Add nix cache implementation

.sops.yaml

@@ -19,7 +19,7 @@ creation_rules:
         - *nkagami_main
         - *nkagami_do
         - *nki_framework
-  - path_regex: nki-home/secrets/secrets\.yaml$
+  - path_regex: nki-home/secrets\.yaml$
     key_groups:
     - age:
         - *nki_pc

common.nix

@@ -13,6 +13,7 @@ in
 with lib; {
   imports = [
     # defaultShell
+    ./modules/services/nix-cache
   ];
 
   ## Packages

modules/my-tinc/hosts.nix

@@ -23,10 +23,13 @@ in
       hosts;
 
     # Add all of them to host
-    networking.extraHosts = lib.strings.concatStringsSep
-      "\n"
-      (lib.attrsets.mapAttrsToList
-        (name: host: "${host.subnetAddr} ${name}.tinc")
-        hosts);
+    nki.services.edns = {
+      enable = true;
+      cloaking-rules =
+        (lib.attrsets.mapAttrs'
+          (name: host: { name = "${name}.tinc"; value = host.subnetAddr; })
+          hosts)
+      ;
+    };
   };
 }

modules/services/edns/default.nix

@@ -8,6 +8,11 @@ in
   options.nki.services.edns = {
     enable = mkEnableOption "Enable encrypted DNS";
     ipv6 = mkEnableOption "Enable ipv6";
+    cloaking-rules = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      description = "A set of domain -> ip mapping for cloaking_rules";
+    };
   };
 
   config = mkIf cfg.enable {
@@ -42,6 +47,11 @@ in
           { server_name = "*"; via = [ "anon-plan9-dns" "anon-v.dnscrypt.up-ipv4" ]; }
         ];
         anonymized_dns.skip_incompatible = true;
+
+        # Cloaking rules
+        cloaking_rules = pkgs.writeText "cloaking_rules.txt" (lib.strings.concatStringsSep
+          "\n"
+          (lib.attrsets.mapAttrsToList (name: ip: "${name} ${ip}") cfg.cloaking-rules));
       };
     };
   };

modules/services/nix-cache/cache-pub-key.pem

@@ -0,0 +1 @@
+nix.home.tinc:zG2uDy0MbLY0wLuoVH/qKzTD6hTfKZufA2cWDSTCZMA=

modules/services/nix-cache/default.nix

@@ -0,0 +1,59 @@
+{ config, pkgs, lib, ... }:
+
+with { inherit (lib) mkEnableOption mkOption types mkIf; };
+let
+  cfg = config.nki.services.nix-cache;
+in
+{
+  options.nki.services.nix-cache = {
+    enableClient = mkOption {
+      type = types.bool;
+      default = !cfg.enableServer;
+      description = "Enable nix-cache client";
+    };
+    enableServer = mkEnableOption "Enable nix-cache server";
+
+    host = mkOption {
+      type = types.str;
+      default = "nix.home.tinc";
+    };
+
+    publicKey = mkOption {
+      type = types.str;
+      default = builtins.readFile ./cache-pub-key.pem;
+    };
+
+    privateKeyFile = mkOption {
+      type = types.path;
+      description = "Path to the private key .pem file";
+    };
+  };
+
+  config = {
+    nix.settings = mkIf cfg.enableClient {
+      substituters = [ cfg.host ];
+      trusted-public-keys = [ cfg.publicKey ];
+    };
+
+    services.nix-serve = mkIf cfg.enableServer {
+      enable = true;
+      secretKeyFile = cfg.privateKeyFile;
+    };
+
+    users = mkIf cfg.enableServer {
+      users.nix-serve = { group = "nix-serve"; isSystemUser = true; };
+      groups.nix-serve = { };
+    };
+
+    services.nginx = mkIf cfg.enableServer {
+      enable = true;
+      recommendedProxySettings = true;
+      virtualHosts = {
+        # ... existing hosts config etc. ...
+        "${cfg.host}" = {
+          locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
+        };
+      };
+    };
+  };
+}

nki-home/configuration.nix

@@ -10,8 +10,6 @@ with lib;
     [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      # secret management
-      ./secrets
       # Fonts
       ../modules/personal/fonts
       # Encrypted DNS
@@ -33,6 +31,13 @@ with lib;
   common.linux.sops.enable = true;
   common.linux.sops.file = ./secrets.yaml;
 
+  # Nix cache server
+  sops.secrets."nix-cache/private-key" = { owner = "nix-serve"; group = "nix-serve"; mode = "0600"; };
+  nki.services.nix-cache = {
+    enableServer = true;
+    privateKeyFile = config.sops.secrets."nix-cache/private-key".path;
+  };
+
   # Networking
   common.linux.networking =
     {

nki-home/secrets.yaml

@@ -13,6 +13,8 @@ dtth-wg:
     preshared-key: ENC[AES256_GCM,data:96q0ZfvPz4pb53XvTGameVkcETamYH8Xbv69672RBdacH6QjRCCVvPnBTfA=,iv:Q2Yonb07/Uu6KidhMgRX4zJuNU1ZySNC7g/5TwpMU80=,tag:1qQQdk20yIQlGZmX+/25RA==,type:str]
 peertube:
     dtth-key: ENC[AES256_GCM,data:Gu7qOisVBZrFXKBr51165FJ7Ej4hV+lIf3AMC02R3UFNXOnTHF2xC8E=,iv:F83FuD1VjZEJFMcx3gkQuKCpJmYdHtO15fRHkYdMxJM=,tag:ScH42Tr5ZsIo9JMnXhylSw==,type:str]
+nix-cache:
+    private-key: ENC[AES256_GCM,data:4sbfIQb10Y50CrZbgjN+1iXEbXTpDqMbIB/yA3WlaAqhLtb8HKib5aZX3DLoxFbVihJcztQsvBBgEAhT9iMijoksaT9qzBQ5yIn4NGCfFem1DK8DQdjhTLMCVTyMFCT7hQHu/2Sd7w==,iv:zTSxuKOtOLekOBKBvl9MScD/Bo1Hviqq/n8Saa+1Cgo=,tag:fx73fCDPY9d07V3KKMw3DA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -46,8 +48,8 @@ sops:
             bUhIT0Z2b1dVWGNyS1hRVFRyZTA4d00KchP7EhSOMwBl5vFuuskzosRoi8jUu1sw
             hVjJNF2a40ewgkQgVAoWEzirHbknbQORzmepDDRth7Bve3UQU64+GA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-04-18T13:34:51Z"
-    mac: ENC[AES256_GCM,data:cinVE1pHSgjCRPIDwANzR0oHw7zdN8DVDQKkhXT5j+dGiaFzNvLoYyMcEsjoxAjEdup3YMo+Vg6I4C94AUCrTn7N9BGjnGFVQz3m9q13zORi1+HWam0VItBzJm1iIo8x0PPs79OBaIHVUFAz8r4DW46P/LQISl9MQSDpCCTjVVk=,iv:2VAehWaoh2lNZM8jlmt+dqo5eeHfcr++eAdQfm/tCcM=,tag:QSnbObe3046AnFpK3Y01Eg==,type:str]
+    lastmodified: "2024-08-16T12:16:41Z"
+    mac: ENC[AES256_GCM,data:x3zeCDljzyRpro4sem2pC33rFfm5jAjFhhX9JNlzLB6aNZ1TUv0qz4g7NhkWY23XNjJFmYqIW+pib97OVDd15kRojknM/UYCThW5oZDIWKn+TA9+bF9NGBjxP60t3n3dlU5VmgD8bgiApUS+XzHnJXuxhfiIHclvfxdLC33R7S4=,iv:str4fZX58mzFlD4rYaLmiCAeZmHIernG3636Tt+Rwgg=,tag:qS47OGc/o4/0Cj/V4e8dBg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.9.0

nki-yoga-g8/configuration.nix

@@ -16,8 +16,8 @@
     ];
 
   # Secrets
-  sops.defaultSopsFile = ./secrets.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  common.linux.sops.enable = true;
+  common.linux.sops.file = ./secrets.yaml;
 
   ## tinc
   sops.secrets."tinc-private-key" = { };