Nix flake configuration for my various machines (clients and homelab servers)
sign before push to cache
Parthiv Krishna
(Jun 22, 2026, 6:39 AM UTC)
1645cee8
7ba4f8b6
+18
-5
+6
-1
.github/workflows/nixos-build.yaml
+6
-1
.github/workflows/nixos-build.yaml
···
26
26
build-dir = /nix/build
27
27
extra-platforms = aarch64-linux
28
28
extra-substituters = https://cache.flox.dev?priority=30
29
-
extra-trusted-public-keys = flox-cache-public-1:7F4OyH7ZCnFhcze3fJdfyXYLQw/aV7GEed86nQ7IsOs=
29
+
extra-trusted-public-keys = flox-cache-public-1:7F4OyH7ZCnFhcze3fJdfyXYLQw/aV7GEed86nQ7IsOs= github-ci-1:0fNXOmbysSbsQNRgkqPDwxyDIFZwquLmnk/7gNrx/Us=
30
30
fallback = true
31
31
connect-timeout = 5
32
32
- name: Load SSH private key for secrets repo
···
51
51
nix build --fallback --no-link .#nixosConfigurations.${{ matrix.host }}.config.system.build.toplevel
52
52
- name: Push to cache
53
53
continue-on-error: true
54
+
env:
55
+
CACHE_SIGNING_KEY: ${{ secrets.CACHE_SIGNING_KEY }}
54
56
run: |
55
57
path=$(nix path-info .#nixosConfigurations.${{ matrix.host }}.config.system.build.toplevel)
58
+
printf '%s' "$CACHE_SIGNING_KEY" > /tmp/signing-key.pem
59
+
nix store sign --key-file /tmp/signing-key.pem --recursive "$path"
60
+
rm /tmp/signing-key.pem
56
61
nix copy --to ssh-ng://nix-cache@cache.sub0.net "$path"
57
62
ssh nix-cache@cache.sub0.net "nix-store --add-root /nix/var/nix/gcroots/cache/${{ matrix.host }} -r $path"
+2
modules/features/meta/nix.nix
+2
modules/features/meta/nix.nix
···
13
13
cacheFqdn = lib.custom.mkPublicFqdn config.constants "cache";
14
14
# nix-store --generate-binary-cache-key <cacheFqdn>-1 signing-key.private signing-key.public
15
15
cachePublicKey = "${cacheFqdn}-1:x8wTeYCstMWT0jwzccBr3IT8V2DXqRKu8k/KUv5nW4Q=";
16
+
ciPublicKey = "github-ci-1:0fNXOmbysSbsQNRgkqPDwxyDIFZwquLmnk/7gNrx/Us=";
16
17
in
17
18
{
18
19
nix.settings = {
···
29
30
trusted-public-keys = [
30
31
"flox-cache-public-1:7F4OyH7ZCnFhcze3fJdfyXYLQw/aV7GEed86nQ7IsOs="
31
32
cachePublicKey
33
+
ciPublicKey
32
34
];
33
35
34
36
# fallback if our cache goes offline
+10
-4
modules/features/selfhosted/harmonia.nix
+10
-4
modules/features/selfhosted/harmonia.nix
···
2
2
{ lib }:
3
3
let
4
4
port = 5000;
5
+
ciPublicKey = "github-ci-1:0fNXOmbysSbsQNRgkqPDwxyDIFZwquLmnk/7gNrx/Us=";
5
6
in
6
7
lib.custom.mkSelfHostedFeature {
7
8
name = "harmonia";
···
39
40
};
40
41
users.groups.nix-cache = { };
41
42
42
-
# allow nix-cache user to push to the nix store and create GC roots
43
-
nix.settings.trusted-users = [ "nix-cache" ];
43
+
nix.settings = {
44
+
# allow nix-cache user to push to the nix store and create GC roots
45
+
trusted-users = [ "nix-cache" ];
46
+
47
+
# trust CI-signed paths so GitHub Actions can push locally-built paths
48
+
trusted-public-keys = [ ciPublicKey ];
44
49
45
-
# sign store paths when they're pushed via `nix copy`
46
-
nix.settings.secret-key-files = [ config.sops.secrets."${secretsRoot}/signing-key".path ];
50
+
# sign store paths when they're pushed via `nix copy`
51
+
secret-key-files = [ config.sops.secrets."${secretsRoot}/signing-key".path ];
52
+
};
47
53
48
54
# Pre-create GC roots directory owned by nix-cache so CI can create roots without sudo
49
55
systemd.tmpfiles.rules = [