Cachix

NixCI can pull from and push to the Cachix caches that you list in your NixCI configuration. Pulling needs no secret for a public cache. Pushing needs a secret.

Builds use the NixCI cache whether or not you configure Cachix.

List each cache under cachix with its name and public key. This example pulls from and pushes to my-cache:

{
  cachix = {
    name = "my-cache";
    public-key = "my-cache.cachix.org-1:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
    push = true;
  };
}

NixCI ignores the nixConfig of your flake.nix, so a cache that is only listed there is not used.

NixCI pulls from every cache that you list. To pull from a private cache, add a Cachix auth token as a secret named CACHIX_AUTH_TOKEN, or whatever the cache's auth-token-secret says.

To push to a cache, NixCI uses one of these secrets:

• CACHIX_AUTH_TOKEN (preferred), or
• CACHIX_SIGNING_KEY

Whether it pushes depends on the cache's push:

• Unset: NixCI pushes when the repository has either secret, and only pulls otherwise.
• push = true;: NixCI pushes, and a run fails without either secret.
• push = false;: NixCI only pulls, whatever secrets the repository has.

cachix: # optional
  # default: []
  # Cachix caches to pull from and push to
  # any of
  [ # CachixConfiguration
    name: # required
      # Name of the cache
      <string>
    public-key: # required
      # Public key of the cache, to trust what is pulled from it.
      <string>
    push: # optional
      # Whether to push what is built to the cache, with the secret named by auth-token-secret or else signing-key-secret.
      # When true, a run fails without either secret.
      # When false, neither secret is used to push.
      # When unset, NixCI pushes if either secret exists and only pulls otherwise.
      <boolean>
    auth-token-secret: # optional
      # default: CACHIX_AUTH_TOKEN
      # Name of the repository secret holding a Cachix auth token.
      # Used to push, and to pull from a private cache.
      <string>
    signing-key-secret: # optional
      # default: CACHIX_SIGNING_KEY
      # Name of the repository secret holding the signing key of the cache.
      # Used to push when there is no auth token.
      <string>
  , - # CachixConfiguration
      name: # required
        # Name of the cache
        <string>
      public-key: # required
        # Public key of the cache, to trust what is pulled from it.
        <string>
      push: # optional
        # Whether to push what is built to the cache, with the secret named by auth-token-secret or else signing-key-secret.
        # When true, a run fails without either secret.
        # When false, neither secret is used to push.
        # When unset, NixCI pushes if either secret exists and only pulls otherwise.
        <boolean>
      auth-token-secret: # optional
        # default: CACHIX_AUTH_TOKEN
        # Name of the repository secret holding a Cachix auth token.
        # Used to push, and to pull from a private cache.
        <string>
      signing-key-secret: # optional
        # default: CACHIX_SIGNING_KEY
        # Name of the repository secret holding the signing key of the cache.
        # Used to push when there is no auth token.
        <string>
  ]