Nix 二进制缓存与替换器：substituters、签名与自建缓存

nix build nixpkgs#firefox                 # 优先用缓存
nix build --option substitute false nixpkgs#hello   # 强制本地构建
nix build --no-require-sigs ...           # 允许未签名缓存（见第 3 节）

# /etc/nix/nix.conf
substituters = https://cache.nixos.org https://my-cache.example.com
trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= my-cache-1:abc...=

# 临时覆盖（命令行）
nix build --substituters https://my-cache.example.com nixpkgs#hello

# 用户级
mkdir -p ~/.config/nix
echo 'substituters = https://my-cache.example.com' >> ~/.config/nix/nix.conf

# 1. 信任官方缓存
trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=

# 2. 信任自建缓存（多公钥用空格分隔）
trusted-public-keys = cache.nixos.org-1:... my-cache-1:abc123...=

# 3. 单次绕过（仅调试，生产禁用）
nix build --no-require-sigs --substituters https://untrusted.example.com ...

StorePath: /nix/store/zzz-hello-2.12.1
URL: nar/1abc...def.nar.xz
Compression: xz
FileHash: sha256:2ghi...=
FileSize: 204800
NarHash: sha256:3jkl...=
NarSize: 655360
References: ccc-glibc-2.38-4 aaa-hello-2.12.1
Deriver: xxx-hello-2.12.1.drv
Sig: my-cache-1:base64signature...

# 手动导出某路径为 nar 并查看大小
nix-store --dump /nix/store/zzz-hello | wc -c

# 从 nar 恢复
nix-store --restore ./out < <(nix-store --dump /nix/store/zzz-hello)

# 直接 curl narinfo（以官方缓存为例）
curl -s https://cache.nixos.org/zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.narinfo

# nix 自带的查询
nix path-info --store https://cache.nixos.org -S nixpkgs#hello

# NixOS 配置
services.nix-serve = {
  enable = true;
  port = 5000;
  secretKeyFile = "/var/lib/nix-serve/cache-priv-key.pem";
};

services.harmonia = {
  enable = true;
  settings = {
    bind = "[::]:5000";
    sign_key = "/var/lib/harmonia/cache-priv-key.pem";
  };
};

# 生成密钥对（写入当前目录）
nix-store --generate-binary-cache-key my-cache-1 ./cache-priv-key.pem ./cache-pub-key.pem

# 公钥内容形如：
# my-cache-1:AbCdEf...=

# 推送到远程 HTTP 缓存（需该缓存支持写入，或推送目标为 ssh store）
nix copy --to https://my-cache.example.com ./result

# 用私钥边推边签
nix copy --to https://my-cache.example.com --secret-key-files ./cache-priv-key.pem ./result

# 推送到 ssh store（目标机 store 本身即缓存源）
nix copy --to ssh://builder@cache-host ./result

# 1. 对 store 路径签名
nix store sign --key-file ./cache-priv-key.pem /nix/store/zzz-hello

# 2. 推送到缓存（签名信息随 narinfo 一起上传）
nix copy --to https://my-cache.example.com /nix/store/zzz-hello

nix store verify --store https://my-cache.example.com --trusted-public-keys "$(cat cache-pub-key.pem)" /nix/store/zzz-hello

s3://my-nix-cache/
├── nix-cache-info              # 缓存元信息（StoreDir、WantMassQuery 等）
├── zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.narinfo
├── nar/
│   └── 1abc...def.nar.xz

StoreDir: /nix/store
WantMassQuery: 1
Priority: 40

nix copy --to 's3://my-nix-cache?region=us-east-1' --secret-key-files ./cache-priv-key.pem ./result

# /etc/nix/nix.conf
experimental-features = nix-command flakes
substituters = https://my-cache.example.com https://cache.nixos.org
trusted-public-keys = my-cache-1:AbCdEf...= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
trusted-substituters = https://my-cache.example.com
connect-timeout = 5

nix.settings = {
  substituters = [
    "https://my-cache.example.com"
    "https://cache.nixos.org"
  ];
  trusted-public-keys = [
    "my-cache-1:AbCdEf...="
    "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
  ];
};

# 1. 确认实际生效的配置
nix config show | grep -E 'substituters|trusted-public-keys'

# 2. 确认用户是否 trusted（非 trusted 用户的 substituters 设置被忽略）
nix config show | grep trusted-users

# 3. 手动询问缓存
nix path-info --store https://my-cache.example.com /nix/store/zzz-hello

error: path '/nix/store/zzz-hello' is not valid

error: path '/nix/store/zzz-hello' already exists in the store

nix copy --to https://my-cache.example.com \
  --parallel-connections 4 \
  --retry 3 \
  ./result