Secure implementation for FlakeHub Determinate Gov
Determinate Gov is our Federal Risk and Authorization Management Program (FedRAMP) High environment. FedRAMP High is Certification Class D under FedRAMP’s 2026 Consolidated Rules. FlakeHub Determinate Gov is the FlakeHub service provided by Determinate Gov, available at https://flakehub.us rather than https://flakehub.com. This guide shows you how to use Determinate in conjunction with FlakeHub Determinate Gov and, just as importantly, what you’re responsible for on your side.
Determinate Gov is available to organizations that have been provided access. Contact us to discuss terms of access or schedule a demo.
This guide uses must and must not for requirements, not suggestions. FlakeHub Determinate Gov gives you a compliant place to store and distribute your flakes and cached artifacts, but a secure implementation also depends on how you configure your organization, your identity provider, and what you publish.
Onboarding
Onboarding your organization to FlakeHub Determinate Gov requires a few steps. Some steps are Determinate Systems’ responsibility, some are your responsibility, and we’ve labeled each one so you always know who is responsible for the next action in the chain.
Don’t share Controlled Unclassified Information (CUI) or export-controlled data with us at any point during onboarding. Our support systems are outside the FedRAMP authorization boundary, as we explain in the Get help section.
Register your organization
Who: you
An owner of your GitHub organization needs to:
- Log in to FlakeHub Determinate Gov.
- Install the FlakeHub Determinate Gov GitHub app to your GitHub organization.
- Fill in the organization registration form and click Register organization.
The app only grants FlakeHub read access to the minimum information it needs to associate your organization and its members with your FlakeHub account. The steps are the same as in Install and configure FlakeHub’s GitHub app, which has screenshots. Use the FlakeHub Determinate Gov app and flakehub.us wherever it shows the FlakeHub app and flakehub.com.
Once you’ve installed the app and registered your organization, let us know the name of your organization so that we can pick up the next steps.
Set up Entra GCC-High
Who: you and us
FlakeHub Determinate Gov supports Microsoft Entra ID in Azure Government Community Cloud High (GCC-High). Follow the Entra onboarding guide, with these differences:
- Specify
GCC-Highas your Entra partition when you send us your tenant information. - Log in at https://flakehub.us/login rather than https://flakehub.com/login, and choose Register or sign in to FlakeHub with Entra Government Community Cloud — High.
- Log out at https://api.flakehub.us/logout rather than https://api.flakehub.com/logout.
- Manage your organization’s members at
https://flakehub.us/:org/settings?editview=membersrather than on flakehub.com.
We configure your tenant on our side and let you know when you can log in with Entra. Don’t move on to the login steps in that guide until you hear from us.
Enable private flakes and FlakeHub Cache
Who: us
We enable private flakes and FlakeHub Cache for your organization. You don’t need to sign up for a paid plan through the FlakeHub web interface, as you would on flakehub.com, because your Determinate Gov agreement covers these features.
Provision your encryption key
Who: us
We provision a customer encryption key dedicated to your organization. We let you know once it’s in place, along with anything you need to know about it.
Connect and review your responsibilities
Who: you
Once we’ve let you know that your organization is ready, connect your machines and CI to FlakeHub Determinate Gov. Then, before you put FlakeHub Determinate Gov into production, work through the rest of this guide, which covers the requirements that you must meet. If your security or procurement team needs documentation for its own review, such as a completed security questionnaire, contact us.
Connect to FlakeHub Determinate Gov
Prerequisites
- You must be a member of your organization on FlakeHub.
- Every machine that communicates with FlakeHub Determinate Gov, including its cache, must run Determinate Nix 3.21.9 (released 30 July 2026) or later.
Point Determinate Nix at FlakeHub Determinate Gov
On every machine that communicates with FlakeHub Determinate Gov — including all CI machines — you must set the Determinate root to https://flakehub.us in the Determinate Nixd configuration file:
{
"root": "https://flakehub.us"
}For example, in CI, you would do this:
- name: Configure Determinate Gov
run: |
sudo mkdir -p /etc/determinate
echo '{"root":"https://flakehub.us"}' | sudo tee /etc/determinate/config.json
- uses: DeterminateSystems/determinate-nix-action@v3Once set, restart the Determinate daemon so that the new configuration takes effect (or: set it before installing Determinate Nix, as in the above example).
macOS
sudo launchctl kickstart -k system/systems.determinate.nix-daemonLinux with systemd
sudo systemctl restart nix-daemon.serviceConfigure FlakeHub Cache in CI
Magic Nix Cache must use api.flakehub.us as its FlakeHub API server and cache.flakehub.us as its FlakeHub Cache server.
If you use the FlakeHub Cache Action:
- uses: DeterminateSystems/flakehub-cache-action@v3
with:
flakehub-api-server: https://api.flakehub.us
flakehub-cache-server: https://cache.flakehub.usIf you run the magic-nix-cache binary directly:
magic-nix-cache \
--flakehub-api-server https://api.flakehub.us \
--flakehub-cache-server https://cache.flakehub.usConfigure flakehub-push
flakehub-push must use api.flakehub.us as its FlakeHub API server:
- uses: DeterminateSystems/flakehub-push@v3
with:
host: https://api.flakehub.usPublish only private flakes
You must publish only private flakes.
Public flakes are readable by anyone, which is not admissible in FlakeHub Determinate Gov, so set visibility to "private" in every publishing configuration:
- uses: DeterminateSystems/flakehub-push@v3
with:
host: https://api.flakehub.us
visibility: "private"Restrict your allowlists
Your organization’s settings on flakehub.us include an Amazon Resource Name (ARN) allowlist, a Google Cloud Platform (GCP) ID allowlist, and a network allowlist. Changing any of them affects your security posture.
Any device that matches an entry in the AWS ARN or GCP ID allowlists is granted a device token, and that token grants access to your organization, its flakes, and the contents of all cache slices. You must add only ARNs, GCP IDs, and IP addresses that you trust.
For details on how each identity type is matched, see logging in from AWS STS and logging in from GCP.
Set an appropriate session duration
Session duration in the FlakeHub web interface is capped by the expiration of the JSON Web Token (JWT) that your identity provider issues, as recorded in the token’s exp claim, or 15 minutes, whichever comes first.
You must configure expiration in your identity provider so that it satisfies every standard and requirement that applies to your organization. FlakeHub honors the shorter of the two values, so a long-lived identity token is a long-lived session, up to the cap.
Meet your PIV and CAC requirements
FlakeHub delegates authentication to your identity provider, such as Microsoft Entra or Okta. That means that Personal Identity Verification (PIV) and Common Access Card (CAC) enforcement happens there, not in FlakeHub.
You must ensure that your identity provider properly adheres to the standards and requirements that apply to your organization’s use of PIV and CAC.
Keep controlled data out of flake metadata
The contents of your flakes’ outputs are private, but the metadata that FlakeHub uses to identify and index a release is not the place for sensitive data. When you publish flake releases, you must not include export-controlled data or Controlled Unclassified Information (CUI) in any of these places:
| Location | Where it comes from |
|---|---|
| The flake’s name | The GitHub repository’s name, unless you override it with the name input to flakehub-push |
| The flake’s description | The description in your flake.nix, if there is one |
| The flake’s labels | The labels on the GitHub repository |
| Output attribute paths and derivation names | Your flake’s outputs, if you set include-output-paths: true in flakehub-push |
| The JSON flake metadata | nix flake metadata --json |
| The README | The README.md file in the repository |
| The repository URL | The repository’s URL |
| The published directory | The directory input to flakehub-push |
Take the output .#packages.x86_64-linux.cui-data-inside as an example.
Neither the attribute path nor the resulting store path may contain CUI in its name, so, assuming the string cui-data-inside is itself CUI, the attribute path packages.x86_64-linux.cui-data-inside and the following output store path would be unacceptable:
/nix/store/sglc12hc6pc68w5ppn2k56n6jcpaci16-cui-data-inside
The contents of that store path, on the other hand, may include CUI.
If you use the FlakeHub Cache Action before flakehub-push successfully uploads a release, it automatically creates a project with the same name as the GitHub repository.
Choose repository names accordingly, because the name reaches FlakeHub before your first release does.
Get help
If you have questions about implementing any of these requirements, contact us.
When interacting with Determinate Systems support, customers are responsible for ensuring that information submitted to support complies with applicable legal and regulatory requirements. Do not submit Controlled Unclassified Information (CUI), export-controlled information, or other data subject to U.S.-person or U.S.-location handling requirements unless Determinate Systems has explicitly authorized such use. Support tickets may be processed by non-U.S. persons or outside the United States. Determinate Systems support systems are outside the FedRAMP authorization boundary unless explicitly stated otherwise.