Binary Caching

Most packages come pre-built with binaries provided by the official Nix binary cache.

If you’re modifying a package or using a package that’s not built upstream, Nix will build it from source instead of downloading a binary.

To prevent packages from being built more than once, devenv provides seamless integration with binary caches hosted by Cachix.

Setup with SecretSpec (recommended)

You don’t need to install Cachix client, devenv will handle binary caching for you.

Create either a personal auth token or a per-cache token in the cache settings.

Enable SecretSpec with the system keyring as the provider, and enable devenv’s built-in Cachix token requirement:

secretspec:
  enable: true
  provider: keyring
  cachix_auth_token: true

No secretspec.toml declaration is needed. Run devenv shell; on the first interactive run, devenv prompts for the token and saves it to the keyring. Subsequent runs resolve it automatically. Non-interactive invocations, such as direnv, cannot prompt, so run devenv shell once first.

devenv uses the resolved secret for both pulling from private caches and pushing, without exporting it into your environment.

Setting secretspec.cachix_auth_token to true uses the secret name CACHIX_AUTH_TOKEN. Set it to a string instead when your SecretSpec backend’s policy (e.g. OpenBao/Vault) only grants access to the token under a different name:

secretspec:
  enable: true
  provider: openbao
  cachix_auth_token: MY_TEAM_CACHIX_TOKEN

Setup (legacy)

Export a personal auth token or a per-cache token as CACHIX_AUTH_TOKEN=XXX.

If CACHIX_AUTH_TOKEN is not set in the environment and SecretSpec does not provide it, devenv falls back to the auth token stored by the Cachix CLI (cachix authtoken) in $XDG_CONFIG_HOME/cachix/cachix.dhall (usually ~/.config/cachix/cachix.dhall).

Pull

Configure your new cache:

{
  cachix.pull = [ "mycache" ];
}

Pushing

{
  cachix.push = "mycache";
}

Pushing binaries conditionally

You’ll likely not want every user to push to the cache.

It’s usually convenient to enable pushing explicitly, for example as part of CI run:

$ echo '{ cachix.push = "mycache"; }' > devenv.local.nix

Disabling the Cachix integration

You can disable the integration by setting the following in devenv.nix:

{
  cachix.enable = false;
}

Nix will continue to substitute binaries from any caches you may have configured externally, such as the official NixOS cache.