Private caches

Only machines with a pull token can read a private cache. Use one for builds of code you don't want public.

Make a cache private

Choose Only machines with a pull token when you create the cache. You can switch an empty cache between public and private on its page, and the change applies everywhere within 30 seconds. Once a cache has paths, who can pull is fixed: to change it, create a new cache.

Your tier must include private caches. If your tier changes to one without them, existing private caches stay private and machines with a pull token still read them, but new pushes are refused. Snowstead assigns tiers manually during beta.

Give machines a pull token

Create a token under Tokens that can pull from the cache, then put it in a netrc file on each machine. Nix sends it as the password when it fetches from the cache:

machine cache.snowstead.com
password <the pull token>

Point Nix at the file, and use the cache's private address, which has /private/ in it:

nix.settings = {
  substituters = [ "https://cache.snowstead.com/private/team" ];
  trusted-public-keys = [ "<the key from your cache's page>" ];
  netrc-file = "/etc/nix/netrc";
};

Keep the netrc file readable only by root. If a machine is lost, revoke its token and it stops working within seconds: see Tokens.