View source for Attic on Nix Darwin

Here are some snippets of code required to configure and run [https://docs.attic.rs/ attic] on macOS with [https://github.com/LnL7/nix-darwin <code>nix-darwin</code>], and use it as an optional cache.

<span id="files-required"></span>
= Files required =

To make <code>nix-darwin</code> configure attic correctly, you need a configuration module̵ <code>attic.nix</code> and a configuration <code>atticd.toml</code> for attic to use during runtime to use the correct paths for storage.

<span id="user-creation"></span>
= User creation =

First, create a user and group called <code>attic</code> to host the attic server on your machine. In the <code>attic.nix</code> file, add the following:

<syntaxhighlight lang="nix"># attic.nix
{ config, pkgs, ... }:
{
  users.groups.attic = {
    # Adjust the gid to your liking
    gid = 603;
  };
  users.users.attic = {
    createHome = false;
    description = "attic user";
    gid = 603;
    # Adjust the uid to your liking
    uid = 603;
    isHidden = true;
  };
  users.knownGroups = [ "attic" ];
  users.knownUsers = [ "attic" ];
}</syntaxhighlight>
This Nix configuration hides the attic user, and it can’t log in since shell set to <code>sbin/nologin</code>.

<span id="attic-configuration"></span>
= Attic configuration =

Create a configuration file <code>atticd.toml</code> and add the following contents:

<pre class="toml"># atticd.toml
# Socket address to listen on, you might want to adjust the port used.
listen = &quot;127.0.0.1:18080&quot;

# Optionally, configure allowed hosts here
allowed-hosts = []

[database]
# Attic's database is located in /var/attic/db.sqlite
url = &quot;sqlite:///var/attic/db.sqlite?mode=rwc&quot;

# Whether to enable sending on periodic heartbeat queries
#
# If enabled, a heartbeat query will be sent every minute
#heartbeat = false

[storage]
# Store everything locally in /var/attic/storage
type = &quot;local&quot;
path = &quot;/var/attic/storage&quot;

# Default values from
# https://github.com/zhaofengli/attic/blob/main/server/src/config-template.toml
[chunking]
nar-size-threshold = 65536 # chunk files that are 64 KiB or larger
min-size = 16384            # 16 KiB
avg-size = 65536            # 64 KiB
max-size = 262144           # 256 KiB

[compression]
type = &quot;zstd&quot;
#level = 8

[garbage-collection]
# The frequency to run garbage collection at
interval = &quot;12 hours&quot;</pre>
Write the attic configuration to <code>/etc/attic/atticd.toml</code> using the following Nix snippet:

<syntaxhighlight lang="nix"># attic.nix
{ config, pkgs, ... }:
{
  # ...
  environment.etc = {
    atticd = {
      source = ./atticd.toml;
      target = "attic/atticd.toml";
    };
  };
  # ...
}</syntaxhighlight>
<span id="credentials-file"></span>
= Credentials file =

Next, feed 32 bytes of random data into <code>base64</code>. Pipe these 32 bytes into a secret, read-only file that only <code>attic</code> can open:

<syntaxhighlight lang="bash">openssl rand 32 |
  base64 |
  sudo tee /etc/attic/secret.base64 > /dev/null
sudo chown attic:attic /etc/attic/secret.base64
sudo chmod 400 /etc/attic/secret.base64</syntaxhighlight>
<span id="attic-service-file"></span>
= Attic service file =

Next, tell <code>nix-darwin</code> to add a launchd service using the following snippet in the same <code>attic.nix</code> file:

<syntaxhighlight lang="nix"># attic.nix
{ config, pkgs, ... }:
let
  logPath = "/var/log/atticd";
  attic-client = pkgs.attic-client;
  attic-server = pkgs.attic-server;
in
{
  environment.systemPackages = [
    attic-client
    attic-server
  ];
  launchd.daemons.attic = {
    script = ''
      ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64="$(cat /etc/attic/secret.base64)"
      export ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64
      exec ${attic-server}/bin/atticd --config /etc/attic/atticd.toml
    '';
    serviceConfig = {
      KeepAlive = true;
      StandardOutPath = "${logPath}/attic.stdout.log";
      StandardErrorPath = "${logPath}/attic.stderr.log";
      UserName = "attic";
    };
  };
}</syntaxhighlight>
The preceding launchd daemon script reads the attic secret token into an environment variable and starts the attic server using the configuration stored in <code>atticd.toml</code>.

Make sure that you have a attic runtime directory:

<syntaxhighlight lang="bash">sudo mkdir -m700 /var/attic
sudo chown attic:attic /var/attic</syntaxhighlight>
<span id="configuring-the-client"></span>
= Configuring the client =

Import <code>attic.nix</code> into your main <code>nix-darwin</code> configuration:

<syntaxhighlight lang="nix"># darwin-configuration.nix
{ config, pkgs, ... }:
{
  imports = [
    # ...
    ./attic.nix
    # ...
  ];
}</syntaxhighlight>
Then, rebuild your <code>nix-darwin</code> system using <code>darwin-rebuild switch</code>. On my system, I use the following invocation:

<syntaxhighlight lang="bash">darwin-rebuild switch --flake $DOTFILES/nix/generic</syntaxhighlight>
Next, create a JSON Web Token (JWT) for a cache named after your computer’s name. You can use this JWT with your local Nix builder:

<syntaxhighlight lang="bash">sudo -u attic \
  ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64="$(sudo -u attic cat /etc/attic/secret.base64)" \
  atticadm make-token \
  --config /etc/attic/atticd.toml \
  --sub "$(hostname)" \
  --validity "1 month" \
  --pull "$(hostname)-*" \
  --push "$(hostname)-*" \
  --delete "$(hostname)-*" \
  --create-cache "$(hostname)-*" \
  --configure-cache "$(hostname)-*" \
  --configure-cache-retention "$(hostname)-*" \
  --destroy-cache "$(hostname)-*"</syntaxhighlight>
The JWT created in his preceding <code>make-token</code> command has broad permissions. Please adjust permissions to your liking. attic outputs the JWT token in your shell session.

Finally, try logging in with the generated token:

<syntaxhighlight lang="bash"># Port configured in atticd.toml
attic login "$(hostname)" http://127.0.0.1:18080 "$YOUR_TOKEN"</syntaxhighlight>
Did it work? Great. To tell the Nix builder to use attic as its cache, it needs to have credentials available in a <code>netrc</code> file. Furthermore, you need to add the cache’s public key as a trusted key.

First, retrieve the public key and <code>netrc</code> file. The preceding <code>attic login</code> invocation created a <code>config.toml</code> file in <code>$HOME/.config/attic</code>, which conveniently contains the JWT token for a <code>netrc</code> file.

<syntaxhighlight lang="bash"># This will try to grab the netrc information that attic created after logging
# in
sed -n -E -e 's/token = "(.+)"/machine .+\npassword \1/p' \
  $HOME/.config/attic/config.toml |
  sudo tee /etc/nix/netrc
sudo chmod 440 /etc/nix/netrc
# Let me know if this sed expression worked</syntaxhighlight>
You can show the public key using <code>attic cache info</code>:

<syntaxhighlight lang="bash">attic cache info "$(hostname)-default"</syntaxhighlight>
You should see the following output:

<pre>               Public: false
           Public Key: XXXXXXX-default:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Binary Cache Endpoint: https://XXXXXXXXXXXXX:18080/XXXXXXX-default
         API Endpoint: https://XXXXXXXXXXXXX:18080/
      Store Directory: /nix/store
             Priority: 41
  Upstream Cache Keys: [&quot;cache.nixos.org-1&quot;]
     Retention Period: Global Default</pre>
Store the preceding information in <code>attic.nix</code>:

<syntaxhighlight lang="nix"># attic.nix
{ ... } :
let
  # make sure to insert the correct hostname here:
  hostname = "your-hostname";
  # Insert the public key that you have created in the previous step
  public-key = "";
  # Make sure the hostname, port, and cache name are correct
  cache-url = "http://127.0.0.1:18080/${hostname}-default";
in
{
  nix.settings.substituters = [ cache-url ];
  nix.settings.trusted-public-keys = [

    "${hostname}-default:${public-key}"
  ];
  nix.settings.trusted-substituters = [ cache-url ];
  # This file was created using the preceding sed script
  nix.settings.netrc-file = "/etc/nix/netrc";
}</syntaxhighlight>
<span id="testing-the-cache"></span>
= Testing the cache =

Now, rebuild <code>nix-darwin</code> one more time. Every time you run Nix commands after that, Nix consults the local attic cache first. You can try this with any command:

<syntaxhighlight lang="bash"># This will look up hello in your local cache first
nix run nixpkgs#hello</syntaxhighlight>
<span id="troubleshooting"></span>
= Troubleshooting =

Does Nix complain that your local cache isn’t a binary cache? Check that you can access the attic cache using curl first:

<syntaxhighlight lang="bash"># Might have copy the netrc file somewhere user-readable
curl --netrc-file /etc/nix/netrc -v -n \
  "http://localhost:18080/$(hostname)-default/nix-cache-info"</syntaxhighlight>
You should be able to see the following result:

<pre>[...]
&lt; content-type: text/x-nix-cache-info
&lt; date: Sat, 07 Sep 2024 08:15:50 GMT
&lt; content-length: 51
&lt;
WantMassQuery: 1
StoreDir: /nix/store
Priority: 41
[...]</pre>
This way, you can see if the credentials are correct or not, and if your computer can reach attic at all.

Furthermore, watch the attic logs under <code>/var/log/atticd</code> for any error messages. You should be able to observe the following log output:

<pre>==&gt; /var/log/atticd/attic.stderr.log &lt;==
[...]
Attic Server 0.1.0 (release)
Running migrations...
Starting API server...
Listening on 127.0.0.1:18080...

==&gt; /var/log/atticd/attic.stdout.log &lt;==</pre>
<span id="further-reading"></span>
= Further reading =

* <code>nix-darwin</code>: https://github.com/LnL7/nix-darwin
* attic source code repository: https://github.com/zhaofengli/attic
* attic NixOS configuration: https://github.com/zhaofengli/attic/blob/main/nixos/atticd.nix
* How to serve and configure Nix store (not cache) via HTTP: https://nix.dev/manual/nix/2.18/package-management/binary-cache-substituter