feat(nix-cache): proxy ustc and cachix, prefer the LAN cache

Assisted-by: DeepSeek Harness (deepseek-flash)

hosts/12kingdoms-youko/homelab-services/nix-cache-proxy.nix

@@ -25,8 +25,8 @@ let
     add_header X-Cache-Status $upstream_cache_status always;
   '';
 
-  cacheLocation = upstream: {
-    proxyPass = "https://${upstream}/";
+  cacheLocation = upstream: subPath: {
+    proxyPass = "https://${upstream}${subPath}/";
     extraConfig = ''
       proxy_set_header Host ${upstream};
       ${cacheConfig}
@@ -56,8 +56,12 @@ in
       ];
 
       locations = {
-        "/cache.nixos.org/" = cacheLocation "cache.nixos.org";
-        "/cache.numtide.com/" = cacheLocation "cache.numtide.com";
+        "/cache.nixos.org/" = cacheLocation "cache.nixos.org" "";
+        "/cache.numtide.com/" = cacheLocation "cache.numtide.com" "";
+        "/ryan4yin.cachix.org/" = cacheLocation "ryan4yin.cachix.org" "";
+        # The mirror keeps the upstream path under /nix-channels/store.
+        "/mirrors.ustc.edu.cn/nix-channels/store/" =
+          cacheLocation "mirrors.ustc.edu.cn" "/nix-channels/store";
       };
     };
   };

modules/base/nix.nix

@@ -28,26 +28,23 @@
     # The official https://cache.nixos.org is always trusted and is appended
     # automatically, so it does not need to be listed here.
     substituters = [
-      # Domestic mirrors are fast from the LAN; query them directly first.
-      # status: https://mirrors.ustc.edu.cn/status/
-      "https://mirrors.ustc.edu.cn/nix-channels/store"
-      # status: https://mirror.sjtu.edu.cn/
-      # "https://mirror.sjtu.edu.cn/nix-channels/store"
-      # others
-      # "https://mirrors.sustech.edu.cn/nix-channels/store"
-      "https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store"
-
-      # Pull-through cache for upstreams that are slow from the LAN. Nix
-      # appends the official cache.nixos.org last, so list its proxy here.
+      # The LAN cache on youko first: one machine warms it over the WAN, then
+      # every other machine fetches the same paths over gigabit. A miss only
+      # costs one extra hop, since the cache fetches the path itself.
+      "https://nix-cache.writefor.fun/mirrors.ustc.edu.cn/nix-channels/store"
       "https://nix-cache.writefor.fun/cache.nixos.org"
       # numtide's cache (niks3), which serves the prebuilt packages of the
       # numtide/llm-agents.nix flake input used for the AI agent CLIs.
       "https://nix-cache.writefor.fun/cache.numtide.com"
-      # Direct fallback if the LAN proxy is unavailable.
-      "https://cache.numtide.com"
-
       # My own NUR cache, built by the ryan4yin/nur-packages CI. NUR's npm
       # dep hashes assume no registry mirror, so take them from the cache.
+      "https://nix-cache.writefor.fun/ryan4yin.cachix.org"
+
+      # Direct fallbacks for when youko is down; every proxied cache above also
+      # exists in the clear, so losing the LAN cache costs speed, not builds.
+      "https://mirrors.ustc.edu.cn/nix-channels/store"
+      "https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store"
+      "https://cache.numtide.com"
       "https://ryan4yin.cachix.org"
     ];
 

outputs/x86_64-linux/tests/youko-nix-cache-proxy/expected.nix

@@ -1,11 +1,15 @@
 {
   nginxEnabled = true;
   caddyVhostExists = true;
-  ustcRemainsFirst = true;
+  lanCacheFirst = true;
+  ustcProxyConfigured = true;
   nixosProxyConfigured = true;
   numtideProxyConfigured = true;
-  numtideDirectFallback = true;
+  cachixProxyConfigured = true;
+  directFallbacks = true;
   cacheLivesOnDataVolume = true;
   nixosUpstream = "https://cache.nixos.org/";
   numtideUpstream = "https://cache.numtide.com/";
+  cachixUpstream = "https://ryan4yin.cachix.org/";
+  ustcUpstream = "https://mirrors.ustc.edu.cn/nix-channels/store/";
 }

outputs/x86_64-linux/tests/youko-nix-cache-proxy/expr.nix

@@ -11,11 +11,19 @@ in
 {
   nginxEnabled = nginx.enable;
   caddyVhostExists = cfg.services.caddy.virtualHosts ? "nix-cache.writefor.fun";
-  ustcRemainsFirst = builtins.head substituters == "https://mirrors.ustc.edu.cn/nix-channels/store";
+  lanCacheFirst = lib.hasPrefix "https://nix-cache.writefor.fun/" (builtins.head substituters);
+  ustcProxyConfigured = builtins.elem "https://nix-cache.writefor.fun/mirrors.ustc.edu.cn/nix-channels/store" substituters;
   nixosProxyConfigured = builtins.elem "https://nix-cache.writefor.fun/cache.nixos.org" substituters;
   numtideProxyConfigured = builtins.elem "https://nix-cache.writefor.fun/cache.numtide.com" substituters;
-  numtideDirectFallback = builtins.elem "https://cache.numtide.com" substituters;
+  cachixProxyConfigured = builtins.elem "https://nix-cache.writefor.fun/ryan4yin.cachix.org" substituters;
+  directFallbacks =
+    builtins.elem "https://mirrors.ustc.edu.cn/nix-channels/store" substituters
+    && builtins.elem "https://cache.numtide.com" substituters
+    && builtins.elem "https://ryan4yin.cachix.org" substituters;
   cacheLivesOnDataVolume = lib.hasInfix "/data/apps/nix-cache-proxy" nginx.appendHttpConfig;
   nixosUpstream = nginx.virtualHosts."nix-cache-proxy".locations."/cache.nixos.org/".proxyPass;
   numtideUpstream = nginx.virtualHosts."nix-cache-proxy".locations."/cache.numtide.com/".proxyPass;
+  cachixUpstream = nginx.virtualHosts."nix-cache-proxy".locations."/ryan4yin.cachix.org/".proxyPass;
+  ustcUpstream =
+    nginx.virtualHosts."nix-cache-proxy".locations."/mirrors.ustc.edu.cn/nix-channels/store/".proxyPass;
 }