Wire Forge-native release infrastructure

nixos/modules/burrow-nix-cache.nix

@@ -0,0 +1,162 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.burrow.nixCache;
+  garageCfg = config.services.burrow.garage;
+in
+{
+  options.services.burrow.nixCache = {
+    enable = lib.mkEnableOption "Burrow Nix binary cache";
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "nix.burrow.net";
+      description = "Public domain for the Burrow Nix binary cache.";
+    };
+
+    listenAddress = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      description = "Attic listen address.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8080;
+      description = "Attic listen port.";
+    };
+
+    cacheName = lib.mkOption {
+      type = lib.types.str;
+      default = "burrow";
+      description = "Default public Attic cache name.";
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.path;
+      default = garageCfg.environmentFile;
+      description = "Environment file containing Attic JWT and Garage S3 credentials.";
+    };
+
+    adminTokenFile = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/burrow/nix-cache/admin-token";
+      description = "Host-local file containing the generated Attic admin token.";
+    };
+
+    ciPushTokenFile = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/burrow/nix-cache/ci-push-token";
+      description = "Host-local file containing the generated Attic CI push token.";
+    };
+
+    ciPushTokenValidity = lib.mkOption {
+      type = lib.types.str;
+      default = "1y";
+      description = "Validity duration for the generated Attic CI push token.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = garageCfg.enable;
+        message = "services.burrow.nixCache requires services.burrow.garage.enable = true.";
+      }
+    ];
+
+    services.atticd = {
+      enable = true;
+      environmentFile = cfg.environmentFile;
+      settings = {
+        listen = "${cfg.listenAddress}:${toString cfg.port}";
+        allowed-hosts = [ cfg.domain ];
+        api-endpoint = "https://${cfg.domain}/";
+        require-proof-of-possession = true;
+        storage = {
+          type = "s3";
+          bucket = garageCfg.atticBucket;
+          region = garageCfg.region;
+          endpoint = "http://${garageCfg.apiListenAddress}:${toString garageCfg.apiPort}";
+        };
+      };
+    };
+
+    environment.systemPackages = [
+      pkgs.attic-client
+    ];
+
+    services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
+      encode gzip zstd
+      reverse_proxy ${cfg.listenAddress}:${toString cfg.port}
+    '';
+
+    systemd.services.atticd = {
+      after = [ "burrow-garage-bootstrap.service" ];
+      wants = [ "burrow-garage-bootstrap.service" ];
+      requires = [ "burrow-garage-bootstrap.service" ];
+    };
+
+    systemd.services.burrow-nix-cache-bootstrap = {
+      description = "Bootstrap Burrow Nix binary cache";
+      after = [ "atticd.service" ];
+      requires = [ "atticd.service" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [
+        pkgs.attic-client
+        pkgs.coreutils
+      ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+        Group = "root";
+      };
+      script = ''
+        set -euo pipefail
+
+        install -d -m 0700 "$(dirname ${lib.escapeShellArg cfg.adminTokenFile})"
+        install -d -m 0700 "$(dirname ${lib.escapeShellArg cfg.ciPushTokenFile})"
+
+        for _ in $(seq 1 60); do
+          if (: > /dev/tcp/${cfg.listenAddress}/${toString cfg.port}) >/dev/null 2>&1; then
+            break
+          fi
+          sleep 1
+        done
+
+        if [ ! -s ${lib.escapeShellArg cfg.adminTokenFile} ]; then
+          umask 077
+          atticd-atticadm make-token \
+            --sub burrow-nix-cache-bootstrap \
+            --validity 10y \
+            --create-cache '*' \
+            --pull '*' \
+            --push '*' \
+            --delete '*' \
+            --configure-cache '*' \
+            --configure-cache-retention '*' \
+            > ${lib.escapeShellArg cfg.adminTokenFile}
+        fi
+
+        token="$(cat ${lib.escapeShellArg cfg.adminTokenFile})"
+        export HOME=/var/lib/burrow/nix-cache
+        install -d -m 0700 "$HOME"
+
+        attic login local http://${cfg.listenAddress}:${toString cfg.port} "$token" --set-default
+        if ! attic cache info ${lib.escapeShellArg "local:${cfg.cacheName}"} >/dev/null 2>&1; then
+          attic cache create --public --priority 39 ${lib.escapeShellArg "local:${cfg.cacheName}"}
+        fi
+
+        if [ ! -s ${lib.escapeShellArg cfg.ciPushTokenFile} ]; then
+          umask 077
+          atticd-atticadm make-token \
+            --sub burrow-ci-cache-publisher \
+            --validity ${lib.escapeShellArg cfg.ciPushTokenValidity} \
+            --pull ${lib.escapeShellArg cfg.cacheName} \
+            --push ${lib.escapeShellArg cfg.cacheName} \
+            > ${lib.escapeShellArg cfg.ciPushTokenFile}
+        fi
+      '';
+    };
+  };
+}