blob: 8bbfb09bba706ef9a4a814154e691ddb66cb3c66 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
|
# the public key for the current iteration of this cache is:
# cache.rnrd.eu-1:6Q2MPTZ6ycAzWcc0VzXR+pKRlJ+6kfdQfj6iRsN5s1I=
{ config, unstablePkgs, ... }:
let
inherit (config.age) secrets;
cachePort = 3138;
in
{
age.secrets.binary-cache-key = {
file = ../secrets/binary-cache-key.age;
};
services = {
harmonia = {
enable = true;
# 24.11 does not include built-in zstd compression for harmonia yet.
package = unstablePkgs.harmonia;
signKeyPaths = [ secrets.binary-cache-key.path ];
settings = {
bind = "127.0.0.1:${toString cachePort}";
workers = 6;
priority = 33;
};
};
nginx.virtualHosts."cache.rnrd.eu" = {
useACMEHost = "rnrd.eu";
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:${toString cachePort}";
# i'm not sure whether harmonia actually does anything
# with websockets, but their example includes nginx settings
# that can be toggled on with this setting.
# see: https://github.com/nix-community/harmonia#configuration-for-public-binary-cache-on-nixos
proxyWebsockets = true;
};
extraConfig = ''
proxy_redirect http:// https://;
access_log /var/log/nginx/cache.access.log json_combined;
'';
};
};
}
|
