imxyy1soope1/nixos-dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Activity

nix: nix-racer -> selector4nix

Browse Source 
Replace the vendored nix-racer Rust proxy with selector4nix as the local
substituter proxy. Drop the nix-racer crate and its systemd service, add
the selector4nix flake input, repoint nix.settings.substituters at its
port, and load upstream nixos modules via an upstreamModules list in
flake/hosts.nix.
This commit is contained in:
imxyy1soope1
2026-08-08 21:36:18 +08:00
parent 96de1d082c
commit 1cf0d8fed2
10 changed files with 128 additions and 2565 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/core/nix.nix
+29 -82
View File
@@ -32,99 +32,46 @@ in
nh
];
environment.etc =
(lib.mapAttrs' (name: value: {
environment.etc = (
lib.mapAttrs' (name: value: {
name = "nix/path/${name}";
value.source = value.flake;
}) config.nix.registry)
// {
"nix/nix-racer.toml".source = (pkgs.formats.toml { }).generate "nix-racer.toml" {
listen = "127.0.0.1:2048";
substituters = [
# {
# penalty = 0;
# url = "https://mirror.sjtu.edu.cn/nix-channels/store";
# }
{
penalty = 0;
url = "https://mirrors.sjtug.sjtu.edu.cn/nix-channels/store";
}
{
penalty = 50;
url = "https://mirrors.ustc.edu.cn/nix-channels/store";
}
{
penalty = 0;
url = "https://nix-community.cachix.org";
}
{
penalty = 0;
url = "https://cache.numtide.com";
}
{
penalty = 100;
url = "https://cache.nixos.org";
}
];
};
};
}) config.nix.registry
);
systemd.services.nix-racer = {
description = "Nix substituter proxy with parallel cache queries and latency-aware selection";
wantedBy = [ "multi-user.target" ];
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
serviceConfig = {
Type = "simple";
ExecStart = "${lib.getExe (pkgs.callPackage ./nix-racer/_package.nix { })}";
Restart = "on-failure";
RestartSec = 5;
DynamicUser = true;
CapabilityBoundingSet = [ "" ];
DeviceAllow = "";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectSystem = "strict";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
services.selector4nix = {
enable = true;
configureSubstituter = "keep";
settings = {
server.port = 5496;
substituters = [
{
url = "https://mirror.sjtu.edu.cn/nix-channels/store";
}
{
url = "https://mirrors.sjtug.sjtu.edu.cn/nix-channels/store";
}
{
url = "https://mirrors.ustc.edu.cn/nix-channels/store";
}
{
url = "https://nix-community.cachix.org";
}
{
url = "https://cache.numtide.com";
}
{
url = "https://cache.nixos.org";
}
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@resources"
"~@privileged"
];
UMask = "0077";
};
};
nix.settings = {
experimental-features = "nix-command flakes pipe-operators";
substituters = lib.mkForce [
"http://127.0.0.1:2048"
"https://mirrors.sjtug.sjtu.edu.cn/nix-channels/store"
"https://cache.numtide.com"
"http://127.0.0.1:${toString (config.services.selector4nix.settings.server.port or 5496)}"
"https://cache.nixos.org"
# "https://mirrors.ustc.edu.cn/nix-channels/store"
# "https://mirrors.sjtug.sjtu.edu.cn/nix-channels/store"
# "https://nix-community.cachix.org"
];
trusted-public-keys = [
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="