rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

drop lantian attic cache (compromised)

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-10-19 09:36:50 +01:00
parent 8dab56de4f
commit 89c0205fe2
3 changed files with 10 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

8
common.nix
View file

@ -69,13 +69,13 @@ let
# always evaluates on the machine it runs on (--build-host ships the # always evaluates on the machine it runs on (--build-host ships the
# derivation, not the expression), so the only way to move eval off a client # derivation, not the expression), so the only way to move eval off a client
# is to run nix on the server over SSH and hand the resulting closure to # is to run nix on the server over SSH and hand the resulting closure to
# --store-path, which skips eval and build entirely. Same lantian substituter # --store-path, which skips eval and build entirely. --out-link keeps a gc
# as services/prebuild.nix, and --out-link keeps a gc root on the server so # root on the server so `clean` there can't reap the closure mid-copy.
# `clean` there can't reap the closure mid-copy. SSH and the copy run as # SSH and the copy run as
# fred, not root: root has no key on the server, and require-sigs = false # fred, not root: root has no key on the server, and require-sigs = false
# below is a daemon setting, so the daemon takes the unsigned closure from an # below is a daemon setting, so the daemon takes the unsigned closure from an
# untrusted user just fine. Only the activation needs sudo. # untrusted user just fine. Only the activation needs sudo.
remoteUpdate = "bash -c 'set -o pipefail && OLD_SYSTEM=$(readlink /run/current-system) && NEW=$(ssh fred@nordhammer.it \"nix build --refresh --print-out-paths --out-link prebuild-${config.networking.hostName} --option extra-substituters https://attic.xuyh0120.win/lantian --option extra-trusted-public-keys lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc= ${flake}#nixosConfigurations.${config.networking.hostName}.config.system.build.toplevel\") && nix copy --from ssh://fred@nordhammer.it $NEW --log-format internal-json 2>&1 | ${copyBar}/bin/nix-copy-bar && sudo nixos-rebuild switch --no-reexec --store-path $NEW && ${post}'"; remoteUpdate = "bash -c 'set -o pipefail && OLD_SYSTEM=$(readlink /run/current-system) && NEW=$(ssh fred@nordhammer.it \"nix build --refresh --print-out-paths --out-link prebuild-${config.networking.hostName} ${flake}#nixosConfigurations.${config.networking.hostName}.config.system.build.toplevel\") && nix copy --from ssh://fred@nordhammer.it $NEW --log-format internal-json 2>&1 | ${copyBar}/bin/nix-copy-bar && sudo nixos-rebuild switch --no-reexec --store-path $NEW && ${post}'";
in in
{ {
imports = [ imports = [

13
hosts/hardware/FredOS-Gaming.nix
View file

@ -8,16 +8,9 @@
nixpkgs.overlays = [ inputs.nix-cachyos-kernel.overlays.pinned ]; nixpkgs.overlays = [ inputs.nix-cachyos-kernel.overlays.pinned ];
boot.kernelPackages = lib.mkForce pkgs.cachyosKernels.linuxPackages-cachyos-bore; boot.kernelPackages = lib.mkForce pkgs.cachyosKernels.linuxPackages-cachyos-bore;
# garnix.io shut down July 2026; lantian's attic cache still serves the # No binary cache for the cachyos kernel: garnix.io shut down July 2026 and
# cachyos kernel builds. # lantian's attic (and its signing key) was dropped after the October 2026
nix.settings = { # server compromise (xddxdd/nix-cachyos-kernel#110). The server builds it.
substituters = [
"https://attic.xuyh0120.win/lantian"
];
trusted-public-keys = [
"lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc="
];
};
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ]; boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
boot.initrd.kernelModules = [ "amdgpu" ]; boot.initrd.kernelModules = [ "amdgpu" ];

9
services/prebuild.nix
View file

@ -52,14 +52,11 @@ let
Type = "oneshot"; Type = "oneshot";
StateDirectory = "prebuild"; StateDirectory = "prebuild";
}; };
# Gaming's kernel comes from lantian's attic (see hosts/hardware/ # Gaming's cachyos kernel has no binary cache any more (see hosts/
# FredOS-Gaming.nix). That substituter isn't configured on this host, so # hardware/FredOS-Gaming.nix), so a kernel bump builds from source here —
# without it the cachyos kernel gets built from source here instead of # hours, not minutes. That's what this nightly prebuild absorbs.
# fetched — hours, not minutes. Harmless for the Macbook.
script = '' script = ''
${config.nix.package}/bin/nix build --refresh \ ${config.nix.package}/bin/nix build --refresh \
--option extra-substituters https://attic.xuyh0120.win/lantian \
--option extra-trusted-public-keys lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc= \
--out-link /var/lib/prebuild/${host} \ --out-link /var/lib/prebuild/${host} \
'git+https://forg.gregersen.it/rope/nixos#nixosConfigurations.${host}.config.system.build.toplevel' 'git+https://forg.gregersen.it/rope/nixos#nixosConfigurations.${host}.config.system.build.toplevel'
''; '';