infra.build

Cache FQDN. If atticd runs on a substrate outside the fleet’s internal zone (e.g. an XCP-ng tier-0 builder), pick a name in the substrate zone and have the hosting module register the A record (e.g. fleet.xenZoneRecords.attic = "<ip>";) so fleet DNS resolves it.

Type: string

Default: none (required when its feature is enabled)

Example:

"attic.example.lan"

Declared by: nix/modules/infra/build/attic

`infra.build.attic.listenPort`

Local TCP port atticd listens on. Clients reach the cache via the Caddy vhost at fqdn, which reverse-proxies to this port on loopback.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

Declared by: nix/modules/infra/build/attic

`infra.build.attic.postBuildHook`

Install a post-build-hook so every local build uploads to atticd.

Type: boolean

Default:

true

Declared by: nix/modules/infra/build/attic

`infra.build.attic.s3Bucket`

Bucket in the S3 store (s3Endpoint) that holds the cache NARs. Must match the bucket the minted access key was granted on (bootstrap step 1).

Type: string

Default:

"nix-cache"

Declared by: nix/modules/infra/build/attic

`infra.build.attic.s3Endpoint`

S3 endpoint (e.g. in-fleet Garage). HTTP-direct to the store’s native port is fine for fleet-internal traffic on a trusted L2 — no need to round-trip a TLS terminator. Switch to an https:// endpoint when atticd is co-located with an untrusted boundary.

Type: string

Default: none (required when its feature is enabled)

Example:

"http://s3.example.lan:3900"

Declared by: nix/modules/infra/build/attic

`infra.build.builder`

`infra.build.builder.cacheBindAddress`

Address:port harmonia binary cache listens on.

Type: string

Default:

"[::]:5000"

Declared by: nix/modules/infra/build/builder

`infra.build.builder.cores`

Number of CPU cores per build job.

Type: signed integer

Default:

Declared by: nix/modules/infra/build/builder

`infra.build.builder.enable`

Whether to enable Nix remote builder + harmonia binary cache.

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/build/builder

`infra.build.builder.maxJobs`

Maximum number of parallel nix build jobs.

Type: signed integer

Default:

Declared by: nix/modules/infra/build/builder

`infra.build.builder.trustedUsers`

Users trusted to manage the Nix store.

Type: list of string

Default:

[
  "root"
  "sysadmin"
]

Declared by: nix/modules/infra/build/builder

`infra.build.hydra`

`infra.build.hydra.enable`

Whether to enable Hydra CI server on the builder host.

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/build/hydra.nix

`infra.build.hydra.hydraUrl`

Canonical external URL Hydra advertises for itself (links in the UI and notification emails). Asserted non-null when the module is enabled — set it explicitly if fleet.settings.domain.internal is null.

Type: null or string

Default:

"https://hydra.${config.fleet.settings.domain.internal}"

Declared by: nix/modules/infra/build/hydra.nix

`infra.build.hydra.listenHost`

Address hydra-server binds to. Default listens on all interfaces; set to 127.0.0.1 to serve only through the Caddy vhost.

Type: string

Default:

"0.0.0.0"

Declared by: nix/modules/infra/build/hydra.nix

`infra.build.hydra.maxConcurrentEvals`

Value for Hydra’s max_concurrent_evals — how many jobset evaluations may run in parallel. Keep low on builder hosts that also run real builds; each eval can use gigabytes of memory.

Type: signed integer

Default:

Declared by: nix/modules/infra/build/hydra.nix

`infra.build.hydra.notificationSender`

From: address for Hydra build-notification emails (also used as the msmtp envelope sender when smtp.enable is set). Asserted non-null when the module is enabled.

Type: null or string

Default:

"hydra@${config.fleet.settings.domain.base}"

Declared by: nix/modules/infra/build/hydra.nix

`infra.build.hydra.port`

TCP port for the hydra-server web UI. Opened in the firewall, reverse-proxied by the hydra.<domain.internal> Caddy vhost, and scraped by Alloy for HTTP metrics.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

Declared by: nix/modules/infra/build/hydra.nix

`infra.build.hydra.project`

Name of the Hydra project that holds the declaratively-managed jobsets (spec.json in the repo).

Type: string

Default:

config.fleet.settings.name

Declared by: nix/modules/infra/build/hydra.nix

`infra.build.hydra.smtp.enable`

Whether to enable SMTP email relay via Resend (msmtp) for Hydra build notifications.

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/build/hydra.nix

`infra.build.lxcTemplateFactory`

`infra.build.lxcTemplateFactory.enable`

Whether to enable automatic NixOS LXC template builds published to the NFS template store.

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/build/lxc-template-factory.nix

`infra.build.lxcTemplateFactory.interval`

systemd OnCalendar cadence for the freshness check.

Type: string

Default:

"daily"

Declared by: nix/modules/infra/build/lxc-template-factory.nix

`infra.build.lxcTemplateFactory.nfsTemplateDir`

PVE vztmpl directory inside the NFS export to publish templates into.

Type: string

Default:

"/data/nfs/store/template/cache"

Declared by: nix/modules/infra/build/lxc-template-factory.nix

`infra.build.registryProxy`

`infra.build.registryProxy.cacheDir`

Directory for cached Docker images.

Type: string

Default:

"/var/lib/docker-registry-proxy"

Declared by: nix/modules/infra/build/registry-proxy.nix

`infra.build.registryProxy.enable`

Whether to enable Docker registry pull-through proxy (caches Docker Hub, ghcr.io, etc.).

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/build/registry-proxy.nix

`infra.build.registryProxy.port`

Port the registry proxy listens on.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

Declared by: nix/modules/infra/build/registry-proxy.nix

`infra.build.registryProxy.registries`

Space-separated list of registries to cache.

Type: string

Default:

"k8s.gcr.io gcr.io quay.io ghcr.io docker.io"

Declared by: nix/modules/infra/build/registry-proxy.nix

`infra.build.remote`

`infra.build.remote.enable`

Whether to enable offloading nix builds to the fleet’s remote build machines.

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/build/remote

`infra.build.remote.sshKeySopsFile`

Encrypted file holding . Null reads it from the consumer’s sops.defaultSopsFile. A split-store consumer — one file per resource, each encrypted to only the hosts that need it — sets no defaultSopsFile at all, so leaving this null there fails eval with sops.defaultSopsFile was accessed but has no value defined. That is the point of the split: the offload key is a fleet-wide credential and belongs in a file encrypted to the few hosts that opt in, not in one every host can read.

Type: null or absolute path

Default:

null

Example:

"../secrets/build-offload.yaml"

Declared by: nix/modules/infra/build/remote

`infra.build.remote.sshKeySopsPath`

Sops key path of the private key the nix-daemon uses to reach the build machines. Read as root, since the daemon — not the invoking user — opens the connection.

Type: string

Default:

"services/builder/ssh_priv_key"

Declared by: nix/modules/infra/build/remote

`infra.build.wikiPublisher`

`infra.build.wikiPublisher.branch`

Branch whose tip the handbook is built from.

Type: string

Default:

"nightly"

Declared by: nix/modules/infra/build/wiki-publisher.nix

`infra.build.wikiPublisher.enable`

Whether to enable timer that rebuilds the handbook from the repo tip and rsyncs it to the docs host (INFRA-150).

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/build/wiki-publisher.nix

`infra.build.wikiPublisher.repoUrl`

HTTPS clone URL for the deployments repo (token auth).

Type: string

Default: none (required when its feature is enabled)

Example:

"https://github.com/example-org/deployments.git"

Declared by: nix/modules/infra/build/wiki-publisher.nix

`infra.build.wikiPublisher.schedule`

systemd OnCalendar expression for the refresh.

Type: string

Default:

"*-*-* 06:15:00"

Declared by: nix/modules/infra/build/wiki-publisher.nix

`infra.build.wikiPublisher.siteFlakeAttr`

Flake package attribute that builds the static handbook site in the consumer repo.

Type: string

Default:

"wiki-site"

Example:

"docs-site"

Declared by: nix/modules/infra/build/wiki-publisher.nix

`infra.build.wikiPublisher.target`

rsync/ssh destination for the docs host.

Type: string

Default: none (required when its feature is enabled)

Example:

"root@192.0.2.25"

Declared by: nix/modules/infra/build/wiki-publisher.nix

`infra.build.wikiPublisher.targetDir`

Directory the docs host serves the handbook from.

Type: string

Default:

"/var/lib/wiki/site"

Declared by: nix/modules/infra/build/wiki-publisher.nix

Keyboard shortcuts

fleetkit