Public Nix binary cache

Stop building in production.

Build your Nix artifacts in CI, push them to your cache, and deploy instantly.

Getting started

Add the cache to NixOS or nix-darwin

Keep your existing cache.nixos.org entry and add this cache alongside it. Anonymous reads use the configured R2 Custom Domain directly, avoiding a Worker request for each download.

Client setup

Use the full module configuration

This example intentionally keeps the official cache and its existing signing key. Replace only the placeholder with the key you already use for cache.nixos.org.

substituters = lib.mkForce [
  "https://cache.nixos.org"
  "https://nix-cache-r2.ihc.im"
];

trusted-public-keys = lib.mkForce [
  "cache.nixos.org-1:<existing-cache-key>"
  "nix-cache.ihc.im:xhp3WqL+VxLzUfNtW49pt1amYrvyv0bJquZwFC6ofug="
];

Verify the public key

Trust narinfos signed with this public key. The Worker does not sign narinfos:

nix-cache.ihc.im:xhp3WqL+VxLzUfNtW49pt1amYrvyv0bJquZwFC6ofug=

Apply and build normally

After deploying the module, continue using your normal Nix commands. Existing substituters remain available.

About lib.mkForce: it makes this module's complete lists authoritative. Keep the official cache entry and its real key in the lists as shown; do not replace them with only the Worker values.