try to use caddy file_server with s3

.github/workflows/build-machines-and-homes.yml

@@ -70,12 +70,20 @@ jobs:
           nix build -L "$package"
 
       - name: cache
-        if: always()
+        # https://stackoverflow.com/a/58859404
+        if: '!cancelled()'
         run: |
           package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
-          nix copy -j8 \
-            --to 's3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem' \
-            $(nix path-info --recursive --derivation "$package" |sed 's/\.drv$/.drv^*/')
+          derivations=()
+          while IFS=$'\n' read derivation; do
+              derivations+=("$derivation")
+          done < <(nix path-info --derivation "$package")
+
+          for derivation in "${derivations[@]}"; do
+              nix copy -j8 \
+                --to 's3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem' \
+                $(nix-store --query --requisites --include-outputs "$derivation")
+          done
 
   build-homes:
     strategy:
@@ -129,9 +137,17 @@ jobs:
           nix build -L "$package"
 
       - name: cache
-        if: always()
+        # https://stackoverflow.com/a/58859404
+        if: '!cancelled()'
         run: |
           package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
-          nix copy -j8 \
-            --to 's3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem' \
-            $(nix path-info --recursive --derivation "$package" |sed 's/\.drv$/.drv^*/')
+          derivations=()
+          while IFS=$'\n' read derivation; do
+              derivations+=("$derivation")
+          done < <(nix path-info --derivation "$package")
+
+          for derivation in "${derivations[@]}"; do
+              nix copy -j8 \
+                --to 's3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem' \
+                $(nix-store --query --requisites --include-outputs "$derivation")
+          done

.github/workflows/build-packages.yml

@@ -59,7 +59,8 @@ jobs:
       - run: nix build -L ${{ matrix.package }}
 
       - name: cache result
-        if: always()
+        # https://stackoverflow.com/a/58859404
+        if: '!cancelled()'
         run: |
           nix copy -j8 \
             --to 's3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem' \

hosts/chunk/garage.nix

@@ -46,5 +46,20 @@
         reverse_proxy localhost:3902
       '';
     };
+    "dl.cy7.sh".extraConfig = ''
+      import common
+      fs dl
+      file_server {
+        browse
+      }
+    '';
   };
+
+  services.caddy.globalConfig = ''
+    filesystem dl s3 {
+      bucket caddy-dl
+      region us-east-1
+      endpoint https://s3.cy7.sh
+    }
+  '';
 }

modules/caddy.nix

@@ -20,8 +20,9 @@ in
           # error message will tell you the correct version tag to use
           # (still need the @ to pass nix config check)
           "github.com/caddy-dns/cloudflare@v0.0.0-20250228175314-1fb64108d4de"
+          "github.com/sagikazarmark/caddy-fs-s3@v0.7.1-0.20250228151755-8e8ed9e5aab9"
         ];
-        hash = "sha256-YYpsf8HMONR1teMiSymo2y+HrKoxuJMKIea5/NEykGc=";
+        hash = "sha256-7IdAmp3O5yTUPFwWkwKAQpAqbNUazB5yG3b/WCq8GP0=";
       };
       logFormat = lib.mkForce "level INFO";
       acmeCA = "https://acme-v02.api.letsencrypt.org/directory";

secrets/services/caddy.yaml

@@ -1,5 +1,5 @@
 caddy:
-    env: ENC[AES256_GCM,data:fyP1pPJgO9jN0ypC09s0Sz+HlUX42fl6DxWevYYevKdlKTgz5VHQfbELhy6vejmg9v+zFB3/AtSZfWJQB2dNX4Zm/L42wf5QZ7oYoa9QTujJjRgE96OXM77ioNy2DzFzpGw3w16QoC7zaR8UHSN1KL6qRj5xxKw0U6Apxhc0AuBoLvNHOgn8CHY92Q4OBcA1tJn8tgLB9uZB5Ge/2BlEjdSQ0sZMLkE+dHC4/0IILVFrrv1sWRXvXt6t5njF,iv:tF5GRPFYZSuKRgDAY1e8/J7jNQAEqDpgXlpwWW+1P4E=,tag:lK/BUErXNIPgqXPzGJvPTQ==,type:str]
+    env: ENC[AES256_GCM,data:NBE8mVyz1lN+W6UHNa0KYnEYNtyK6bTQH/HgZ2OsGXSBXrse38Ga3CRw/rHgKrLSkjSx7faUrn0s1/8nNWY4gz2Ntv9N+HtKgQhXaxXhgp9BpH6ClVEL65s7F81Gr3SsZ3SlLra4cDDZ9ytX8/RxZ+httllVhODOmTyVtow9abNRwTJogdqf5gRBQvd1LnjXR6ET7VMZFTM2JETnxiax/LS1DSsp5XgJtQfmhL8eZ3hz6SZxReD1DC+5pg4=,iv:d/R4Fi3Ylqv4I2EIOX9Pzfpep8U5ctgrIRMEFTsL8e0=,tag:aV/6Z3k6ZjnF0/z49liwIw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -33,8 +33,8 @@ sops:
             Q2hBZE1FOHJ3aW5rVmoyK045eG11cmsKFOmP5iWONREZvxu0rM+fKMPQKgnYq5LH
             AKMZFsP7nnUxjdCXEA18sDg4Rf0qp8i3uQK3D6P7417j9ye/YZA4BQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-08T21:05:07Z"
-    mac: ENC[AES256_GCM,data:vgGCrCJMBxjiCWZYymlaPKTekA1Weprwgtc4xcoPVlDsuljkXDth+aAZPpnakE/nSXhGC6jGJOHdtrsIUTkH2R9WQHIdZDBy+VrVQoV6xE3ijfWyIujcIPwz3s1MGBqRFUYum1XMU5FAcIASiYV7PDxj/f6fsLbjKZCc9/kG3GE=,iv:PSvlssl+Gx+Gcw6/zccIKJDeNz3dJ0kHnPmCrAdBnqQ=,tag:6F/JKBFNxKEgMTyYZ3W0Vg==,type:str]
+    lastmodified: "2025-03-29T05:03:16Z"
+    mac: ENC[AES256_GCM,data:94JoFG2sBvPOD4lquq8Ck1sGzNIiPDjufRuBz2mXbLA0Lx11xL2/dkdQA2A9Eb2DE0TRtPPMl8JHwGWcUac+dWdeYXcu0LRxZxWHp/ajoHnYHbBRzxdM2gRtb0igkBTCMxDtBH8zOoMNn/g1U/m1m8G/fAoWf4VCB2wGpy7WrRA=,iv:OqQzOf6QRYZiHqerE0Cn8JPrhzcgHkSn2tdhDLbFEq4=,tag:LwRgqPNj+fNhM70Bq7vIXw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.4