rickub
Sign in Get started
nandi/jolt-nativepublic⑂ Fork 0
⑂ d970307
Branches
main View all branches → View all tags →
Commits
⬇ Clone ▾
git clone https://git.rickub.com/nandi/jolt-native.git
git clone ssh://git@rickub.com/nandi/jolt-native.git

Host key fingerprint (ed25519): SHA256:iycHnxEyq0Q7uyVpB7JlznP0G7JrTPXLYRcAU5CSLhc — verify it before your first connect.

Stop pulling all of nixpkgs through the SSH tunnel

nix picks a substituter by priority, not by the order it is listed in,
and an ssh-ng store defaults to 0 against cache.nixos.org's 40 -- so
nixbuild was serving stock nixpkgs paths over a single SSH connection
instead of letting the CDN do it. Only the crate paths are unique to
nixbuild; everything else belongs on the cache.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
nandi committed 2026-09-07T21:44:13-07:00 Browse files
d970307 parent: 849c3de
modified .gitlab-ci.yml +5 -1
@@ -38,6 +38,10 @@ check:
3838 # rather than carry it as a second secret we lean on the transport -- the
3939 # store is reached over SSH authenticated with our own key. cache.nixos.org
4040 # is verified by its own key either way; require-sigs only relaxes nixbuild.
41+ # The explicit priority matters: nix picks a substituter by priority rather
42+ # than by the order listed here, and an ssh-ng store defaults to 0 against
43+ # cache.nixos.org's 40, so without it nixbuild wins even for stock nixpkgs
44+ # paths and they crawl through one SSH connection instead of the CDN.
4145 #
4246 # Keep the builder's job count modest. nixbuild's sshd caps concurrent
4347 # sessions and refuses the excess, which nix surfaces as the thoroughly
@@ -54,7 +58,7 @@ check:
5458 'experimental-features = nix-command flakes' \
5559 'builders = ssh-ng://eu.nixbuild.net x86_64-linux - 16 1 big-parallel,benchmark' \
5660 'builders-use-substitutes = true' \
57- 'substituters = https://cache.nixos.org ssh-ng://eu.nixbuild.net' \
61+ 'substituters = https://cache.nixos.org ssh-ng://eu.nixbuild.net?priority=50' \
5862 'require-sigs = false' \
5963 "max-jobs = $(nproc)" >> /etc/nix/nix.conf
6064 script:
@@ -38,6 +38,10 @@ check:
38 # rather than carry it as a second secret we lean on the transport -- the38 # rather than carry it as a second secret we lean on the transport -- the
39 # store is reached over SSH authenticated with our own key. cache.nixos.org39 # store is reached over SSH authenticated with our own key. cache.nixos.org
40 # is verified by its own key either way; require-sigs only relaxes nixbuild.40 # is verified by its own key either way; require-sigs only relaxes nixbuild.
41+ # The explicit priority matters: nix picks a substituter by priority rather
42+ # than by the order listed here, and an ssh-ng store defaults to 0 against
43+ # cache.nixos.org's 40, so without it nixbuild wins even for stock nixpkgs
44+ # paths and they crawl through one SSH connection instead of the CDN.
41 #45 #
42 # Keep the builder's job count modest. nixbuild's sshd caps concurrent46 # Keep the builder's job count modest. nixbuild's sshd caps concurrent
43 # sessions and refuses the excess, which nix surfaces as the thoroughly47 # sessions and refuses the excess, which nix surfaces as the thoroughly
@@ -54,7 +58,7 @@ check:
54 'experimental-features = nix-command flakes' \58 'experimental-features = nix-command flakes' \
55 'builders = ssh-ng://eu.nixbuild.net x86_64-linux - 16 1 big-parallel,benchmark' \59 'builders = ssh-ng://eu.nixbuild.net x86_64-linux - 16 1 big-parallel,benchmark' \
56 'builders-use-substitutes = true' \60 'builders-use-substitutes = true' \
57- 'substituters = https://cache.nixos.org ssh-ng://eu.nixbuild.net' \61+ 'substituters = https://cache.nixos.org ssh-ng://eu.nixbuild.net?priority=50' \
58 'require-sigs = false' \62 'require-sigs = false' \
59 "max-jobs = $(nproc)" >> /etc/nix/nix.conf63 "max-jobs = $(nproc)" >> /etc/nix/nix.conf
60 script:64 script: