Secure Implementation for FlakeHub Determinate Gov

Determinate Gov is our Federal Risk and Authorization Management Program (FedRAMP) High environment. FedRAMP High is Certification Class D under FedRAMP’s 2026 Consolidated Rules. FlakeHub Determinate Gov is the FlakeHub service provided by Determinate Gov, at https://flakehub.us rather than https://flakehub.com. This guide shows you how to use Determinate in conjunction with FlakeHub Determinate Gov and, just as importantly, what you’re responsible for on your side.

Determinate Gov is available to organizations that have been provided access. Contact us at sales@determinate.systems to discuss terms of access or schedule a demo.

This guide uses must and must not for requirements, not suggestions. FlakeHub Determinate Gov gives you a compliant place to store and distribute your flakes and cached artifacts, but a Secure Implementation also depends on how you configure your organization, your identity provider, and what you publish.

Connect to FlakeHub Determinate Gov

Prerequisites

You must be a member of your organization on FlakeHub.
Every machine that communicates with FlakeHub Determinate Gov, including its cache, must run Determinate Nix 3.21.9 (released 30 July 2026) or later.

Point Determinate Nix at FlakeHub Determinate Gov

On every machine that communicates with FlakeHub Determinate Gov — including all CI machines — you must set the Determinate root to https://flakehub.us in the Determinate Nixd configuration file:

/etc/determinate/config.json


{
  "root": "https://flakehub.us"
}

For example, in CI, you would do this:

.github/workflows/nix.yaml


- name: Configure Determinate Gov
  run: |
    sudo mkdir -p /etc/determinate
    echo '{"root":"https://flakehub.us"}' | sudo tee /etc/determinate/config.json
- uses: DeterminateSystems/determinate-nix-action@v3

Once set, restart the Determinate daemon so that the new configuration takes effect (or: set it before installing Determinate Nix, as in the above example).

macOS

Restart the Determinate daemon on macOS


sudo launchctl kickstart -k system/systems.determinate.nix-daemon

Linux with systemd

Restart the Determinate daemon on Linux


sudo systemctl restart nix-daemon.service

Configure FlakeHub Cache in CI

Magic Nix Cache must use api.flakehub.us as its FlakeHub API server and cache.flakehub.us as its FlakeHub Cache server.

If you use the FlakeHub Cache Action:

.github/workflows/nix.yaml


- uses: DeterminateSystems/flakehub-cache-action@v3
  with:
    flakehub-api-server: https://api.flakehub.us
    flakehub-cache-server: https://cache.flakehub.us

If you run the magic-nix-cache binary directly:

Run Magic Nix Cache against FlakeHub Determinate Gov


magic-nix-cache \
  --flakehub-api-server https://api.flakehub.us \
  --flakehub-cache-server https://cache.flakehub.us

Configure flakehub-push

flakehub-push must use api.flakehub.us as its FlakeHub API server:

.github/workflows/nix.yaml


- uses: DeterminateSystems/flakehub-push@v3
  with:
    host: https://api.flakehub.us

Publish only private flakes

You must publish only private flakes. Public flakes are readable by anyone, which is not admissible in FlakeHub Determinate Gov, so set visibility to "private" in every publishing configuration:

.github/workflows/nix.yaml


- uses: DeterminateSystems/flakehub-push@v3
  with:
    host: https://api.flakehub.us
    visibility: "private"

Restrict your allowlists

Your organization’s settings on flakehub.us include an Amazon Resource Name (ARN) allowlist, a Google Cloud Platform (GCP) ID allowlist, and a network allowlist. Changing any of them affects your security posture.

Any device that matches an entry in the AWS ARN or GCP ID allowlists is granted a device token, and that token grants access to your organization, its flakes, and the contents of all cache slices. You must add only ARNs, GCP IDs, and IP addresses that you trust.

For details on how each identity type is matched, see logging in from AWS STS and logging in from GCP.

Set an appropriate session duration

Session duration in the FlakeHub web interface is capped by the expiration of the JSON Web Token (JWT) that your identity provider issues, as recorded in the token’s exp claim, or 15 minutes, whichever comes first.

You must configure expiration in your identity provider so that it satisfies every standard and requirement that applies to your organization. FlakeHub honors the shorter of the two values, so a long-lived identity token is a long-lived session, up to the cap.

Meet your PIV and CAC requirements

FlakeHub delegates authentication to your identity provider, such as Microsoft Entra or Okta. That means that Personal Identity Verification (PIV) and Common Access Card (CAC) enforcement happens there, not in FlakeHub.

You must ensure that your identity provider properly adheres to the standards and requirements that apply to your organization’s use of PIV and CAC.

Keep controlled data out of flake metadata

The contents of your flakes’ outputs are private, but the metadata that FlakeHub uses to identify and index a release is not the place for sensitive data. When you publish flake releases, you must not include export-controlled data or Controlled Unclassified Information (CUI) in any of these places:

Location	Where it comes from
The flake’s name	The GitHub repository’s name, unless you override it with the `name` input to `flakehub-push`
The flake’s description	The `description` in your `flake.nix`, if there is one
The flake’s labels	The labels on the GitHub repository
Output attribute paths and derivation names	Your flake’s outputs, if you set `include-output-paths: true` in `flakehub-push`
The JSON flake metadata	`nix flake metadata --json`
The README	The `README.md` file in the repository
The repository URL	The repository’s URL
The published directory	The `directory` input to `flakehub-push`

Take the output .#packages.x86_64-linux.cui-data-inside as an example. Neither the attribute path nor the resulting store path may contain CUI in its name, so, assuming the string cui-data-inside is itself CUI, the attribute path packages.x86_64-linux.cui-data-inside and the following output store path would be unacceptable:

/nix/store/
sglc12hc6pc68w5ppn2k56n6jcpaci16
-cui-data-inside

The contents of that store path, on the other hand, may include CUI.

If you use the FlakeHub Cache Action before flakehub-push successfully uploads a release, it automatically creates a project with the same name as the GitHub repository. Choose repository names accordingly, because the name reaches FlakeHub before your first release does.

Get help

If you have questions about implementing any of these requirements, contact us at support@determinate.systems.