Migrating to FlakeHub Cache

This document describes how to read from an existing authenticated Nix cache while transitioning to FlakeHub Cache.

You will need:

Your existing cache’s domain. In this document, we use cache.example.com.
Your existing cache’s signing key. In this document, we use cache.example.com-1:z6v4aBPO5OZMRt0aenmWKfgfuLabAavY3E9Q1ya7J58=.
Credentials for your existing cache. In this document, we use password-for-cache-example-com.

When you see these values, substitute your own.

Push to FlakeHub Cache from GitHub

Push to FlakeHub Cache from your CI/CD workflows by enabling Magic Nix Cache.

github-actions-workflow.yml

jobs:
  check:
    permissions:
      id-token: "write"
      contents: "read"
    steps:
      - uses: DeterminateSystems/nix-installer-action@main
        with:
          determinate: true
      - uses: DeterminateSystems/magic-nix-cache-action@main

Magic Nix Cache can not push to FlakeHub Cache if you omit the permissions.

Install Determinate

Install Determinate on the device to enable FlakeHub Cache.

Create a netrc to authenticate with your existing cache.

Create or move your existing cache’s netrc file to a stable location, like /etc/determinate/netrc.custom.

/etc/determinate/netrc.custom

machine cache.example.com password password-for-cache-example-com

The netrc file must not be in the Nix store.

Configure additional netrc sources

Edit the Determinate configuration at /etc/determinate/config.json, and list the netrc you just created as an additional netrc.

/etc/determinate/config.json

{
  "authentication": {
    "additionalNetrcSources": [
      "/etc/determinate/netrc.custom"
    ]
  }
}

Enable your additional cache

Add your other cache to /etc/nix/nix.custom.conf:

extra-substituters = https://cache.example.com
extra-trusted-public-keys = cache.example.com-1:z6v4aBPO5OZMRt0aenmWKfgfuLabAavY3E9Q1ya7J58=

Restart the daemon

Restart the Determinate daemon after changing its configuration, or altering the additional netrc files.

macOS

sudo launchctl kickstart -k system/systems.determinate.nix-daemon

Linux with systemd

sudo systemctl restart nix-daemon.service

Testing

Determinate’s synthesized netrc file at /nix/var/determinate/netrc now contains the merged entries of your additional netrc files and the FlakeHub credentials.

Use nix build to build a program you know is cached in the additional cache, but not yet present in the FlakeHub Cache.

$ nix run
[...]
copying path '/nix/store/px5wm2jf76y9qw277kkfzb76c21zwzg1-rust-std-stable-2024-10-17' from 'https://cache.example.com'...

Easy caching with Determinate CI Log in with AWS STS