Cachix

Cachix is a Saas service providing nix binary caches. The project is currently in beta and offers only personal binary caches.

We use it to cache toolbox builds on every revision. We do it to prevent operators or CI jobs to issue build operations while using nix-shell.

Using cachix cli

To install cachix cli:

toolbox install pkgs.cachix

To be used cachix needs a CACHIX_SIGNING_KEY in environment variables. That secret is forged by Cachix webservice and is specific to the user. The key can be found in gopass:

gopass show caascad/cachix/toolbox

This signing key controls toolbox binary cache.

And to push something:

nix-build | cachix push toolbox

Github actions

All github actions starting with 'publish.*' push toolbox binaries to toolbox binary cache. In the Github secrets the signing key have been registered.

The Github Action issues those commands inside the toolbox repository to push to cachix:

nix-build | cachix push toolbox
nix-build -A terraform-providers | cachix push toolbox

Cache references

Binary caches are store in the nix config file at ${HOME}/.config/nix/nix.conf:

substituters = https://cache.nixos.org https://toolbox.cachix.org
trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= toolbox.cachix.org-1:ZFzO+86jD4G5ukgmLOnQRxjVmMcqu+60JTusH6pv8/8=
experimental-features = nix-command

Those config files are deployed on:

• Base nix image: this image is used as base docker nix image (ci uses it for trackbone jobs)
• Operator computers: the toolbox installation takes care of this