Justus: Add to Garden

2026-01-30T06:50:58Z

Add to Garden

← Older revision		Revision as of 06:50, 30 January 2026
Line 262:		Line 262:
	* attic NixOS configuration: https://github.com/zhaofengli/attic/blob/main/nixos/atticd.nix		* attic NixOS configuration: https://github.com/zhaofengli/attic/blob/main/nixos/atticd.nix
	* How to serve and configure Nix store (not cache) via HTTP: https://nix.dev/manual/nix/2.18/package-management/binary-cache-substituter		* How to serve and configure Nix store (not cache) via HTTP: https://nix.dev/manual/nix/2.18/package-management/binary-cache-substituter
			[[Category:Garden]]

Justus: Created page with "Here are some snippets of code required to configure and run [https://docs.attic.rs/ attic] on macOS with [https://github.com/LnL7/nix-darwin `nix-darwin`], and use it as an optional cache. = Files required = To make `nix-darwin` configure attic correctly, you need a configuration module̵ `attic.nix` and a configuration `atticd.toml` for attic to use during runtime to use the correct paths f..."

2026-01-30T05:01:41Z

Created page with "Here are some snippets of code required to configure and run [https://docs.attic.rs/ attic] on macOS with [https://github.com/LnL7/nix-darwin <code>nix-darwin</code>], and use it as an optional cache. = Files required = To make <code>nix-darwin</code> configure attic correctly, you need a configuration module̵ <code>attic.nix</code> and a configuration <code>atticd.toml</code> for attic to use during runtime to use the correct paths f..."

New page

Here are some snippets of code required to configure and run [https://docs.attic.rs/ attic] on macOS with [https://github.com/LnL7/nix-darwin <code>nix-darwin</code>], and use it as an optional cache.


= Files required =

To make <code>nix-darwin</code> configure attic correctly, you need a configuration module̵ <code>attic.nix</code> and a configuration <code>atticd.toml</code> for attic to use during runtime to use the correct paths for storage.


= User creation =

First, create a user and group called <code>attic</code> to host the attic server on your machine. In the <code>attic.nix</code> file, add the following:

<syntaxhighlight lang="nix"># attic.nix
{ config, pkgs, ... }:
{
users.groups.attic = {
# Adjust the gid to your liking
gid = 603;
};
users.users.attic = {
createHome = false;
description = "attic user";
gid = 603;
# Adjust the uid to your liking
uid = 603;
isHidden = true;
};
users.knownGroups = [ "attic" ];
users.knownUsers = [ "attic" ];
}</syntaxhighlight>
This Nix configuration hides the attic user, and it can’t log in since shell set to <code>sbin/nologin</code>.


= Attic configuration =

Create a configuration file <code>atticd.toml</code> and add the following contents:

<pre class="toml"># atticd.toml
# Socket address to listen on, you might want to adjust the port used.
listen = "127.0.0.1:18080"

# Optionally, configure allowed hosts here
allowed-hosts = []

[database]
# Attic's database is located in /var/attic/db.sqlite
url = "sqlite:///var/attic/db.sqlite?mode=rwc"

# Whether to enable sending on periodic heartbeat queries
#
# If enabled, a heartbeat query will be sent every minute
#heartbeat = false

[storage]
# Store everything locally in /var/attic/storage
type = "local"
path = "/var/attic/storage"

# Default values from
# https://github.com/zhaofengli/attic/blob/main/server/src/config-template.toml
[chunking]
nar-size-threshold = 65536 # chunk files that are 64 KiB or larger
min-size = 16384 # 16 KiB
avg-size = 65536 # 64 KiB
max-size = 262144 # 256 KiB

[compression]
type = "zstd"
#level = 8

[garbage-collection]
# The frequency to run garbage collection at
interval = "12 hours"</pre>
Write the attic configuration to <code>/etc/attic/atticd.toml</code> using the following Nix snippet:

<syntaxhighlight lang="nix"># attic.nix
{ config, pkgs, ... }:
{
# ...
environment.etc = {
atticd = {
source = ./atticd.toml;
target = "attic/atticd.toml";
};
};
# ...
}</syntaxhighlight>

= Credentials file =

Next, feed 32 bytes of random data into <code>base64</code>. Pipe these 32 bytes into a secret, read-only file that only <code>attic</code> can open:

<syntaxhighlight lang="bash">openssl rand 32 |
base64 |
sudo tee /etc/attic/secret.base64 > /dev/null
sudo chown attic:attic /etc/attic/secret.base64
sudo chmod 400 /etc/attic/secret.base64</syntaxhighlight>

= Attic service file =

Next, tell <code>nix-darwin</code> to add a launchd service using the following snippet in the same <code>attic.nix</code> file:

<syntaxhighlight lang="nix"># attic.nix
{ config, pkgs, ... }:
let
logPath = "/var/log/atticd";
attic-client = pkgs.attic-client;
attic-server = pkgs.attic-server;
in
{
environment.systemPackages = [
attic-client
attic-server
];
launchd.daemons.attic = {
script = ''
ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64="$(cat /etc/attic/secret.base64)"
export ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64
exec ${attic-server}/bin/atticd --config /etc/attic/atticd.toml
'';
serviceConfig = {
KeepAlive = true;
StandardOutPath = "${logPath}/attic.stdout.log";
StandardErrorPath = "${logPath}/attic.stderr.log";
UserName = "attic";
};
};
}</syntaxhighlight>
The preceding launchd daemon script reads the attic secret token into an environment variable and starts the attic server using the configuration stored in <code>atticd.toml</code>.

Make sure that you have a attic runtime directory:

<syntaxhighlight lang="bash">sudo mkdir -m700 /var/attic
sudo chown attic:attic /var/attic</syntaxhighlight>

= Configuring the client =

Import <code>attic.nix</code> into your main <code>nix-darwin</code> configuration:

<syntaxhighlight lang="nix"># darwin-configuration.nix
{ config, pkgs, ... }:
{
imports = [
# ...
./attic.nix
# ...
];
}</syntaxhighlight>
Then, rebuild your <code>nix-darwin</code> system using <code>darwin-rebuild switch</code>. On my system, I use the following invocation:

<syntaxhighlight lang="bash">darwin-rebuild switch --flake $DOTFILES/nix/generic</syntaxhighlight>
Next, create a JSON Web Token (JWT) for a cache named after your computer’s name. You can use this JWT with your local Nix builder:

<syntaxhighlight lang="bash">sudo -u attic \
ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64="$(sudo -u attic cat /etc/attic/secret.base64)" \
atticadm make-token \
--config /etc/attic/atticd.toml \
--sub "$(hostname)" \
--validity "1 month" \
--pull "$(hostname)-*" \
--push "$(hostname)-*" \
--delete "$(hostname)-*" \
--create-cache "$(hostname)-*" \
--configure-cache "$(hostname)-*" \
--configure-cache-retention "$(hostname)-*" \
--destroy-cache "$(hostname)-*"</syntaxhighlight>
The JWT created in his preceding <code>make-token</code> command has broad permissions. Please adjust permissions to your liking. attic outputs the JWT token in your shell session.

Finally, try logging in with the generated token:

<syntaxhighlight lang="bash"># Port configured in atticd.toml
attic login "$(hostname)" http://127.0.0.1:18080 "$YOUR_TOKEN"</syntaxhighlight>
Did it work? Great. To tell the Nix builder to use attic as its cache, it needs to have credentials available in a <code>netrc</code> file. Furthermore, you need to add the cache’s public key as a trusted key.

First, retrieve the public key and <code>netrc</code> file. The preceding <code>attic login</code> invocation created a <code>config.toml</code> file in <code>$HOME/.config/attic</code>, which conveniently contains the JWT token for a <code>netrc</code> file.

<syntaxhighlight lang="bash"># This will try to grab the netrc information that attic created after logging
# in
sed -n -E -e 's/token = "(.+)"/machine .+\npassword \1/p' \
$HOME/.config/attic/config.toml |
sudo tee /etc/nix/netrc
sudo chmod 440 /etc/nix/netrc
# Let me know if this sed expression worked</syntaxhighlight>
You can show the public key using <code>attic cache info</code>:

<syntaxhighlight lang="bash">attic cache info "$(hostname)-default"</syntaxhighlight>
You should see the following output:

<pre> Public: false
Public Key: XXXXXXX-default:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Binary Cache Endpoint: https://XXXXXXXXXXXXX:18080/XXXXXXX-default
API Endpoint: https://XXXXXXXXXXXXX:18080/
Store Directory: /nix/store
Priority: 41
Upstream Cache Keys: ["cache.nixos.org-1"]
Retention Period: Global Default</pre>
Store the preceding information in <code>attic.nix</code>:

<syntaxhighlight lang="nix"># attic.nix
{ ... } :
let
# make sure to insert the correct hostname here:
hostname = "your-hostname";
# Insert the public key that you have created in the previous step
public-key = "";
# Make sure the hostname, port, and cache name are correct
cache-url = "http://127.0.0.1:18080/${hostname}-default";
in
{
nix.settings.substituters = [ cache-url ];
nix.settings.trusted-public-keys = [

"${hostname}-default:${public-key}"
];
nix.settings.trusted-substituters = [ cache-url ];
# This file was created using the preceding sed script
nix.settings.netrc-file = "/etc/nix/netrc";
}</syntaxhighlight>

= Testing the cache =

Now, rebuild <code>nix-darwin</code> one more time. Every time you run Nix commands after that, Nix consults the local attic cache first. You can try this with any command:

<syntaxhighlight lang="bash"># This will look up hello in your local cache first
nix run nixpkgs#hello</syntaxhighlight>

= Troubleshooting =

Does Nix complain that your local cache isn’t a binary cache? Check that you can access the attic cache using curl first:

<syntaxhighlight lang="bash"># Might have copy the netrc file somewhere user-readable
curl --netrc-file /etc/nix/netrc -v -n \
"http://localhost:18080/$(hostname)-default/nix-cache-info"</syntaxhighlight>
You should be able to see the following result:

<pre>[...]
< content-type: text/x-nix-cache-info
< date: Sat, 07 Sep 2024 08:15:50 GMT
< content-length: 51
<
WantMassQuery: 1
StoreDir: /nix/store
Priority: 41
[...]</pre>
This way, you can see if the credentials are correct or not, and if your computer can reach attic at all.

Furthermore, watch the attic logs under <code>/var/log/atticd</code> for any error messages. You should be able to observe the following log output:

<pre>==> /var/log/atticd/attic.stderr.log <==
[...]
Attic Server 0.1.0 (release)
Running migrations...
Starting API server...
Listening on 127.0.0.1:18080...

==> /var/log/atticd/attic.stdout.log <==</pre>

= Further reading =

* <code>nix-darwin</code>: https://github.com/LnL7/nix-darwin
* attic source code repository: https://github.com/zhaofengli/attic
* attic NixOS configuration: https://github.com/zhaofengli/attic/blob/main/nixos/atticd.nix
* How to serve and configure Nix store (not cache) via HTTP: https://nix.dev/manual/nix/2.18/package-management/binary-cache-substituter

Attic on Nix Darwin - Revision history

Justus: Add to Garden