niks3";
121
+
# ... and the S3-backed binary cache the outputs land in. Fork for
122
+
# `push --ignore-upstream-key` (not upstream yet). It rebases onto
123
+
# Mic92/niks3 daily (its .github/workflows/rebase-upstream.yml), so
124
+
# `nix flake update niks3` follows upstream.
125
+
niks3.url = "github:lassulus/niks3";
123
126
niks3.inputs.nixpkgs.follows = "nixpkgs";
124
127
niks3.inputs.treefmt-nix.follows = "treefmt-nix";
125
128
+5
configs/nix-farm/builder.nix
+5
configs/nix-farm/builder.nix
···
73
73
publicKeys = lib.optional (builtins.pathExists cachePub) (
74
74
lib.removeSuffix "\n" (builtins.readFile cachePub)
75
75
);
76
+
# cache.nixos.org keeps serving what it signed; only push our own paths
77
+
pushFlags = [
78
+
"--ignore-upstream-key"
79
+
"cache.nixos.org-1"
80
+
];
76
81
};
77
82
};
78
83
+2
tools/ci-farm/ci-farm.sh
+2
tools/ci-farm/ci-farm.sh