From 308f0da79f3ab1821be12845e9f2f90559c55125 Mon Sep 17 00:00:00 2001
From: Paul-Henri Froidmont <git.contact-57n2p@froidmont.org>
Date: Thu, 15 Sep 2022 03:40:09 +0200
Subject: [PATCH] Add NixOS binary cache

---
 dns.tf                   |  8 ++++++++
 modules/binary-cache.nix | 34 ++++++++++++++++++++++++++++++++++
 profiles/storage.nix     |  1 +
 secrets.enc.yml          |  6 ++++--
 4 files changed, 47 insertions(+), 2 deletions(-)
 create mode 100644 modules/binary-cache.nix

diff --git a/dns.tf b/dns.tf
index 261c426..3d33e8d 100644
--- a/dns.tf
+++ b/dns.tf
@@ -56,6 +56,14 @@ resource "hetznerdns_record" "storage1_a" {
   ttl     = 600
 }
 
+resource "hetznerdns_record" "cache_a" {
+  zone_id = data.hetznerdns_zone.banditlair_zone.id
+  name    = "cache"
+  value   = local.storage1_ip
+  type    = "A"
+  ttl     = 600
+}
+
 resource "hetznerdns_record" "jellyfin_a" {
   zone_id = data.hetznerdns_zone.banditlair_zone.id
   name    = "jellyfin"
diff --git a/modules/binary-cache.nix b/modules/binary-cache.nix
new file mode 100644
index 0000000..5f4f9ba
--- /dev/null
+++ b/modules/binary-cache.nix
@@ -0,0 +1,34 @@
+{ config, ... }:
+{
+
+  sops.secrets = {
+    nixCacheKey = {
+      owner = config.services.borgbackup.jobs.data.user;
+      key = "nix/cache_secret_key";
+    };
+  };
+
+
+  services.nix-serve = {
+    enable = true;
+    port = 1500;
+    secretKeyFile = config.sops.secrets.nixCacheKey.path;
+  };
+
+  services.nginx = {
+    virtualHosts = {
+      "cache.${config.networking.domain}" = {
+
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/".extraConfig = ''
+          proxy_pass http://localhost:${toString config.services.nix-serve.port};
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        '';
+      };
+    };
+  };
+}
diff --git a/profiles/storage.nix b/profiles/storage.nix
index 497bd10..2ecd73b 100644
--- a/profiles/storage.nix
+++ b/profiles/storage.nix
@@ -14,6 +14,7 @@
     ../modules/custom-monit.nix
     ../modules/jitsi.nix
     ../modules/gitlab-runner.nix
+    ../modules/binary-cache.nix
   ];
 
   sops.secrets = {
diff --git a/secrets.enc.yml b/secrets.enc.yml
index fee6675..5c614e5 100644
--- a/secrets.enc.yml
+++ b/secrets.enc.yml
@@ -1,3 +1,5 @@
+nix:
+    cache_secret_key: ENC[AES256_GCM,data:Q2mRU+EuTyqjYNvbuyGLqoDSqa/7EPlzNuCJU7QUBRSozf1D4dDzAPNU47xZ2rKcjz6Eg4OhAZLlGeFw9le8SzHOSJ65UYHoMMc6Rpvv/fPhgg2s2UMArrqyO3ultj1pVe3eIIRzBQcdoFqVDg==,iv:jhMTWEO6ahcZl+Dq6mA+mWIie8T0Dq1ZYe/HHYAD5ss=,tag:2GRmd2z96+TGI7MdvOBEdA==,type:str]
 gitlab:
     runner_registration_config: ENC[AES256_GCM,data:BxkP4+moNV4eip9g2MoOFzZgWvYHELQ3qOJxMAGV9Ffdy5Fhl7mFNE85yv2I09hg2hwd68V3ThwiZ7eBoOi87bDRN82PeIyDqPtjbNA1ZcLJqE8=,iv:I/1wzcVSiz90cgRqMhGfN1wdB0EVQYVPyFn3RvSbTaw=,tag:8hMKQfmtPZf3nbs4LjnH3w==,type:str]
 synapse:
@@ -50,8 +52,8 @@ sops:
     azure_kv: []
     hc_vault: []
     age: []
-    lastmodified: "2022-07-27T03:05:41Z"
-    mac: ENC[AES256_GCM,data:vImmhxK93ubN/gTPtKkWrzPp+9ipU+WtggD0zODTZgNmzrtWOtEisUTA3sjMHKtuliK26Y73BjR8l44My8UpMsKCcAQAa+IHZHNZW7/VyKM7cRU71Eav+SGWMpCUHBTLZCfBIVMC0GyNcajGJypDUTh1ETpj7TV9NKysx1ocBhM=,iv:7JoI6/q46+iI1onRNnLfxZUEDZo4rMhzhnZVn6YbU+g=,tag:NOJGXv2Sx8kvJcRPoQslnw==,type:str]
+    lastmodified: "2022-09-14T22:46:49Z"
+    mac: ENC[AES256_GCM,data:KfG7/Hp3xxa3ykVkbPGWfzufc22TxvfGykNLxN8CX1BrEjdjZhKDYkTbdrANRxuMh1KlCQ1n9zOptPYT7lylEhEAQN4MpyQ0Mz2aQjZgNqhm2qO+YFlvbNsilK1fIbE3exLELfPTCBuJHYj6zMVgOZd1kXNcbL4VRN8uzct4ZzA=,iv:FvD2nvdsLxr5Yd+TKdP/wYHfr9Av5chPYxbwbltnpNI=,tag:hOlapLfrbW+hJlAHp5jX/w==,type:str]
     pgp:
         - created_at: "2021-11-29T00:57:34Z"
           enc: |