nix

configuration files that power my machines
Log | Files | Refs | README | LICENSE

harmonia.nix (2812B)

      1 {
      2   config,
      3   lib,
      4   haravara,
      5   ...
      6 }: let
      7   cfg = config.services.haravara.harmonia;
      8 in {
      9   options.services.haravara.harmonia = {
     10     enable = lib.mkEnableOption "Harmonia Nix binary cache";
     11     domain = lib.mkOption {
     12       type = lib.types.str;
     13       description = "Domain name for the Harmonia cache";
     14     };
     15     authLabel = haravara.authLabelOption;
     16     signKeyPaths = lib.mkOption {
     17       type = lib.types.listOf lib.types.path;
     18       default = [];
     19       description = "Paths to signing key files for the binary cache";
     20     };
     21     enableCompression = lib.mkOption {
     22       type = lib.types.bool;
     23       default = false;
     24       description = "Enable transparent compression with zstd";
     25     };
     26     priority = lib.mkOption {
     27       type = lib.types.int;
     28       default = 30;
     29       description = "Binary cache priority advertised in /nix-cache-info";
     30     };
     31     port = lib.mkOption {
     32       type = lib.types.port;
     33       default = 5000;
     34       description = "Port for Harmonia to listen on";
     35     };
     36     basicAuth = lib.mkOption {
     37       type = lib.types.nullOr (lib.types.submodule {
     38         options = {
     39           user = lib.mkOption {
     40             type = lib.types.str;
     41             description = "Basic auth username";
     42           };
     43           hash = lib.mkOption {
     44             type = lib.types.str;
     45             description = "Basic auth password hash (Caddy-compatible)";
     46           };
     47         };
     48       });
     49       default = null;
     50       description = "Basic auth configuration";
     51     };
     52   };
     53 
     54   config = lib.mkIf cfg.enable {
     55     services.harmonia.cache = {
     56       enable = true;
     57       inherit (cfg) signKeyPaths;
     58       settings = {
     59         bind = "127.0.0.1:${toString cfg.port}";
     60         workers = 4;
     61         max_connection_rate = 256;
     62         inherit (cfg) priority;
     63         enable_compression = cfg.enableCompression;
     64       };
     65     };
     66 
     67     services.caddy.virtualHosts."${cfg.domain}".extraConfig =
     68       (lib.optionalString (cfg.basicAuth != null) ''
     69         basic_auth {
     70           ${cfg.basicAuth.user} ${cfg.basicAuth.hash}
     71         }
     72       '')
     73       + ''
     74         # Handle Nix cache requests
     75         @nix_cache_paths {
     76           path /nix-cache-info
     77           path *.narinfo
     78           path *.nar
     79           path /serve/*
     80         }
     81 
     82         handle @nix_cache_paths {
     83           reverse_proxy 127.0.0.1:${toString cfg.port}
     84         }
     85 
     86         # Optional: serve package content directly
     87         @serve_paths {
     88           path_regexp ^/serve/(?P<hash>[a-z0-9]+)/.*
     89         }
     90 
     91         handle @serve_paths {
     92           reverse_proxy 127.0.0.1:${toString cfg.port}
     93         }
     94       '';
     95 
     96     nix.settings.allowed-users = ["harmonia"];
     97 
     98     systemd.tmpfiles.rules = lib.concatLists [
     99       ["d /var/lib/harmonia 0750 harmonia harmonia -"]
    100       (map (keyPath: "f ${keyPath} 0400 harmonia harmonia -") cfg.signKeyPaths)
    101     ];
    102   };
    103 }