l 1 prism: serve nix-cache

1 files changed, 24 insertions, 0 deletions

diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix
index 6ed80ac39..9a9bd4730 100644
--- a/lass/1systems/prism.nix
+++ b/lass/1systems/prism.nix
@@ -210,6 +210,30 @@ in {
         '')
       ];
     }
+    {
+      services.nix-serve = {
+        enable = true;
+        secretKeyFile = config.krebs.secret.files.nix-serve-key.path;
+      };
+      systemd.services.nix-serve = {
+        requires = ["secret.service"];
+        after = ["secret.service"];
+      };
+      krebs.secret.files.nix-serve-key = {
+        path = "/run/secret/nix-serve.key";
+        owner.name = "nix-serve";
+        source-path = toString <secrets> + "/nix-serve.key";
+      };
+      krebs.nginx = {
+        enable = true;
+        servers.nix-serve = {
+          server-names = [ "cache.prism.r" ];
+          locations = lib.singleton (lib.nameValuePair "/" ''
+            proxy_pass http://localhost:${toString config.services.nix-serve.port};
+          '');
+        };
+      };
+    }
   ];
 
   krebs.build.host = config.krebs.hosts.prism;