Monorepo for Tangled
tangled.org
localinfra: add ncps cache service for spindle to use
Signed-off-by: dawn <dawn@tangled.org>
author
dawn
date
(Jun 27, 2026, 3:59 PM +0300)
commit
35c2b24e
35c2b24ea048f7ad7fa2c86d655d3157705effd5
parent
9824c1d4
9824c1d4223f54ffa925f783b2f836d2780f9ff9
change-id
xqxxymlx
xqxxymlxwkpvpvsxnqpzymvrxqxqonsw
+57
+39
docker-compose.yml
+39
docker-compose.yml
···
132
132
condition: service_completed_successfully
133
133
networks: [tngl]
134
134
135
+
ncps-migrate:
136
+
image: &ncps-image ghcr.io/kalbasit/ncps:v0.9.4
137
+
profiles: ["linux"]
138
+
restart: "no"
139
+
command:
140
+
- /bin/dbmate
141
+
- --migrations-dir=/share/ncps/db/migrations/sqlite
142
+
- --no-dump-schema
143
+
- --url=sqlite:/storage/db.sqlite
144
+
- up
145
+
volumes:
146
+
- ncps-data:/storage
147
+
networks: [tngl]
148
+
149
+
ncps:
150
+
image: *ncps-image
151
+
profiles: ["linux"]
152
+
restart: unless-stopped
153
+
environment:
154
+
ANALYTICS_REPORTING_ENABLED: "false"
155
+
command: ["/bin/ncps", "serve", "--config", "/etc/ncps/ncps.yaml"]
156
+
volumes:
157
+
- ncps-data:/storage
158
+
- ./localinfra/ncps.yaml:/etc/ncps/ncps.yaml:ro
159
+
- ./localinfra/ncps-secret-key:/keys/ncps-secret-key:ro
160
+
depends_on:
161
+
ncps-migrate:
162
+
condition: service_completed_successfully
163
+
networks: [tngl]
164
+
135
165
spindle:
136
166
profiles: ["linux"]
137
167
build:
···
153
183
SPINDLE_MICROVM_PIPELINES_AGENT_PORT: "11240"
154
184
SPINDLE_S3_LOG_BUCKET: ""
155
185
SPINDLE_MICROVM_PIPELINES_ENABLE_CGROUPS: "false"
186
+
# route guest nix substitution + uploads through the local ncps cache.
187
+
# ncps re-signs on serve with cache.local's key, so the guest trusts the
188
+
# matching public key below (no signing happens in spindle itself).
189
+
SPINDLE_NIX_CACHE_READ_URLS: http://ncps:8501
190
+
SPINDLE_NIX_CACHE_TRUSTED_PUBLIC_KEYS: cache.local:F7YqpMzuBdILYd/v+wMZN2YKxCzliXQyFmeezOxw7rU=
191
+
SPINDLE_NIX_CACHE_UPLOAD_URL: http://ncps:8501/upload
156
192
# these two are required for cgroups, uncomment if testing
157
193
# privileged: true
158
194
# cgroup: host
···
186
222
condition: service_started
187
223
init-accounts:
188
224
condition: service_completed_successfully
225
+
ncps:
226
+
condition: service_started
189
227
networks: [tngl]
190
228
191
229
knotmirror-tap:
···
327
365
knotmirror-data:
328
366
spindle-data:
329
367
spindle-logs:
368
+
ncps-data:
330
369
init-state:
331
370
go-cache:
332
371
go-mod-cache:
+1
localinfra/ncps-secret-key
+1
localinfra/ncps-secret-key
···
1
+
cache.local:hay0+jvBNguou2tNt19FvrBCogHwHc+mqQe3bww5ZX4XtiqkzO4F0gth3+/7Axk3ZgrELOWJdDIWZ57M7HDutQ==
+16
localinfra/ncps.yaml
+16
localinfra/ncps.yaml
···
1
+
# Development only. Not for production use.
2
+
cache:
3
+
allow-put-verb: true
4
+
hostname: "cache.local"
5
+
database-url: "sqlite:/storage/db.sqlite"
6
+
secret-key-path: "/keys/ncps-secret-key"
7
+
sign-narinfo: true
8
+
storage:
9
+
local: "/storage"
10
+
upstream:
11
+
urls:
12
+
- https://cache.nixos.org
13
+
public-keys:
14
+
- cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
15
+
server:
16
+
addr: "0.0.0.0:8501"
+1
localinfra/readme.md
+1
localinfra/readme.md
···
17
17
- spindle (<https://spindle.tngl.boltless.dev>)
18
18
- knotmirror (<https://knotmirror.tngl.boltless.dev>)
19
19
- appview (<https://tngl.boltless.dev>) (live reloading)
20
+
- [ncps](https://github.com/kalbasit/ncps) nix binary cache (internal, `http://ncps:8501`)
20
21
- caddy reverse proxy
21
22
22
23
## Setup