adisbladis/nix-cache-beacon

nix-cache-beacon is an alpha stage tool that turns a group of computers on the same local network into a shared binary cache for the Nix package manager. Nix normally downloads prebuilt packages from a central cache online, this tool instead uses mDNS, a way for devices to automatically discover each other on a local network, so machines running Nix can find each other, announce that they have cached packages available, and fetch them from a nearby machine instead of the internet, effectively racing multiple local caches against each other to get packages faster. On the security side, the README is clear that this project does not change how Nix normally verifies packages: substituted packages still have to be signed by a key the system already trusts, and package signatures are checked before any metadata from a race is accepted. It does note that traffic between machines is unencrypted, which means other devices on the same local network could potentially observe what packages you are trying to fetch, something to be aware of before using it on a network you do not fully trust. The main way to use nix-cache-beacon is through its NixOS module, configured directly in a NixOS system's configuration file. You can enable it to advertise your machine's cache to the network, point at a local binary cache server such as Harmonia to serve from, and enable the local cache lookup feature so your system checks the network for packages before falling back to the internet. If you are running NixOS, the tool automatically uses the same cryptographic signing keys already configured on your system. The application code is licensed under GPL 3.0 or later, while the accompanying Nix configuration expressions are licensed separately under MIT.