The Nix Hydra store delivers a robust and scalable continuous integration solution for the Nix ecosystem. It enables teams to cache builds, share binaries, and achieve deterministic deployments across diverse environments.
By leveraging a shared binary cache, organizations reduce rebuild times, cut compute costs, and improve developer experience while maintaining reproducible software supply chains.
| Store URL | Status | Connected Workers | Last Build |
|---|---|---|---|
| https://cache.nixos.org | Online | 250 | 2024-11-18T14:02:00Z |
| https://hydra.mycompany.io | Online | 12 | 2024-11-18T13:55:00Z |
| https://ci.opensuse.org | Online | 800 | 2024-11-18T13:59:12Z |
| https://experimental.nixos.org | Degraded | ||
| https://nixhub.io | Online | 45 | 2024-11-18T13:50:00Z |
Distributed Build Coordination
Nix Hydra coordinates distributed builds by distributing derivation trees to idle builder machines. It evaluates build dependencies and schedules jobs to optimize throughput while respecting resource constraints.
Each connected worker advertises its system profile, supported platforms, and current load. Hydra uses this information to route builds to appropriate builders, ensuring binaries are produced in the correct format for the target environment.
Trusted Binary Management
The Nix Hydra store acts as a trusted binary manager by signing artifacts with cryptographic keys. This guarantees integrity, prevents tampering, and allows downstream consumers to verify provenance before evaluating or deploying builds.
Administrative policies control which users can push binaries, which channels receive promotion, and under what conditions binaries are garbage collected. Fine-grained privilege separation limits blast radius during accidental or malicious uploads.
High Availability Architecture
A resilient Nix Hydra deployment uses a database backend, replicated build slaves, and load-balanced web interfaces. This architecture supports horizontal scaling and reduces downtime due to node or network failures.
Backups of the PostgreSQL store and periodic binary cache replication protect against data loss. Operational runbooks define recovery time objectives, disaster recovery steps, and communication protocols for maintenance events.
Build Triggering and Workflow Integration
Developers trigger builds by pushing to version control, submitting pull requests, or invoking the API. Hydra integrates with CI workflows, applying linting, testing, and packaging stages before promoting successful builds to staging or production channels.
Conditional builds, matrix jobs, and parameterized workflows enable teams to enforce quality gates while retaining flexibility for experimental branches or nightly validation pipelines.
Operational Best Practices
- Define clear channel promotion rules to separate stable from experimental binaries.
- Enable signature verification on clients to enforce trusted use of cached builds.
- Schedule periodic cache pruning and monitor disk usage on builder nodes.
- Integrate alerting for failed builds, worker disconnections, and database latency.
- Document recovery procedures and test disaster recovery drills on a regular cadence.
FAQ
Reader questions
How does the Nix Hydra store handle build reproducibility across different machines?
By deriving output paths from cryptographic hashes of exact inputs, including dependency graphs and builder specifications, Hydra guarantees bitwise identical results regardless of the physical builder.
Can I use Nix Hydra with private repositories and restricted network environments?
Yes, you can configure Hydra workers to pull from private Git sources over SSH and push binaries to an air-gapped cache, provided the necessary keys and access routes are in place.
What happens when two workers attempt to build the same derivation simultaneously?
Hydra employs a build locking mechanism; the first worker to claim the job proceeds, while the second worker skips or retries, preventing wasted resources and conflicting uploads.
How can I monitor build queue times and resource utilization in Nix Hydra?
Built-in metrics and web dashboards display queue lengths, builder status, and historical build durations, allowing operators to right-size infrastructure and prioritize urgent jobs.