colin
/
nix-files
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

flake: fix "deploy" commands to bypass substituters, and address deprecated nix path signing

This commit is contained in:
Colin 2024-02-26 15:00:07 +00:00
parent d0d7994c2f
commit dd6e1c5e38
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
flake.nix
View File

@ -283,9 +283,11 @@
# - sandbox friendliness (especially: `git` doesn't have to be run as root)
if [ -n "$addr" ]; then
sudo nix sign-paths -r -k /run/secrets/nix_serve_privkey "$storePath"
sudo nix store sign -r -k /run/secrets/nix_serve_privkey "$storePath"
# add more `-v` for more verbosity (up to 5).
nix-copy-closure -v --gzip --to "$addr" "$storePath"
# builders-use-substitutes false: optimizes so that the remote machine doesn't try to get paths from its substituters.
# we already have all paths here, and the remote substitution is slow to check and SERIOUSLY flaky on moby in particular.
nix copy -vv --option builders-use-substitutes false --to "ssh-ng://$addr" "$storePath"
fi
if [ -n "$action" ]; then

4
hosts/common/nix/default.nix
View File

@ -4,7 +4,9 @@
nix.settings = {
# see: `man nix.conf`
# useful when a remote builder has a faster internet connection than me
# useful when a remote builder has a faster internet connection than me.
# note that this also applies to `nix copy --to`, though.
# i think any time a remote machine wants a path, this means we ask them to try getting it themselves before we supply it.
builders-use-substitutes = true; # default: false
# maximum seconds to wait when connecting to binary substituter