plumjam/nixos - Change ADJBSSJQYK6JNUKKP4AOQWLBIXR2DUMBRWTGXJKZASF6M2BSFYCQC

object-storage: Replace nixServe with s3 bucket for caching.

Created by PlumJam on January 13, 2026

ADJBSSJQYK6JNUKKP4AOQWLBIXR2DUMBRWTGXJKZASF6M2BSFYCQC

Dependencies

In channels

main

Change contents

File deletion: plum-cache-key.age, key.age
BF:BFD[8.2] → [8.562:611]
BF:BFD[8.611] → [9.323:323]
BFD:BFD[9.304] → [9.751:789]
BF:BFD[9.789] → [9.323:323]
B:BD[9.323] → [9.324:346]
B:BD[9.346] → [10.589:925]
```
age-encryption.org/v1
```
File deletion: kiwi-cache-key.age, key.age
BF:BFD[8.2] → [8.973:1022]
BF:BFD[8.1022] → [11.1736:1736]
BFD:BFD[11.1717] → [11.2113:2151]
BF:BFD[11.2151] → [11.1736:1736]
B:BD[11.1736] → [11.1737:2112]
File addition: yuzu-nix-store-key.age (----------)
[8.2]
File addition: s3-secret-key.age (----------)
[8.2]
File addition: s3-access-key.age (----------)
[8.2]
File addition: fad17fe5d38aba521397c107ef65c9c1-s3SecretKey.age (----------)
[12.27]
File addition: 7c1a37883bd70a34a72528236fd607da-s3AccessKey.age (----------)
[12.27]
File addition: 013f3fb2c1fb4a5ec166f855ba451dbb-nixStoreKey.age (----------)
[12.27]
File deletion: 3d58c84ea17883e8e472a7bbc2380d2f-nixServeKey.age
BF:BFD[12.2685] → [12.6037:6116]
BF:BFD[12.6116] → [12.5639:5639]
B:BD[12.5639] → [12.5640:6036]
File addition: a3b1b6aa9018bb14164401403b7b2ed6-s3SecretKey.age (----------)
[12.2685]
File addition: 8a38405ee9a8b696e6566a862e325bdd-nixStoreKey.age (----------)
[12.2685]
File addition: 2b7b5c8f6b5417f8de50e9ee36990f83-s3AccessKey.age (----------)
[12.2685]
File deletion: c2fa51be502649aa766e7099e05a7464-nixServeKey.age
BF:BFD[12.11415] → [12.12730:12809]
BF:BFD[12.12809] → [12.12244:12244]
B:BD[12.12244] → [12.12245:12729]
File addition: de1e946878806afc534ceebb593e368b-s3SecretKey.age (----------)
[12.11415]
File addition: d8f81a3a9ed6586dd4eea8f786843289-s3AccessKey.age (----------)
[12.11415]
File addition: 7c6109483cc97ba977b38431761bdc30-nixStoreKey.age (----------)
[12.11415]
File addition: 91d8ee87a8a21c391fdf90ad2b5129cb-s3SecretKey.age (----------)
[12.16472]
File addition: 579247cd54e15e0ffd19385825a16149-s3AccessKey.age (----------)
[12.16472]
File addition: plum-nix-store-key.age (----------)
[8.2]
File addition: kiwi-nix-store-key.age (----------)
[8.2]
Replacement in modules/theme.json at line 2 [13.10167]
B:BD[13.10170] → [14.158:177]
```
  "mode": "light",
```
[13.10170]
[15.251]
```
  "mode": "dark",
```
Deletion in modules/rebuild.nix at line 48 [16.42448]
B:BD[2.2289] → [2.2289:2352]
```
            "--fallback" # Build locally if substituters fail.
```

File addition: object-storage.nix (----------)

[17.2]

{
  flake.modules.nixos.object-storage =
    {
      pkgs,
      config,
      lib,
      ...
    }:
    let
      inherit (lib.modules) mkIf;
      inherit (lib.meta) getExe;
      inherit (lib.attrsets) optionalAttrs;
      inherit (config.age) secrets;
      bucket = "plumjam";
      endpoint = "fsn1.your-objectstorage.com";
      s3Cache = "s3://${bucket}?endpoint=${endpoint}";
      setupScript = pkgs.writeShellScriptBin "s3-setup" ''
        #!/usr/bin/env bash
        set -euo pipefail
        # Minio client.
        mkdir -p "$HOME/.mc"
        ${getExe pkgs.minio-client} alias set plumjam-fsn1 \
          https://${endpoint} \
          "$(sudo cat ${secrets.s3AccessKey.path})" \
          "$(sudo cat ${secrets.s3SecretKey.path})" \
          --api s3v4 \
          --path off
        # Environment file for Nix S3 access.
        sudo mkdir -p /etc/nix
        accessKey=$(sudo cat ${secrets.s3AccessKey.path})
        secretKey=$(sudo cat ${secrets.s3SecretKey.path})
        sudo tee /etc/nix/s3-credentials > /dev/null <<EOF
        AWS_ACCESS_KEY_ID=$accessKey
        AWS_SECRET_ACCESS_KEY=$secretKey
        EOF
        sudo chmod 600 /etc/nix/s3-credentials
        # Set up post-build hook if we have a signing key.
        ${
          if secrets ? nixStoreKey then # sh
            ''
              sudo tee /etc/nix/post-build-hook.sh > /dev/null <<'HOOK'
              #!/bin/sh
              set -e
              # Read AWS credentials from agenix
              export AWS_ACCESS_KEY_ID=$(cat ${secrets.s3AccessKey.path})
              export AWS_SECRET_ACCESS_KEY=$(cat ${secrets.s3SecretKey.path})
              # Sign the output paths
              for output in $OUT_PATHS; do
                /run/current-system/sw/bin/nix store sign --recursive --key-file ${secrets.nixStoreKey.path} "$output" 2>/dev/null || true
              done
              # Upload to S3 cache
              for output in $OUT_PATHS; do
                /run/current-system/sw/bin/nix copy --to "${s3Cache}" "$output"
              done
              HOOK
              sudo chmod +x /etc/nix/post-build-hook.sh
              echo "Post-build hook configured at /etc/nix/post-build-hook.sh"
            ''
          else
            ""
        }
        echo "S3 setup complete."
        echo "  Bucket: ${bucket}"
        echo "  Endpoint: ${endpoint}"
        echo "  Substituter: ${s3Cache}"
        echo "  Signing key: ${if secrets ? nixStoreKey then "enabled" else "disabled"}"
      '';
    in
    mkIf (secrets ? s3AccessKey && secrets ? s3SecretKey) {
      environment.systemPackages = [
        pkgs.minio-client
        setupScript
      ];
      nix.settings = {
        extra-substituters = [ s3Cache ];
        extra-trusted-public-keys = [
          "yuzu-store.plumj.am:p6zQw/rR/i1GxTNYE9nNMgReiy2PuDwpq6aXW0DKfoo="
          "plum-store.plumj.am:LBmfncp/ftlagUEZOM0NWK2tTH4fIT0Bk2WEBU48CNM="
          "kiwi-store.plumj.am:PMlO9Tv8jZf5huFRsKWBD7ejVASjUXnZS1o7xpsN5hw="
          # TODO date-store
          # TODO ?lime-store?
          "blackwell-store.plumj.am:o9oPrcWuBcXiC0YJkf9pbxkITxc0qqS2aB8QKiYnzoo="
        ];
      }
      // optionalAttrs (secrets ? nixStoreKey) {
        post-build-hook = "/etc/nix/post-build-hook.sh";
        secret-key-files = secrets.nixStoreKey.path;
      };
    };
}

Replacement in modules/nix-settings.nix at line 41 [18.101]

B:BD[18.1786] → [6.143:164]

∅:D[6.164] → [18.1806:1866]

B:BD[18.1806] → [18.1806:1866]

B:BD[18.1866] → [6.165:225]

        (registryMap
        |> mapAttrsToList (name: value: "${name}=${value}")
        |> (if isDarwin then concatStringsSep ":" else id))

[18.1786]

[6.225]

        (
          registryMap
          |> mapAttrsToList (name: value: "${name}=${value}")
          |> (if isDarwin then concatStringsSep ":" else id)
        )

Deletion in modules/nix-settings.nix at line 53 [18.101]

B:BD[18.2104] → [18.2104:2204]

            "https://cache1.plumj.am?priority=10"
            "https://cache2.plumj.am?priority=10"

Deletion in modules/nix-settings.nix at line 58 [18.101]

B:BD[18.2343] → [18.2343:2493]

            "cache1.plumj.am:rFlt5V4tYjsyo3QMRsaoO9VGYISJR+45tT35/6BpKsA="
            "cache2.plumj.am:IoMjbQ43lgHh8gMoEJj/VYK8c3Xbpc/TLRPKAaQSGas="

Replacement in modules/nix-cache.nix at line 39 [19.32786]
B:BD[4.722] → [4.722:747]
```
          enable = true;
```
[4.722]
[20.861]
```
          enable = false;
```

Replacement in modules/nix-cache.nix at line 43 [19.32786]

∅:D[4.788] → [20.955:980]

B:BD[20.955] → [20.955:980]

B:BD[20.980] → [4.789:861]

          enable = true;
          signKeyPaths = singleton config.age.secrets.nixServeKey.path;

[4.788]

[20.1158]

          enable = false;
          signKeyPaths = singleton config.age.secrets.nixStoreKey.path;

Insertion in modules/hosts.nix at line 50 [21.110]
[21.664]
[21.664]
```
      object-storage
```

Insertion in modules/hosts.nix at line 93 [21.110]

[22.9065]

            s3AccessKey.rekeyFile = ../secrets/s3-access-key.age;
            s3SecretKey.rekeyFile = ../secrets/s3-secret-key.age;
            nixStoreKey.rekeyFile = ../secrets/yuzu-nix-store-key.age;

Insertion in modules/hosts.nix at line 143 [21.110]
[7.1194]
[7.1194]
```
      object-storage
```

Insertion in modules/hosts.nix at line 186 [21.110]

[7.2182]

            s3AccessKey.rekeyFile = ../secrets/s3-access-key.age;
            s3SecretKey.rekeyFile = ../secrets/s3-secret-key.age;
            # TODO
            # nixStoreKey.rekeyFile = ../secrets/date-nix-store-key.age;

Insertion in modules/hosts.nix at line 234 [21.110]
[23.1235]
[23.1235]
```
      object-storage
```

Insertion in modules/hosts.nix at line 283 [21.110]

[23.2343]

            s3AccessKey.rekeyFile = ../secrets/s3-access-key.age;
            s3SecretKey.rekeyFile = ../secrets/s3-secret-key.age;
            nixStoreKey.rekeyFile = ../secrets/plum-nix-store-key.age;

Deletion in modules/hosts.nix at line 288 [21.110]
B:BD[23.2511] → [23.2511:2578]
```
            nixServeKey.rekeyFile = ../secrets/plum-cache-key.age;
```
Insertion in modules/hosts.nix at line 331 [21.110]
[5.2530]
[5.2530]
```
      object-storage
```

Insertion in modules/hosts.nix at line 380 [21.110]

[5.3628]

            s3AccessKey.rekeyFile = ../secrets/s3-access-key.age;
            s3SecretKey.rekeyFile = ../secrets/s3-secret-key.age;

Replacement in modules/hosts.nix at line 383 [21.110]

B:BD[5.3713] → [5.3713:3780]

            nixServeKey.rekeyFile = ../secrets/kiwi-cache-key.age;

[5.3713]

[5.3780]

            nixStoreKey.rekeyFile = ../secrets/kiwi-nix-store-key.age;

Insertion in modules/hosts.nix at line 414 [21.110]
[21.2363]
[21.2363]
```
      object-storage
```

Replacement in .forgejo/workflows/nix-ci.yml at line 29 [24.260]

B:BD[7.2783] → [7.2783:2925]

              run: nix build .#nixosConfigurations.date.config.system.build.toplevel --accept-flake-config --builders "" --fallback --no-link

[7.2783]

[25.1032]

              run: nix build .#nixosConfigurations.date.config.system.build.toplevel --accept-flake-config --builders "" --print-build-logs

Replacement in .forgejo/workflows/nix-ci.yml at line 37 [24.260]

B:BD[7.3098] → [7.3098:3240]

              run: nix build .#nixosConfigurations.kiwi.config.system.build.toplevel --accept-flake-config --builders "" --fallback --no-link

[7.3098]

[25.1419]

              run: nix build .#nixosConfigurations.kiwi.config.system.build.toplevel --accept-flake-config --builders "" --print-build-logs

Replacement in .forgejo/workflows/nix-ci.yml at line 46 [24.260]

B:BD[26.541] → [26.541:686]

    #           run: nix build .#darwinConfigurations.lime.config.system.build.toplevel --accept-flake-config --builders "" --fallback --no-link

[26.541]

[25.1807]

    #           run: nix build .#darwinConfigurations.lime.config.system.build.toplevel --accept-flake-config --builders "" --no-link

Replacement in .forgejo/workflows/nix-ci.yml at line 54 [24.260]

B:BD[27.1268] → [27.1268:1412]

    #           run: nix build .#nixosConfigurations.pear.config.system.build.toplevel --accept-flake-config --builders "" --fallback --no-link

[27.1268]

[3.196]

    #           run: nix build .#nixosConfigurations.pear.config.system.build.toplevel --accept-flake-config --builders "" --no-link

Replacement in .forgejo/workflows/nix-ci.yml at line 61 [24.260]

B:BD[3.368] → [3.368:510]

              run: nix build .#nixosConfigurations.plum.config.system.build.toplevel --accept-flake-config --builders "" --fallback --no-link

[3.368]

[25.2194]

              run: nix build .#nixosConfigurations.plum.config.system.build.toplevel --accept-flake-config --builders "" --print-build-logs

Replacement in .forgejo/workflows/nix-ci.yml at line 67 [24.260]
B:BD[25.2735] → [25.2735:2775]
```
            - uses: actions/checkout@v5
```
[25.2735]
[25.2775]
```
            - uses: actions@checkout@v5
```

Replacement in .forgejo/workflows/nix-ci.yml at line 69 [24.260]

B:BD[25.2826] → [25.2826:2968]

              run: nix build .#nixosConfigurations.yuzu.config.system.build.toplevel --accept-flake-config --builders "" --fallback --no-link

[25.2826]

              run: nix build .#nixosConfigurations.yuzu.config.system.build.toplevel --accept-flake-config --builders "" --print-build-logs

object-storage: Replace nixServe with s3 bucket for caching.

Dependencies

In channels

Change contents

File deletion: plum-cache-key.age, key.age

File deletion: kiwi-cache-key.age, key.age

File addition: yuzu-nix-store-key.age (----------)

File addition: s3-secret-key.age (----------)

File addition: s3-access-key.age (----------)

File addition: fad17fe5d38aba521397c107ef65c9c1-s3SecretKey.age (----------)

File addition: 7c1a37883bd70a34a72528236fd607da-s3AccessKey.age (----------)

File addition: 013f3fb2c1fb4a5ec166f855ba451dbb-nixStoreKey.age (----------)

File deletion: 3d58c84ea17883e8e472a7bbc2380d2f-nixServeKey.age

File addition: a3b1b6aa9018bb14164401403b7b2ed6-s3SecretKey.age (----------)

File addition: 8a38405ee9a8b696e6566a862e325bdd-nixStoreKey.age (----------)

File addition: 2b7b5c8f6b5417f8de50e9ee36990f83-s3AccessKey.age (----------)

File deletion: c2fa51be502649aa766e7099e05a7464-nixServeKey.age

File addition: de1e946878806afc534ceebb593e368b-s3SecretKey.age (----------)

File addition: d8f81a3a9ed6586dd4eea8f786843289-s3AccessKey.age (----------)

File addition: 7c6109483cc97ba977b38431761bdc30-nixStoreKey.age (----------)

File addition: 91d8ee87a8a21c391fdf90ad2b5129cb-s3SecretKey.age (----------)

File addition: 579247cd54e15e0ffd19385825a16149-s3AccessKey.age (----------)

File addition: plum-nix-store-key.age (----------)

File addition: kiwi-nix-store-key.age (----------)

Replacement in modules/theme.json at line 2 [13.10167]

Deletion in modules/rebuild.nix at line 48 [16.42448]

File addition: object-storage.nix (----------)

Replacement in modules/nix-settings.nix at line 41 [18.101]

Deletion in modules/nix-settings.nix at line 53 [18.101]

Deletion in modules/nix-settings.nix at line 58 [18.101]

Replacement in modules/nix-cache.nix at line 39 [19.32786]

Replacement in modules/nix-cache.nix at line 43 [19.32786]

Insertion in modules/hosts.nix at line 50 [21.110]

Insertion in modules/hosts.nix at line 93 [21.110]

Insertion in modules/hosts.nix at line 143 [21.110]

Insertion in modules/hosts.nix at line 186 [21.110]

Insertion in modules/hosts.nix at line 234 [21.110]

Insertion in modules/hosts.nix at line 283 [21.110]

Deletion in modules/hosts.nix at line 288 [21.110]

Insertion in modules/hosts.nix at line 331 [21.110]