SNOWSTEAD

Build it once, pull it everywhere.
Hosted Nix binary caches.

Push from CI, pull on every laptop and server, and stop rebuilding what someone already built. Public caches are free.

Create a free cache →
In CI
$ snowstead push acme --closure ./result
Resolving closure for ./result...
Found 1284 paths in closure
[86/87] acme-web-1.4.0  ok (2310KB)
[87/87] acme-api-0.9.2  ok (18422KB)

Done: 87 pushed, 1197 skipped, 0 failed

How it works

  1. 1

    Create a cache

    Create one in the dashboard and choose who can pull: anyone, or only machines with a token. Each cache gets its own address and signing key.

  2. 2

    Push from CI

    The CLI uploads only what the cache doesn't have yet.

    snowstead push acme --closure ./result
  3. 3

    Pull it everywhere

    Add one line to your Nix config. Laptops, servers, and CI download what's already built.

    substituters = [ "https://acme.snowstead.example" ];

What you get

Close to your machines
We serve caches from data centers around the world, so downloads come from one near you.
Private caches
Only machines with a pull token can read a private cache. They send it from their netrc file, which Nix already reads.
Tokens per cache
Give each token push or pull access to only the caches it needs, and set when it expires. Revoke one and it stops working within seconds.
Signed paths
Your cache signs everything you push, so Nix can check it came from you.

Questions

Do I need to change how I build?

No. Snowstead works like any other Nix binary cache. Add it as a substituter with its public key, then push with the CLI.

How do my machines read a private cache?

With a pull token. Put it in a netrc file, which Nix already reads, or send it as a bearer token.

Can I run it myself?

Yes. The source is available, so you can host it yourself. The hosted service is the same code – we just run it for you.

Stop building the same thing twice.

Create a free cache →