binary-cache-upload.nix

{ config, pkgs, ... }:
{
  # Configure nix to upload build results to the cache
  nix.extraOptions =
    let
      post-build-hook = pkgs.writeShellScript "post-build-hook" ''
        #
        # Invoked by post-build hooks to upload new builds to the cache
        #
        set -euo pipefail
        set -f # disable globbing
        export IFS=' '

        echo "Uploading paths $OUT_PATHS"
        source /run/secrets/nix_cache_writer
        exec nix copy --extra-experimental-features nix-command --to "s3://manifold-nix-cache?region=us-west-2&secret-key=/run/secrets/nix_signing_key" $OUT_PATHS
      '';
    in
    ''
      post-build-hook = ${post-build-hook}
    '';
}