Evaluate Athens proxy for private Go modules in Nix sandbox

[LarsArtmann]

Context

Currently, 4 private repos cannot be fetched inside the Nix sandbox:

• github.com/larsartmann/go-cqrs-lite (most-used: ~950 imports across codebase)
• github.com/larsartmann/go-finding (49 imports)
• github.com/larsartmann/go-structure-linter
• github.com/LarsArtmann/go-commit

The Go public proxy (proxy.golang.org) returns 404 for these. In the Nix sandbox (no SSH keys, no git auth), buildGoModule's go mod vendor fails:

fatal: could not read Username for 'https://github.com': terminal prompts disabled

Impact

~10 projects have vendorHash = lib.fakeHash because they can't compute the real hash:

• accountability-system
• Kernovia
• auto-deduplicate
• e-invoicing (demo-server)
• BuildFlow (external tools)

Current workaround: go build ./... for local dev (no nix build).

Why GOPRIVATE Was Already Fixed

The old GOPRIVATE=github.com/LarsArtmann/* wildcard was narrowed to only the 4 private repos in home-base.nix. The 7+ public repos (go-branded-id, go-error-family, go-output, httputil, templ-components, gogenfilter, samber-do-auditlog) now download from proxy.golang.org normally.

Proposed Solution: Athens

Athens is a self-hosted Go module proxy that:

1. Fetches modules from GitHub via a configured token (SSH or PAT)
2. Caches them permanently to disk/S3
3. Serves them over plain HTTP — no SSH keys needed in the sandbox

Nix sandbox (no SSH) → Athens (has GitHub PAT) → GitHub
                            ↓
                      Cache (never re-fetches)

Setup Options

Option A: NixOS module on evo-x2

services.athens = {
  enable = true;
  storageType = "disk";
  config = {
    GithubTokenFile = "/run/secrets/athens-github-token";
  };
};

Then set in project flakes:

overrideModAttrs = _: {
  GOPROXY = "https://athens.lars.software,https://proxy.golang.org,direct";
};

Option B: Make the 4 repos public (simplest if no secrets in history)

Option C: Keep vendorHash = null + committed vendor/ dirs (what project-dependency-graph and bank-sync already do, but vendor dirs can be 200MB+)

Decision Needed

• Evaluate Athens vs making repos public
• If Athens: which host, what storage backend, auth strategy
• If public: audit for secrets first

References

• Full analysis: docs/nix-flake-review-2026-07-10.md
• Athens docs: https://docs.gomods.io
• Affected projects: accountability-system, Kernovia, auto-deduplicate, e-invoicing, BuildFlow

[LarsArtmann]

Codebase Assessment

Confirmed: no Athens references exist yet, and GOPRIVATE is already narrowed to exactly these 4 repos in platforms/common/home-base.nix.

This is a real infrastructure gap — ~10 LarsArtmann projects use vendorHash = lib.fakeHash because the sandbox can't fetch private modules. The three options remain valid:

Option	Verdict
A: Athens on evo-x2	Most robust long-term — one service solves it for ALL projects. Adds maintenance surface (storage, token rotation, uptime).
B: Make repos public	Simplest, zero infra. Requires a secrets audit of git history first.
C: Committed vendor dirs	Already used by some projects (project-dependency-graph, bank-sync). Works but 200MB+ dirs and merge conflicts.

Leaving open pending a decision on which path to pursue.

[LarsArtmann]

Resource Footprint Analysis

Athens is lightweight for our use case (4 private repos):

Dimension	Estimate	Notes
RAM (idle)	~50–100 MB	Single Go binary. Trivial on 128 GB.
RAM (active fetch)	+50–150 MB transient	Scales with GoGetWorkers (default 10, can lower to 3).
Disk (binary)	~75 MB	Static binary (CGO_ENABLED=0).
Disk (cache)	1–2 GB realistic	4 repos × ~1000 total versions. Grows slowly.
CPU	Near-zero idle	Brief spikes during module fetch, then idle.

No database required — disk storage is a flat filesystem under /var/lib/athens. No Mongo, Redis, or external deps.

Implementation Cost

The NixOS module already exists in nixpkgs (services.athens in services/development/athens.nix). It's pre-hardened: DynamicUser, ProtectSystem, PrivateTmp, NoNewPrivileges. For our use case:

services.athens = {
  enable = true;
  storageType = "disk";
  storage.disk.rootPath = "/var/lib/athens";
  githubToken = "/run/secrets/athens-github-token";  # GitHub PAT
  goGetWorkers = 3;  # evo-x2 doesn't need 10
};

Plus a Caddy vHost (athens.${domain}), a GitHub PAT in sops, and a Gatus health check. Total setup: ~30 minutes.

Ongoing Maintenance

• Token rotation: GitHub PAT every 90 days (or fine-grained token with no expiry)
• Disk cleanup: Athens has no built-in eviction. For 4 repos this is a non-issue — years to reach 1 GB.
• Updates: Handled by nix flake update. Athens v0.18.0 is stable, infrequent releases.

Compared to Option B (Make Repos Public)

	Athens	Make Repos Public
Runtime cost	~200 MB peak RAM, <2 GB disk	Zero
Setup time	~30 min	Secrets audit of 4 repos
Ongoing maintenance	PAT rotation	None
Scope	Solves Nix sandbox builds	Solves everything permanently
Risk	Service downtime = builds fail	Public history exposure

If the 4 repos have no secrets in their git history, Option B is strictly simpler — zero infra, zero maintenance, permanently solves the problem for all environments (not just Nix). Athens is the right choice only if any repo must stay private.