| 1 | # This module mirrors most tarballs reachable from Nixpkgs's |
| 2 | # release.nix to the content-addressed tarball cache at |
| 3 | # tarballs.nixos.org. |
| 4 | |
| 5 | { |
| 6 | config, |
| 7 | lib, |
| 8 | pkgs, |
| 9 | ... |
| 10 | }: |
| 11 | |
| 12 | let |
| 13 | # Determine the NixPkgs branch to mirror from. |
| 14 | # We take the current primary stable release. |
| 15 | branches = lib.filter (p: p != null) ( |
| 16 | lib.mapAttrsToList ( |
| 17 | name: v: if v.variant or null == "primary" && v.status or null == "stable" then name else null |
| 18 | ) (import ../channels.nix).channels |
| 19 | ); |
| 20 | branch = |
| 21 | assert (lib.assertMsg (lib.length branches == 1) "Multiple primary releases are marked as stable"); |
| 22 | lib.head branches; |
| 23 | in |
| 24 | |
| 25 | { |
| 26 | age.secrets.tarball-mirror-aws-credentials = { |
| 27 | file = ../build/secrets/tarball-mirror-aws-credentials.age; |
| 28 | owner = "tarball-mirror"; |
| 29 | }; |
| 30 | |
| 31 | users.users.tarball-mirror = { |
| 32 | description = "Nixpkgs tarball mirroring user"; |
| 33 | home = "/home/tarball-mirror"; |
| 34 | createHome = true; |
| 35 | isSystemUser = true; |
| 36 | group = "tarball-mirror"; |
| 37 | }; |
| 38 | |
| 39 | users.groups.tarball-mirror = { }; |
| 40 | |
| 41 | systemd.services.mirror-tarballs = { |
| 42 | description = "Mirror Nixpkgs Tarballs"; |
| 43 | path = [ |
| 44 | config.nix.package |
| 45 | pkgs.git |
| 46 | pkgs.bash |
| 47 | ]; |
| 48 | environment.NIX_REMOTE = "daemon"; |
| 49 | serviceConfig.User = "tarball-mirror"; |
| 50 | serviceConfig.Type = "oneshot"; |
| 51 | serviceConfig.PrivateTmp = true; |
| 52 | script = '' |
| 53 | dir=/home/tarball-mirror/nixpkgs |
| 54 | if ! [[ -e $dir ]]; then |
| 55 | git clone https://github.com/NixOS/nixpkgs.git $dir |
| 56 | fi |
| 57 | cd $dir |
| 58 | git remote update origin |
| 59 | git checkout -f origin/${branch} |
| 60 | # FIXME: use IAM role. |
| 61 | export AWS_ACCESS_KEY_ID=$(sed 's/aws_access_key_id=\(.*\)/\1/ ; t; d' ${config.age.secrets.tarball-mirror-aws-credentials.path}) |
| 62 | export AWS_SECRET_ACCESS_KEY=$(sed 's/aws_secret_access_key=\(.*\)/\1/ ; t; d' ${config.age.secrets.tarball-mirror-aws-credentials.path}) |
| 63 | NIX_PATH=nixpkgs=. ./maintainers/scripts/copy-tarballs.pl \ |
| 64 | --expr 'import <nixpkgs/maintainers/scripts/all-tarballs.nix>' \ |
| 65 | --exclude 'registry.npmjs.org|mirror://kde|mirror://xorg|mirror://kernel|mirror://hackage|mirror://gnome|mirror://apache|mirror://mozilla|pypi.python.org' |
| 66 | ''; |
| 67 | startAt = "05:30"; |
| 68 | }; |
| 69 | |
| 70 | } |