Merge branch 'cache_nix_build'

Separate out the install of dependencies so they can be cached as docker layers before the homepage source code is copied in.
Fix image links.
2026-10-23 20:58:01 -04:00 · 2026-10-23 20:57:20 -04:00 · 2026-10-21 18:58:14 -04:00 · 2026-10-20 23:18:28 -04:00 · 2026-10-20 23:18:20 -04:00 · 2026-10-20 23:18:20 -04:00
6 changed files with 95 additions and 71 deletions
--- a/.webhook_bridge/pipeline-build-homepage-staging.yaml
+++ b/.webhook_bridge/pipeline-build-homepage-staging.yaml
@@ -7,7 +7,7 @@ metadata:
 spec:
  timeouts:
    pipeline: "2h0m0s"
-    tasks: "1h0m0s"
+    tasks: "1h0m40s"
    finally: "0h30m0s"
  taskRunTemplate:
    serviceAccountName: build-bot
@@ -53,7 +53,7 @@ spec:
            - name: url
              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
            - name: revision
-              value: f914437a46978b95f325f68d791dcf1a35738f60
+              value: df36b3853a5657fd883015cdbf07ad6466918acf
            - name: pathInRepo
              value: task/gitea-set-status/0.1/gitea-set-status.yaml
        params:
@@ -123,37 +123,43 @@ spec:
            - name: url
              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
            - name: revision
-              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
+              value: 9c6d3bc418dc2f54d73bdfa984bce3eb6c65fd60
            - name: pathInRepo
-              value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
+              value: task/buildah-rootless-daemonless/0.1/buildah-rootless-daemonless.yaml
        params:
          - name: OUTPUT
            value: >-
-              type=image,"name=$(params.image-name):latest,$(params.image-name):$(tasks.get-time.results.unix-time)",push=true,compression=zstd,compression-level=22,oci-mediatypes=true
+              $(params.image-name):$(tasks.get-time.results.unix-time)
          - name: CONTEXT
            value: $(params.path-to-image-context)
          - name: DOCKERFILE
            value: $(params.path-to-dockerfile)
          - name: EXTRA_ARGS
            value:
-              - "--opt"
-              - "target=$(params.target-name)"
-              - --import-cache
-              - "type=registry,ref=$(params.image-name):buildcache"
-              - --export-cache
-              - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
-              - --opt
-              - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-              - --opt
-              - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
-          - name: BUILDKITD_TOML
+              - "--target"
+              - "$(params.target-name)"
+              - --cache-from
+              - "$(params.image-name)-buildcache"
+              - --cache-to
+              - "$(params.image-name)-buildcache"
+              - --build-arg
+              - "SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)"
+              - --build-arg
+              - "NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
+          - name: REGISTRIES_CONF
            value: |
-              debug = true
-              [registry."docker.io"]
-                mirrors = ["dockerhub.dockerhub.svc.cluster.local"]
-              [registry."dockerhub.dockerhub.svc.cluster.local"]
-                http = true
-                insecure = true
+              unqualified-search-registries = ["docker.io"]
+
+              [[registry]]
+              location = "dockerhub.dockerhub.svc.cluster.local"
+              insecure = true
+
+              [[registry]]
+              location = "docker.io"
+
+              [[registry.mirror]]
+              location = "dockerhub.dockerhub.svc.cluster.local" # Replace with your mirror URL
+              insecure = true
        workspaces:
          - name: source
            workspace: git-source
@@ -173,7 +179,7 @@ spec:
            - name: url
              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
            - name: revision
-              value: f914437a46978b95f325f68d791dcf1a35738f60
+              value: df36b3853a5657fd883015cdbf07ad6466918acf
            - name: pathInRepo
              value: task/gitea-set-status/0.1/gitea-set-status.yaml
        params:
@@ -202,7 +208,7 @@ spec:
            - name: url
              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
            - name: revision
-              value: f914437a46978b95f325f68d791dcf1a35738f60
+              value: df36b3853a5657fd883015cdbf07ad6466918acf
            - name: pathInRepo
              value: task/gitea-set-status/0.1/gitea-set-status.yaml
        params:
@@ -245,4 +251,4 @@ spec:
    - name: path-to-image-context
      value: .
    - name: path-to-dockerfile
-      value: docker/server
+      value: docker/server/Dockerfile
--- a/.webhook_bridge/pipeline-build-homepage.yaml
+++ b/.webhook_bridge/pipeline-build-homepage.yaml
@@ -7,7 +7,7 @@ metadata:
 spec:
  timeouts:
    pipeline: "2h0m0s"
-    tasks: "1h0m0s"
+    tasks: "1h0m40s"
    finally: "0h30m0s"
  taskRunTemplate:
    serviceAccountName: build-bot
@@ -70,6 +70,7 @@ spec:
              script: |
                #!/usr/bin/env sh
                set -euo pipefail
+                export GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new"
                git fetch --tags
                current_tag=$(git tag --points-at HEAD --list 'v*.*.*')
                if [ -z "$current_tag" ]; then
@@ -90,11 +91,9 @@ spec:
            - name: url
              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
            - name: revision
-              value: f914437a46978b95f325f68d791dcf1a35738f60
+              value: df36b3853a5657fd883015cdbf07ad6466918acf
            - name: pathInRepo
              value: task/gitea-set-status/0.1/gitea-set-status.yaml
-        runAfter:
-          - fetch-repository
        params:
          - name: CONTEXT
            value: "$(params.JOB_NAME)"
@@ -110,19 +109,9 @@ spec:
            value: pending
          - name: TARGET_URL
            value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
+        runAfter:
+          - fetch-repository
      - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: f914437a46978b95f325f68d791dcf1a35738f60
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
        params:
          - name: url
            value: $(params.REPO_URL)
@@ -130,6 +119,18 @@ spec:
            value: $(params.PULL_BASE_SHA)
          - name: deleteExisting
            value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
      - name: build-image
        taskRef:
          resolver: git
@@ -137,37 +138,43 @@ spec:
            - name: url
              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
            - name: revision
-              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
+              value: 9c6d3bc418dc2f54d73bdfa984bce3eb6c65fd60
            - name: pathInRepo
-              value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
+              value: task/buildah-rootless-daemonless/0.1/buildah-rootless-daemonless.yaml
        params:
          - name: OUTPUT
            value: >-
-              type=image,"name=$(params.image-name):latest,$(params.image-name):$(tasks.detect-tag.results.tag)",push=true,compression=zstd,compression-level=22,oci-mediatypes=true
+              $(params.image-name):$(tasks.detect-tag.results.tag)
          - name: CONTEXT
            value: $(params.path-to-image-context)
          - name: DOCKERFILE
            value: $(params.path-to-dockerfile)
          - name: EXTRA_ARGS
            value:
-              - "--opt"
-              - "target=$(params.target-name)"
-              - --import-cache
-              - "type=registry,ref=$(params.image-name):buildcache"
-              - --export-cache
-              - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
-              - --opt
-              - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-              - --opt
-              - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
-          - name: BUILDKITD_TOML
+              - "--target"
+              - "$(params.target-name)"
+              - --cache-from
+              - "$(params.image-name)-buildcache"
+              - --cache-to
+              - "$(params.image-name)-buildcache"
+              - --build-arg
+              - "SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)"
+              - --build-arg
+              - "NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
+          - name: REGISTRIES_CONF
            value: |
-              debug = true
-              [registry."docker.io"]
-                mirrors = ["dockerhub.dockerhub.svc.cluster.local"]
-              [registry."dockerhub.dockerhub.svc.cluster.local"]
-                http = true
-                insecure = true
+              unqualified-search-registries = ["docker.io"]
+
+              [[registry]]
+              location = "dockerhub.dockerhub.svc.cluster.local"
+              insecure = true
+
+              [[registry]]
+              location = "docker.io"
+
+              [[registry.mirror]]
+              location = "dockerhub.dockerhub.svc.cluster.local" # Replace with your mirror URL
+              insecure = true
        workspaces:
          - name: source
            workspace: git-source
@@ -187,7 +194,7 @@ spec:
            - name: url
              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
            - name: revision
-              value: f914437a46978b95f325f68d791dcf1a35738f60
+              value: df36b3853a5657fd883015cdbf07ad6466918acf
            - name: pathInRepo
              value: task/gitea-set-status/0.1/gitea-set-status.yaml
        params:
@@ -216,7 +223,7 @@ spec:
            - name: url
              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
            - name: revision
-              value: f914437a46978b95f325f68d791dcf1a35738f60
+              value: df36b3853a5657fd883015cdbf07ad6466918acf
            - name: pathInRepo
              value: task/gitea-set-status/0.1/gitea-set-status.yaml
        params:
@@ -259,4 +266,4 @@ spec:
    - name: path-to-image-context
      value: .
    - name: path-to-dockerfile
-      value: docker/server
+      value: docker/server/Dockerfile
--- a/docker/server/Dockerfile
+++ b/docker/server/Dockerfile
@@ -15,9 +15,13 @@ EOF

 RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt

-COPY . /tmp/build
+COPY flake.nix flake.lock /tmp/build
 WORKDIR /tmp/build

+RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build --no-link '.#dependencies'
+
+COPY . /tmp/build
+
 RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build '.#docker_env'

 # Export the built closure to a folder
--- a/flake.lock
+++ b/flake.lock
@@ -8,11 +8,11 @@
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1784333070,
-        "narHash": "sha256-3WkxaHOS13vFBtQFBmGIPScQZDNLk5bqCAY9qBJASl0=",
+        "lastModified": 1792617478,
+        "narHash": "sha256-ctFfFI7qlZxv6s8nznps7KYp/QQ1zzbMKCgLtl7YYRA=",
        "ref": "refs/heads/main",
-        "rev": "faf279292ad20783775d909b96815f7ca2843b85",
-        "revCount": 327,
+        "rev": "1c369e4b25caf4dd9a962340a770fbd6e543820a",
+        "revCount": 331,
        "type": "git",
        "url": "https://code.fizz.buzz/talexander/natter.git"
      },
--- a/flake.nix
+++ b/flake.nix
@@ -74,6 +74,11 @@
          inherit (appliedOverlay.homepage)
            release
            ;
+          dependencies = pkgs.symlinkJoin {
+            # This is to enable the docker image to install all the dependencies, cache that layer, and then build the final site after the org source files have been loaded. Without this, every update to the blog posts would result in recompiling everything.
+            name = "homepage-dependencies";
+            paths = appliedOverlay.homepage.dependencies;
+          };
          docker_env = pkgs.stdenv.mkDerivation {
            pname = "homepage-docker-env";
            version = "0.0.0";
@@ -100,14 +105,16 @@
            natter' = (natter.overlays.default final final).natter.release;
            organic_ast_explorer' =
              (organic_ast_explorer.overlays.default final final).organic_ast_explorer.release;
-            release = homepageScope.callPackage ./nix/package.nix {
+            dependencies = {
              natter = natter';
              organic_ast_explorer = organic_ast_explorer';
              inherit homepage_private;
            };
+            release = homepageScope.callPackage ./nix/package.nix dependencies;
          in
          {
            inherit release;
+            dependencies = (builtins.attrValues dependencies);
          }
        );
      };
--- a/pages/about_me/index.org
+++ b/pages/about_me/index.org
@@ -7,7 +7,7 @@
 #+exclude_tags: noexport

 Links:
- My personal repos: [[https://code.fizz.buzz/explore/repos][code.fizz.buzz]]
+- My personal repos: [[https://code.fizz.buzz/talexander][code.fizz.buzz]]
 - LinkedIn: https://www.linkedin.com/in/tom-alexander-b6a18216/
 - GitHub: https://github.com/tomalexander
 - Resume: https://fizz.buzz/tom_alexander_resume.pdf
Author	SHA1	Message	Date
Tom Alexander	3eb18a24bc	Merge branch 'cache_nix_build' Some checks failed semver Build semver has succeeded Details build-staging Build build-staging has failed Details build Build build has succeeded Details	2026-10-23 20:58:01 -04:00
Tom Alexander	95a6a3eaa2	Separate out the install of dependencies so they can be cached as docker layers before the homepage source code is copied in.	2026-10-23 20:57:20 -04:00
Tom Alexander	433b52768a	Fix image links. All checks were successful semver Build semver has succeeded Details build-staging Build build-staging has succeeded Details build Build build has succeeded Details Canonicalizing in the nix build was causing the image links to reference the nix build path. By switching to lexical normalization, the paths are being properly calculated.	2026-10-21 18:58:14 -04:00
Tom Alexander	5adcc9f815	Merge branch 'buildah' All checks were successful semver Build semver has succeeded Details build-staging Build build-staging has succeeded Details build Build build has succeeded Details	2026-10-20 23:18:28 -04:00
Tom Alexander	1d85d907ac	Switch main build of homepage to buildah.	2026-10-20 23:18:20 -04:00
Tom Alexander	95c149cf5b	Switch staging build of homepage to buildah.	2026-10-20 23:18:20 -04:00
Tom Alexander	ddf58bacea	Update link to personal repos. All checks were successful semver Build semver has succeeded Details build-staging Build build-staging has succeeded Details build Build build has succeeded Details Now that I am mirroring some repositories, it makes sense to link to my specific user to show only my code.	2026-07-21 21:43:25 -04:00