feat: self-host Attic binary cache on glyph

.github/workflows/ci.yml

@@ -29,15 +29,19 @@ jobs:
     - uses: cachix/install-nix-action@v31
       with:
         github_access_token: ${{ secrets.GITHUB_TOKEN }}
-    - uses: cachix/cachix-action@v16
-      with:
-        name: stackptr
-        authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+    - name: Configure Attic cache
+      run: |
+        nix profile install github:zhaofengli/attic#attic-client
+        attic login rc https://cache.zx.dev ${{ secrets.ATTIC_TOKEN }}
+        attic use rc:main
     - run: nix flake check
-    - name: Build NixOS system
+    - name: Build system configuration
       run: |
         if [ "${{ matrix.system }}" = "aarch64-darwin" ]; then
           nix build .#darwinConfigurations.${{ matrix.host }}.system
         else
           nix build .#nixosConfigurations.${{ matrix.host }}.config.system.build.toplevel
         fi
+    - name: Push to Attic
+      if: github.ref == 'refs/heads/main'
+      run: attic push rc:main ./result

flake.nix

@@ -43,6 +43,10 @@
       inputs.nixpkgs.follows = "nixpkgs";
       inputs.systems.follows = "systems";
     };
+    attic = {
+      url = "github:zhaofengli/attic";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     zx-dev = {
       url = "github:stackptr/zx.dev";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -115,9 +119,11 @@
         nixConfig = {
           experimental-features = ["nix-command" "flakes"];
           extra-substituters = [
+            "https://cache.zx.dev"
             "https://stackptr.cachix.org"
           ];
           extra-trusted-public-keys = [
+            "main:sbkS1Xz6P4g66iyttRGj/o8aPODE6bVG9oKT98/ULKI="
             "stackptr.cachix.org-1:5e2q7OxdRdAtvRmHTeogpgJKzQhbvFqNMmCMw71opZA="
           ];
         };

hosts/glyph/services/attic.nix

@@ -0,0 +1,36 @@
+{config, ...}: {
+  age.secrets.attic-credentials = {
+    file = ./../secrets/attic-credentials.age;
+    mode = "440";
+    owner = "atticd";
+    group = "atticd";
+  };
+
+  services.atticd = {
+    enable = true;
+    environmentFile = config.age.secrets.attic-credentials.path;
+
+    settings = {
+      listen = "[::]:8199";
+
+      database.url = "sqlite:///var/lib/atticd/server.db?mode=rwc";
+
+      storage = {
+        type = "local";
+        path = "/var/lib/atticd/storage";
+      };
+
+      chunking = {
+        nar-size-threshold = 65536;
+        min-size = 16384;
+        avg-size = 65536;
+        max-size = 262144;
+      };
+
+      garbage-collection = {
+        interval = "12 hours";
+        default-retention-period = "30 days";
+      };
+    };
+  };
+}

hosts/glyph/services/default.nix

@@ -4,6 +4,7 @@
   ...
 }: {
   imports = [
+    ./attic.nix
     ./avahi.nix
     ./dns.nix
     ./filebrowser.nix
@@ -84,6 +85,7 @@
   rc.backup = {
     enable = true;
     paths = [
+      "/var/lib/atticd/server.db"
       "/var/lib/basic-memory"
       "/var/lib/open-webui"
       "/var/lib/roon-server/backup"

hosts/spore/services/web/default.nix

@@ -86,6 +86,17 @@
           proxyWebsockets = true;
         };
       };
+      "cache.zx.dev" = {
+        forceSSL = true;
+        useACMEHost = "zx.dev";
+        locations."/" = {
+          proxyPass = "http://glyph.rove-duck.ts.net:8199";
+          extraConfig = ''
+            client_max_body_size 0;
+            proxy_read_timeout 300;
+          '';
+        };
+      };
       "jellyfin.zx.dev" = {
         forceSSL = true;
         useACMEHost = "zx.dev";

lib/hosts.nix

@@ -11,6 +11,7 @@ inputs @ {
   llm-profile,
   nix-index-database,
   zx-dev,
+  attic,
   disko,
   golink,
   ...
@@ -76,6 +77,7 @@ inputs @ {
         {
           nixpkgs.overlays = overlays;
         }
+        attic.nixosModules.atticd
         golink.nixosModules.default
         zx-dev.nixosModules.default
       ];

lib/secrets/glyph.nix

@@ -8,4 +8,5 @@ in {
   "hosts/glyph/secrets/context7-api-key.age".publicKeys = keys;
   "hosts/glyph/secrets/open-webui-env.age".publicKeys = keys;
   "hosts/glyph/secrets/graphite-auth-token.age".publicKeys = keys;
+  "hosts/glyph/secrets/attic-credentials.age".publicKeys = keys;
 }