mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
62 lines
2.7 KiB
Nix
62 lines
2.7 KiB
Nix
{
|
|
pkgs,
|
|
config,
|
|
nixpkgsConfig,
|
|
...
|
|
}:
|
|
{
|
|
nixpkgs.config = nixpkgsConfig;
|
|
|
|
nix.settings = {
|
|
# enable flakes globally
|
|
experimental-features = [
|
|
"nix-command"
|
|
"flakes"
|
|
];
|
|
|
|
# NOTE: the normal user is deliberately NOT a trusted-user. That would
|
|
# grant the right to inject arbitrary substituters (via `nixConfig` in a
|
|
# flake, or `--option substituters ...`), which is a known root-equivalent
|
|
# vector through the daemon. Every substituter we want is instead listed in
|
|
# the system substituters below, which the daemon applies for every user.
|
|
|
|
# WARNING: `substituters` + `trusted-public-keys` are a security boundary,
|
|
# not a convenience list. Nix downloads prebuilt store paths from a
|
|
# substituter, and a trusted key means "trust anything signed by it" —
|
|
# together they let a cache inject arbitrary store paths into your system,
|
|
# which are then run as root at activation. Only add caches you fully trust.
|
|
# The official https://cache.nixos.org is always trusted and is appended
|
|
# automatically, so it does not need to be listed here.
|
|
substituters = [
|
|
# The LAN cache on youko first: one machine warms it over the WAN, then
|
|
# every other machine fetches the same paths over gigabit. A miss only
|
|
# costs one extra hop, since the cache fetches the path itself.
|
|
"https://nix-cache.writefor.fun/mirrors.ustc.edu.cn/nix-channels/store"
|
|
"https://nix-cache.writefor.fun/cache.nixos.org"
|
|
# numtide's cache (niks3), which serves the prebuilt packages of the
|
|
# numtide/llm-agents.nix flake input used for the AI agent CLIs.
|
|
"https://nix-cache.writefor.fun/cache.numtide.com"
|
|
# My own NUR cache, built by the ryan4yin/nur-packages CI. NUR's npm
|
|
# dep hashes assume no registry mirror, so take them from the cache.
|
|
"https://nix-cache.writefor.fun/ryan4yin.cachix.org"
|
|
|
|
# Direct fallbacks for when youko is down; every proxied cache above also
|
|
# exists in the clear, so losing the LAN cache costs speed, not builds.
|
|
"https://mirrors.ustc.edu.cn/nix-channels/store"
|
|
"https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store"
|
|
"https://cache.numtide.com"
|
|
"https://ryan4yin.cachix.org"
|
|
];
|
|
|
|
# WARNING: every key here trusts *everything* that key signs. Add one only
|
|
# for a cache you trust as much as the official one — a careless key hands
|
|
# a third party the ability to ship you arbitrary store paths.
|
|
trusted-public-keys = [
|
|
"niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
|
|
# ryan4yin.cachix.org, see substituters above.
|
|
"ryan4yin.cachix.org-1:Gbk27ZU5AYpGS9i3ssoLlwdvMIh0NxG0w8it/cv9kbU="
|
|
];
|
|
builders-use-substitutes = true;
|
|
};
|
|
}
|