⚡ nix-serve -> harmonia for nix-cache

machines/orbi/service-nix-cache.nix

@@ -4,12 +4,11 @@
   pkgs,
   ...
 }:
+let
+  port = 5005;
+in
 {
 
-  # nixpkgs.config.packageOverrides = p: {
-  #   nix-serve = p.haskellPackages.nix-serve-ng;
-  # };
-
   # generate private key with:
   # nix-store --generate-binary-cache-key my-secret-key my-public-key
   clan.core.facts.services."nix-serve" = {
@@ -26,34 +25,31 @@
     '';
   };
 
-  services.nix-serve = {
+  services.harmonia = {
     enable = true;
-    secretKeyFile = config.clan.core.facts.services.nix-serve.secret."nix-serve.key".path;
-    port = 5005;
+    signKeyPaths = [ config.clan.core.facts.services.nix-serve.secret."nix-serve.key".path ];
+    settings = {
+      bind = "127.0.0.1:${toString port}";
+      priority = 100;
+    };
   };
 
-  healthchecks.closed.public.ports.nix-serve = [ config.services.nix-serve.port ];
-  healthchecks.http.nix-serve = {
+  healthchecks.closed.public.ports.nix-cache = [ port ];
+  healthchecks.http.nix-cache = {
     url = "cache.${config.networking.hostName}.wg0/nix-cache-info";
-    expectedContent = "Priority: 50";
+    expectedContent = "Priority: ${toString config.services.harmonia.settings.priority}";
   };
 
   services.nginx = {
     enable = true;
     virtualHosts."cache.${config.networking.hostName}.wg0" = {
       locations."/".extraConfig = ''
-        proxy_pass http://localhost:${toString config.services.nix-serve.port};
-        allow ${config.wireguard.wg0.subnet};
-        deny all;
-      '';
-      # curl https://cache.nixos.org/nix-cache-info
-      # lower priority means ask first.
-      locations."= /nix-cache-info".extraConfig = ''
-        alias ${pkgs.writeText "cache-info" ''
-          StoreDir: /nix/store
-          WantMassQuery: 1
-          Priority: 50
-        ''};
+        proxy_pass http://localhost:${toString port};
+        proxy_set_header Host $host;
+        proxy_http_version 1.1;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
         allow ${config.wireguard.wg0.subnet};
         deny all;
       '';