Skip to content
marchyo

Nix caches & cache router

Binary caches

Section titled “Binary caches”

marchyo adds its binary caches (modules/nixos/caches.json) to nix.settings.substituters, trusted-substituters and trusted-public-keys. These are plain list definitions, so your own entries merge with them:

nix.settings = {
  substituters = [ "https://my-cache.example.com" ];
  trusted-public-keys = [ "my-cache.example.com-1:..." ];
};

Use lib.mkForce on a list to replace marchyo’s entries (and NixOS’s cache.nixos.org) instead.

Cache router (ncro)

Section titled “Cache router (ncro)”

ncro (Nix Cache Route Optimizer) is a local HTTP proxy that measures upstream latency in real time and routes each binary-cache request to the fastest reachable upstream, streaming NARs with zero local NAR storage. It runs as a DynamicUser systemd service.

marchyo turns on services.ncro.enable with lib.mkDefault. While it is on, http://localhost:<services.ncro.port> is prepended to nix.settings.substituters, and every other substituter becomes an ncro upstream (with the trusted key named after its host, such as cache.nixos.org-1:...). The substituters stay as direct fallbacks; Nix routes by priority, so the local proxy wins.

Option Default Description
services.ncro.enable true (marchyo) Run ncro and front the caches with it
services.ncro.port 4200 (marchyo) Port ncro listens on (localhost only) and the prepended substituter’s port
services.ncro.netrcFile null netrc file for authenticating to private upstreams (e.g. a sops-generated /etc/nix/netrc)
services.ncro.settings.upstreams the substituters Extra entries merge with the derived list 
# Opt out and talk to the caches directly:
services.ncro.enable = false;


# Authenticate to a private upstream:
services.ncro.netrcFile = "/etc/nix/netrc";

After activation, verify with:

Terminal window
systemctl status ncro
curl -sf http://localhost:4200/nix-cache-info
nix config show substituters   # localhost:4200 first