Nix

This command adds the repository to ~/.config/nix/nix.conf as an extra substituter and writes your credentials to ~/.netrc:

relic package setup nix nix --write

Upload a store path and its closure to a local repository:

nix copy --to https://relic.example.com/nix/nix-local ./result

By hand, add to ~/.config/nix/nix.conf:

extra-substituters = https://relic.example.com/nix/nix
netrc-file = /home/<you>/.netrc

Add the credentials to ~/.netrc:

printf 'machine relic.example.com\nlogin <you>\npassword <token>\n' >> ~/.netrc

Signatures

Relic does not sign store paths; they keep the signatures uploaded with them, such as cache.nixos.org's. Nix substitutes only paths signed by a key in trusted-public-keys.

Make a key pair for your own paths:

nix-store --generate-binary-cache-key relic.example.com-1 cache-key.sec cache-key.pub

Sign a path and its closure before copying it:

nix store sign --key-file cache-key.sec --recursive ./result

Trust the public key (the content of cache-key.pub) in nix.conf:

extra-trusted-public-keys = relic.example.com-1:<public key>

require-sigs = false turns signature checks off for every substituter.

• On a multi-user installation, these settings go in /etc/nix/nix.conf.
• nix copy --to a virtual repository stores in its default deployment repository.
• Each path is stored under binary-cache/<hash>/: its .narinfo and NAR.
• Channels (nix-channel) are not served.
• The JFrog® CLI's jf nix uses /artifactory/api/nix/<repo>.