Configuration for my NixOS based systems and Home Manager
Add nixery modules + config
+340
+4
host-specific/misaki/configuration.nix
+4
host-specific/misaki/configuration.nix
+2
host-specific/misaki/coredns/ngp.computer.hosts
+2
host-specific/misaki/coredns/ngp.computer.hosts
···
7
7
192.168.1.3 coder.ngp.computer
8
8
192.168.1.3 stats.ngp.computer
9
9
192.168.1.3 traces.ngp.computer
10
+
192.168.1.3 nixery.ngp.computer
10
11
192.168.1.6 odin.ngp.computer
11
12
12
13
fe80::9ab7:85ff:fe1e:dfe8 img.ngp.computer
···
18
19
fe80::9ab7:85ff:fe1e:dfe8 coder.ngp.computer
19
20
fe80::9ab7:85ff:fe1e:dfe8 stats.ngp.computer
20
21
fe80::9ab7:85ff:fe1e:dfe8 traces.ngp.computer
22
+
fe80::9ab7:85ff:fe1e:dfe8 nixery.ngp.computer
21
23
fe80::3af7:cdff:fec7:54f odin.ngp.computer
+24
host-specific/misaki/services.nix
+24
host-specific/misaki/services.nix
···
16
16
autoScrub.enable = true;
17
17
};
18
18
services.nfs.server.enable = true;
19
+
services.nixery = {
20
+
enable = true;
21
+
openFirewall = false;
22
+
port = 8080;
23
+
storage.backend = "filesystem";
24
+
storage.path = "/var/lib/nixery/storage";
25
+
packageSource = {
26
+
type = "path";
27
+
path = pkgs.path;
28
+
};
29
+
};
19
30
# Some programs need SUID wrappers, can be configured further or are
20
31
# started in user sessions.
21
32
# programs.mtr.enable = true;
···
530
541
"id.ngp.computer"
531
542
"coder.ngp.computer"
532
543
"stats.ngp.computer"
544
+
"nixery.ngp.computer"
533
545
]
534
546
(_: {
535
547
group = "httpd";
···
722
734
recommendedProxySettings = true;
723
735
recommendedTlsSettings = true;
724
736
737
+
upstreams.nixery.servers = {
738
+
"127.0.0.1:${toString config.services.nixery.port}" = { };
739
+
"192.168.1.6:80" = { };
740
+
};
741
+
725
742
virtualHosts."photos.ngp.computer" = {
726
743
enableACME = true;
727
744
acmeRoot = null;
···
796
813
http2 = true;
797
814
locations."/".proxyPass =
798
815
"http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
816
+
};
817
+
virtualHosts."nixery.ngp.computer" = {
818
+
forceSSL = true;
819
+
enableACME = true;
820
+
acmeRoot = null;
821
+
http2 = true;
822
+
locations."/".proxyPass = "http://nixery";
799
823
};
800
824
virtualHosts."knot.packetlost.dev" = {
801
825
forceSSL = true;
+5
host-specific/odin/configuration.nix
+5
host-specific/odin/configuration.nix
+24
host-specific/odin/services.nix
+24
host-specific/odin/services.nix
···
22
22
enable = true;
23
23
};
24
24
25
+
services.nixery = {
26
+
enable = true;
27
+
openFirewall = false;
28
+
port = 8080;
29
+
storage.backend = "filesystem";
30
+
storage.path = "/var/lib/nixery/storage";
31
+
packageSource = {
32
+
type = "path";
33
+
path = pkgs.path;
34
+
};
35
+
};
36
+
37
+
services.nginx = {
38
+
enable = true;
39
+
recommendedGzipSettings = true;
40
+
recommendedOptimisation = true;
41
+
recommendedProxySettings = true;
42
+
recommendedTlsSettings = true;
43
+
44
+
virtualHosts."nixery.ngp.computer" = {
45
+
locations."/".proxyPass = "http://localhost:${toString config.services.nixery.port}";
46
+
};
47
+
};
48
+
25
49
# Containers and VMs
26
50
virtualisation = {
27
51
podman = {
+252
modules/nixery.nix
+252
modules/nixery.nix
···
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
7
+
8
+
let
9
+
cfg = config.services.nixery;
10
+
11
+
sourceEnv =
12
+
{
13
+
path = {
14
+
NIXERY_PKGS_PATH = "/etc/nixery/nixpkgs";
15
+
};
16
+
channel = {
17
+
NIXERY_CHANNEL = cfg.packageSource.channel;
18
+
};
19
+
git = {
20
+
NIXERY_PKGS_REPO = cfg.packageSource.repo;
21
+
};
22
+
}
23
+
.${cfg.packageSource.type};
24
+
25
+
storageEnv =
26
+
{
27
+
filesystem = {
28
+
NIXERY_STORAGE_BACKEND = "filesystem";
29
+
STORAGE_PATH = cfg.storage.path;
30
+
};
31
+
gcs = {
32
+
NIXERY_STORAGE_BACKEND = "gcs";
33
+
GCS_BUCKET = cfg.storage.gcs.bucket;
34
+
}
35
+
// lib.optionalAttrs (cfg.storage.gcs.credentialsFile != null) {
36
+
GOOGLE_APPLICATION_CREDENTIALS = cfg.storage.gcs.credentialsFile;
37
+
};
38
+
s3 = {
39
+
NIXERY_STORAGE_BACKEND = "s3";
40
+
S3_BUCKET = cfg.storage.s3.bucket;
41
+
AWS_REGION = cfg.storage.s3.region;
42
+
S3_LINK_EXPIRATION = cfg.storage.s3.linkExpiration;
43
+
}
44
+
// lib.optionalAttrs (cfg.storage.s3.endpoint != null) {
45
+
S3_ENDPOINT = cfg.storage.s3.endpoint;
46
+
};
47
+
}
48
+
.${cfg.storage.backend};
49
+
50
+
environment = {
51
+
PORT = toString cfg.port;
52
+
NIX_TIMEOUT = toString cfg.timeout;
53
+
HOME = "/var/lib/nixery";
54
+
}
55
+
// sourceEnv
56
+
// storageEnv
57
+
// lib.optionalAttrs (cfg.popularityUrl != null) {
58
+
NIX_POPULARITY_URL = cfg.popularityUrl;
59
+
}
60
+
// cfg.extraEnvironment;
61
+
in
62
+
{
63
+
options.services.nixery = {
64
+
enable = lib.mkEnableOption "Nixery container registry";
65
+
66
+
package = lib.mkPackageOption pkgs "nixery" { };
67
+
68
+
port = lib.mkOption {
69
+
type = lib.types.port;
70
+
default = 8080;
71
+
description = "HTTP port for the Nixery registry.";
72
+
};
73
+
74
+
openFirewall = lib.mkOption {
75
+
type = lib.types.bool;
76
+
default = false;
77
+
description = "Whether to open the configured Nixery port in the firewall.";
78
+
};
79
+
80
+
timeout = lib.mkOption {
81
+
type = lib.types.ints.positive;
82
+
default = 60;
83
+
description = "Maximum number of seconds a single Nix builder may run.";
84
+
};
85
+
86
+
popularityUrl = lib.mkOption {
87
+
type = lib.types.nullOr lib.types.str;
88
+
default = null;
89
+
description = "Optional URL to Nix package popularity data for layer grouping.";
90
+
};
91
+
92
+
environmentFile = lib.mkOption {
93
+
type = lib.types.nullOr lib.types.path;
94
+
default = null;
95
+
description = "Optional environment file for secrets such as S3 credentials.";
96
+
};
97
+
98
+
extraEnvironment = lib.mkOption {
99
+
type = lib.types.attrsOf lib.types.str;
100
+
default = { };
101
+
description = "Additional environment variables passed to Nixery.";
102
+
};
103
+
104
+
packageSource = {
105
+
type = lib.mkOption {
106
+
type = lib.types.enum [
107
+
"path"
108
+
"channel"
109
+
"git"
110
+
];
111
+
default = "path";
112
+
description = "Source type for the nixpkgs package set served by Nixery.";
113
+
};
114
+
115
+
path = lib.mkOption {
116
+
type = lib.types.path;
117
+
default = pkgs.path;
118
+
defaultText = lib.literalExpression "pkgs.path";
119
+
description = "Local nixpkgs path used when packageSource.type is path.";
120
+
};
121
+
122
+
channel = lib.mkOption {
123
+
type = lib.types.str;
124
+
default = "nixos-unstable";
125
+
description = "Nixpkgs channel or commit used when packageSource.type is channel.";
126
+
};
127
+
128
+
repo = lib.mkOption {
129
+
type = lib.types.str;
130
+
default = "https://github.com/NixOS/nixpkgs.git";
131
+
description = "Git repository used when packageSource.type is git.";
132
+
};
133
+
};
134
+
135
+
storage = {
136
+
backend = lib.mkOption {
137
+
type = lib.types.enum [
138
+
"filesystem"
139
+
"gcs"
140
+
"s3"
141
+
];
142
+
default = "filesystem";
143
+
description = "Storage backend for Nixery build cache and image layers.";
144
+
};
145
+
146
+
path = lib.mkOption {
147
+
type = lib.types.str;
148
+
default = "/var/lib/nixery/storage";
149
+
description = "Filesystem storage path used when storage.backend is filesystem.";
150
+
};
151
+
152
+
gcs = {
153
+
bucket = lib.mkOption {
154
+
type = lib.types.str;
155
+
default = "";
156
+
description = "Google Cloud Storage bucket used when storage.backend is gcs.";
157
+
};
158
+
159
+
credentialsFile = lib.mkOption {
160
+
type = lib.types.nullOr lib.types.path;
161
+
default = null;
162
+
description = "Optional service account JSON file for signed GCS URLs.";
163
+
};
164
+
};
165
+
166
+
s3 = {
167
+
bucket = lib.mkOption {
168
+
type = lib.types.str;
169
+
default = "";
170
+
description = "S3 bucket used when storage.backend is s3.";
171
+
};
172
+
173
+
endpoint = lib.mkOption {
174
+
type = lib.types.nullOr lib.types.str;
175
+
default = null;
176
+
description = "Optional S3-compatible endpoint.";
177
+
};
178
+
179
+
region = lib.mkOption {
180
+
type = lib.types.str;
181
+
default = "us-east-1";
182
+
description = "AWS region for the S3 bucket.";
183
+
};
184
+
185
+
linkExpiration = lib.mkOption {
186
+
type = lib.types.str;
187
+
default = "5m";
188
+
description = "Duration for pre-signed S3 layer URLs.";
189
+
};
190
+
};
191
+
};
192
+
};
193
+
194
+
config = lib.mkIf cfg.enable {
195
+
assertions = [
196
+
{
197
+
assertion = cfg.storage.backend != "gcs" || cfg.storage.gcs.bucket != "";
198
+
message = "services.nixery.storage.gcs.bucket must be set when using GCS storage.";
199
+
}
200
+
{
201
+
assertion = cfg.storage.backend != "s3" || cfg.storage.s3.bucket != "";
202
+
message = "services.nixery.storage.s3.bucket must be set when using S3 storage.";
203
+
}
204
+
];
205
+
206
+
users.groups.nixery = { };
207
+
users.users.nixery = {
208
+
isSystemUser = true;
209
+
group = "nixery";
210
+
home = "/var/lib/nixery";
211
+
createHome = true;
212
+
};
213
+
214
+
systemd.tmpfiles.rules = lib.mkIf (cfg.storage.backend == "filesystem") [
215
+
"d ${cfg.storage.path} 0750 nixery nixery - -"
216
+
];
217
+
218
+
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
219
+
220
+
environment.etc."nixery/nixpkgs" = lib.mkIf (cfg.packageSource.type == "path") {
221
+
source = cfg.packageSource.path;
222
+
};
223
+
224
+
systemd.services.nixery = {
225
+
description = "Nixery container registry";
226
+
after = [ "network-online.target" ];
227
+
wants = [ "network-online.target" ];
228
+
wantedBy = [ "multi-user.target" ];
229
+
230
+
inherit environment;
231
+
232
+
path = [
233
+
pkgs.git
234
+
pkgs.nix
235
+
pkgs.openssh
236
+
];
237
+
238
+
serviceConfig = {
239
+
ExecStart = "${lib.getExe' cfg.package "server"}";
240
+
EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
241
+
StateDirectory = "nixery";
242
+
WorkingDirectory = "/var/lib/nixery";
243
+
User = "nixery";
244
+
Group = "nixery";
245
+
Restart = "on-failure";
246
+
RestartSec = "10s";
247
+
NoNewPrivileges = true;
248
+
PrivateTmp = true;
249
+
};
250
+
};
251
+
};
252
+
}
+29
overlays/nixery.nix
+29
overlays/nixery.nix
···
1
+
final: prev:
2
+
3
+
let
4
+
rev = "7eb6caf6c9de3d760351edaa9cb78debe4221dbd";
5
+
6
+
src = prev.fetchgit {
7
+
url = "https://code.tvl.fyi/depot.git:/tools/nixery.git";
8
+
inherit rev;
9
+
hash = "sha256-zIZ8M61IVdFjynoJePXyg4hILX/+rWupDOiK1+EJkeY=";
10
+
};
11
+
12
+
depotStub = {
13
+
nix.readTree.drvTargets = x: x;
14
+
tools.releases.filteredGitPush = _: { };
15
+
};
16
+
17
+
nixeryPackages = import src {
18
+
pkgs = final;
19
+
depot = depotStub;
20
+
};
21
+
in
22
+
{
23
+
inherit nixeryPackages;
24
+
25
+
nixery = nixeryPackages.nixery;
26
+
nixery-image = nixeryPackages.nixery-image;
27
+
nixery-popcount = nixeryPackages.nixery-popcount;
28
+
nixery-prepare-image = nixeryPackages.nixery-prepare-image;
29
+
}