supabase-postgres.git / summary / log / commit / refs
commit 15aaf82601302e72fa827b91ee83f9269d5bdfe0
Author: Márton Boros <martonboros@gmail.com>
Commit: GitHub <noreply@github.com>
Date: Fri Jul 10 13:34:28 2026 +0000
fix(nix): remove insecure trusted-users recommendation and update cache docs (#2238)
Drop the trusted-users setup recommendation and always-allow-substituters,
remove the postgrest binary cache and its public key from flake.nix, and
rework the nix binary cache and start-here docs to match the secure config.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
README.md | 2 +
docs/multigres-image.md | 36 +++++--------
flake.nix | 5 +-
nix/docs/binary-cache.md | 60 ++++++++++++++++++++++
nix/docs/start-here.md | 44 ++++++----------
.../darwin-nixostest/darwin-configuration.nix | 4 --
6 files changed, 92 insertions(+), 59 deletions(-)
diff --git a/README.md b/README.md
index 5adf5780..cef3bfff 100644
--- a/README.md
+++ b/README.md
@@ -124,6 +124,8 @@ The project uses Nix as its build system, which provides:
## Common Tasks
+To skip hours of building and download instead, configure the Supabase Postgres Nix binary cache: [nix/docs/binary-cache.md](nix/docs/binary-cache.md).
+
### Building Locally
To build PostgreSQL with extensions locally:
diff --git a/docs/multigres-image.md b/docs/multigres-image.md
index dc079cc5..3bf9d6e2 100644
--- a/docs/multigres-image.md
+++ b/docs/multigres-image.md
@@ -77,43 +77,33 @@ docker build -f Dockerfile-multigres --target variant-orioledb-17 -t pg-docker-t
nix run .#docker-image-test -- --no-build --target variant-orioledb-17 Dockerfile-multigres
```
-### Optional: install nix
+### Install nix
## Install Nix (Fresh Installation)
We'll use the official Nix installer with a custom configuration that includes our build caches and settings. This works on many platforms, including **aarch64 Linux**, **x86_64 Linux**, and **macOS**.
-### Step 1: Create nix.conf
+### Step 1: Create nix.conf.extra
-First, create a file named `nix.conf` with the following content:
+First, create a file named `nix.conf.extra` with the following content:
```
-allowed-users = *
-always-allow-substitutes = true
-auto-optimise-store = false
-build-users-group = nixbld
-builders-use-substitutes = true
-cores = 0
experimental-features = nix-command flakes
-max-jobs = auto
-netrc-file =
-require-sigs = true
-substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com https://postgrest.cachix.org https://cache.nixos.org/
-trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= postgrest.cachix.org-1:icgW4R15fz1+LqvhPjt4EnX/r19AaqxiVV+1olwlZtI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
-trusted-substituters =
-trusted-users = YOUR_USERNAME root
-extra-sandbox-paths =
-extra-substituters =
-```
+extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
+extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
+ ```
+
+> [!CAUTION]
+> DO NOT add anyone to `trusted-users` in `/etc/nix/nix.conf` as it [grants root without password](https://nix.dev/manual/nix/stable/command-ref/conf-file.html#conf-trusted-users). Instead, add the binary cache to `extra-substituters` and `extra-trusted-public-keys`.
-**Important**: Replace `YOUR_USERNAME` with your actual username in the `trusted-users` line.
+Read about the binary cache in [/nix/docs/binary-cache.md](/nix/docs/binary-cache.md).
### Step 2: Install Nix 2.34.6
Run the following command to install Nix 2.34.6 (the version used in CI) with the custom configuration:
```bash
-curl -L https://releases.nixos.org/nix/nix-2.34.6/install | sh -s -- --daemon --yes --nix-extra-conf-file ./nix.conf
+curl -L https://releases.nixos.org/nix/nix-2.34.6/install | sh -s -- --daemon --yes --nix-extra-conf-file ./nix.conf.extra
```
This will install Nix with our build caches pre-configured, which should eliminate substituter-related errors.
@@ -134,8 +124,6 @@ nix (Nix) 2.34.6
### Test only (image already built)
-
-
```bash
nix run .#docker-image-test -- --no-build --target variant-17 Dockerfile-multigres
nix run .#docker-image-test -- --no-build --target variant-orioledb-17 Dockerfile-multigres
@@ -237,4 +225,4 @@ postgres_release:
postgres17: "17.6.1.097"
postgres15: "15.14.1.097"
```
-Then you can push the changes if the images pass those tests
\ No newline at end of file
+Then you can push the changes if the images pass those tests
diff --git a/flake.nix b/flake.nix
index dbabf994..af27aac3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,10 +1,9 @@
{
description = "Prototype tooling for deploying PostgreSQL";
nixConfig = {
+ # Skip rebuilding all the packages, download instead.
+ # See nix/docs/binary-cache.nix to set it up.
extra-substituters = [ "https://nix-postgres-artifacts.s3.amazonaws.com" ];
- extra-trusted-public-keys = [
- "nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI="
- ];
};
inputs = {
devshell.url = "github:numtide/devshell";
diff --git a/nix/docs/binary-cache.md b/nix/docs/binary-cache.md
new file mode 100644
index 00000000..b7e4e156
--- /dev/null
+++ b/nix/docs/binary-cache.md
@@ -0,0 +1,60 @@
+# Using the Nix binary cache
+
+If you don't use the binary cache, it might take hours to build stuff you could just download, already built by CI.
+
+## NixOS or nix-darwin or system-manager
+
+Add this to your system configuration:
+
+```nix
+{
+ nix.settings.extra-substituters = [
+ "https://nix-postgres-artifacts.s3.amazonaws.com"
+ ];
+ nix.settings.extra-trusted-public-keys = [
+ "nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI="
+ ];
+}
+```
+
+Switch to the new configuration:
+
+```sh
+sudo nixos-rebuild switch
+# or
+sudo nix-darwin switch
+```
+
+## Nix without NixOS or nix-darwin
+
+If you don't have an immutable system configuration, you'll need to edit the nix config manually.
+
+Edit this file:
+
+```text
+/etc/nix/nix.conf
+```
+
+Extend it with this:
+
+```conf
+extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
+extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
+```
+
+> [!CAUTION]
+> DO NOT add anyone to `trusted-users` in `/etc/nix/nix.conf` as it [grants root without password](https://nix.dev/manual/nix/stable/command-ref/conf-file.html#conf-trusted-users). Instead, add the binary cache to `extra-substituters` and `extra-trusted-public-keys`.
+
+Restart the nix daemon to load the new config:
+
+**On macOS:**
+```bash
+sudo launchctl stop org.nixos.nix-daemon
+sudo launchctl start org.nixos.nix-daemon
+```
+
+**On Linux (systemd):**
+```bash
+sudo systemctl restart nix-daemon
+```
+
diff --git a/nix/docs/start-here.md b/nix/docs/start-here.md
index 44c086b3..11e0db5c 100644
--- a/nix/docs/start-here.md
+++ b/nix/docs/start-here.md
@@ -14,24 +14,18 @@ If you already have the official Nix installer (not Determinate Systems) install
### Step 1: Edit /etc/nix/nix.conf
-Add or update the following configuration in `/etc/nix/nix.conf`:
+Extend the following configuration in `/etc/nix/nix.conf`:
-```
-allowed-users = *
-always-allow-substitutes = true
-auto-optimise-store = false
-build-users-group = nixbld
-builders-use-substitutes = true
-cores = 0
+```conf
experimental-features = nix-command flakes
-max-jobs = auto
-require-sigs = true
-substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com https://postgrest.cachix.org https://cache.nixos.org/
-trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= postgrest.cachix.org-1:icgW4R15fz1+LqvhPjt4EnX/r19AaqxiVV+1olwlZtI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
-trusted-users = YOUR_USERNAME root
+extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
+extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
```
-**Important**: Replace `YOUR_USERNAME` with your actual username in the `trusted-users` line.
+> [!CAUTION]
+> DO NOT add anyone to `trusted-users` in `/etc/nix/nix.conf` as it [grants root without password](https://nix.dev/manual/nix/stable/command-ref/conf-file.html#conf-trusted-users). Instead, add the binary cache to `extra-substituters` and `extra-trusted-public-keys`.
+
+Read about the binary cache in [/nix/docs/binary-cache.md](/nix/docs/binary-cache.md).
### Step 2: Restart the Nix Daemon
@@ -56,24 +50,18 @@ We'll use the official Nix installer with a custom configuration that includes o
### Step 1: Create nix.conf
-First, create a file named `nix.conf` with the following content:
+First, create a file named `nix.conf.extra` with the following content:
-```
-allowed-users = *
-always-allow-substitutes = true
-auto-optimise-store = false
-build-users-group = nixbld
-builders-use-substitutes = true
-cores = 0
+```conf
experimental-features = nix-command flakes
-max-jobs = auto
-require-sigs = true
-substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com https://postgrest.cachix.org https://cache.nixos.org/
-trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= postgrest.cachix.org-1:icgW4R15fz1+LqvhPjt4EnX/r19AaqxiVV+1olwlZtI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
-trusted-users = YOUR_USERNAME root
+extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
+extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
```
-**Important**: Replace `YOUR_USERNAME` with your actual username in the `trusted-users` line.
+> [!CAUTION]
+> DO NOT add anyone to `trusted-users` in `/etc/nix/nix.conf` as it [grants root without password](https://nix.dev/manual/nix/stable/command-ref/conf-file.html#conf-trusted-users). Instead, add the binary cache to `extra-substituters` and `extra-trusted-public-keys`.
+
+Read about the binary cache in [/nix/docs/binary-cache.md](/nix/docs/binary-cache.md).
### Step 2: Install Nix 2.34.6
diff --git a/nix/hosts/darwin-nixostest/darwin-configuration.nix b/nix/hosts/darwin-nixostest/darwin-configuration.nix
index 210880b9..8f5ec360 100644
--- a/nix/hosts/darwin-nixostest/darwin-configuration.nix
+++ b/nix/hosts/darwin-nixostest/darwin-configuration.nix
@@ -73,11 +73,7 @@ in
"nix-command"
"flakes"
];
- always-allow-substitutes = true;
- max-jobs = "auto";
- trusted-users = [ "@admin" ];
extra-substituters = [ "https://nix-postgres-artifacts.s3.amazonaws.com" ];
- extra-trusted-substituters = [ "https://nix-postgres-artifacts.s3.amazonaws.com" ];
extra-trusted-public-keys = [
"nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI="
];