How to disable Flakehub Cache? 401 breaks linux builder in CI (non paying user)

[ojsef39]

Hey there, so no matter what i try, i cant figure out how to just disable the Flakehub caching, since i dont pay for it i get a 401, which is fine since its a warning but the determinate linux builder handles that as an error and then fails in CI:

Workflow: https://github.com/ojsef39/dotfiles.nix/blob/1dbf6eff4eabde6b0bf64007a97fe7913cd5f54a/.github/workflows/validate.yml
(I tried it with nix-installer-action, the determinate-action and with/without magic-cache)
Failed pipeline: https://github.com/ojsef39/dotfiles.nix/actions/runs/21828005098/job/62978114834?pr=295
Warning pipeline: https://github.com/ojsef39/dotfiles.nix/actions/runs/21828005098/job/62978033987?pr=295

Any ideas?

Thank you very much in advance!

[cole-h]

Unfortunately, GitHub is giving me a unicorn looking at... everything (by especially your repo / workflow), but have you tried setting:

- uses: DeterminateSystems/magic-nix-cache-action@main
  with:
    use-flakehub: false

?

[ojsef39]

Hey @cole-h, thanks for your response!
Seems like this gets rid only of the warning for the cache action itself
https://github.com/ojsef39/dotfiles.nix/actions/runs/21861553145/job/63091758896?pr=295

  2026-02-10T10:39:54.012395Z  INFO magic_nix_cache: FlakeHub cache is disabled.
    at magic-nix-cache/src/main.rs:407

but unfortunately not for the build itself:
https://github.com/ojsef39/dotfiles.nix/actions/runs/21861553145/job/63091837904?pr=295

error:
       … while waiting for the build environment for '/nix/store/cw64nb8dcbhygcjlc3wyhq9nx04aqi18-kubectl-debug-customisation-layer.drv' to initialize (failed with exit code 1, previous messages: 
       Error: failed to set up Native Linux Builder

       Caused by:
           HTTP status code 400 Bad Request, reply: Failed to fetch Native Linux Builder guest store paths: failed to copy "/nix/store/3qam90lha5ppgm1k2a5ckj3qd5civzpb-linux-6.1.143" from FlakeHub Cache:
           stdout:
           stderr: error:
                  … during download of 'https://cache.flakehub.com/nix-cache-info'

                  error: unable to download 'https://cache.flakehub.com/nix-cache-info': HTTP error 401

                  response body:

                  {"code":401,"error":"FlakeHubAuth","message":"Failed to auth to FlakeHub (status code 401 Unauthorized): \"User is not authorized for this resource.\"","request_id":"019c4728-7270-7ba3-b2ce-47b5bd9c7fa5"}


       Location:
           src/command/builder/macos.rs:77:10)

Error: 
       error: unexpected EOF reading a line
   0: Failed to build Darwin configuration
   1: Command exited with status Exited(1)

maybe ill try later to disable determinate with the nix-installer-action, not sure if that does what i want tho

determinate | Whether to install Determinate Nix and log in to FlakeHub for private Flakes and binary caches. | Boolean | true
-- | -- | -- | --
determinate	Whether to install [Determinate Nix](https://determinate.systems/enterprise) and log in to FlakeHub for private Flakes and binary caches.	Boolean	true

or using this one instead, thats more experimental maybe that works better with the native-linux-builder experimental feature:
https://github.com/DeterminateSystems/ci

[cole-h]

OK, I see the issue now:

The Native Linux Builder requires has a couple requirements:

1. You are logged in to FlakeHub
2. The Native Linux Builder has been enabled for you

I suspect you're failing on number 2. You'll need to contact us via email to get this enabled for you: https://docs.determinate.systems/troubleshooting/native-linux-builder/#obtain-access

[ojsef39]

I have that feature enabled for my account and i've also checked with determinate-nixd status if the feature is enabled in CI and it looked like it is. I used this feature also locally for quite some time now and only didn't have that issue in CI because i had it built and uploaded to my cache locally so it didn't rebuilt it in CI.

I used the github search in the determinate org to look for the cache url and to me it looks like you can't really disable the flakehub cache, seems like this might be a bug in the github action authentification with flakehub? I'm no really sure

[cole-h]

Oh, whoops, I completely misdiagnosed lol. Sorry about that.

Taking a closer look, I noticed you're setting up cachix in there.

This issue is happening because cachix authtoken sets up a netrc file of its own. The way authentication to FlakeHub Cache works is by using our netrc file that we set up when you use the determinate-nix-action action. Native Linux Builder requires FlakeHub Cache access (even if you're not paying for FlakeHub Cache access), and the only way you can authenticate to FlakeHub Cache is via the netrc file. You could try adding --netrc-file /nix/var/determinate/netrc to your check invocation, and that might work around this issue, but that might break Cachix.

[ojsef39]

No worries, i always have the weirdest issues xD

Ahhhh, yeah that absolutely makes sense.

Thanks for the suggestions, i'll give that a try and see if i can workaround it.

I'll post an update here and close the issue then, thank you very much for digging into it :)

[ojsef39]

I havent tried the workaround yet, but i saw that here https://github.com/ojsef39/dotfiles.nix/actions/runs/21861553145/job/63091758896?pr=295 i get the same issue but in that pipeline there is no cachix running which is interesting

I also added some debugging and seems like the netrc file is fine?
https://github.com/ojsef39/dotfiles.nix/actions/runs/21900810078/job/63228364204?pr=295

Just in case i also run nix build locally, im a bit lost now, i think somehow the token in CI has different permissions than i do have locally:

nix build --option substituters https://cache.flakehub.com --option trusted-public-keys "cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM=" nixpkgs#hello
copying path '/nix/store/dw402azxjrgrzrk6j0p66wkqrab5mwgw-hello-2.12.2.tar.gz' from 'https://cache.flakehub.com'...

[ojsef39]

Okay so ive tried something different now

      - name: Re-authenticate with FlakeHub token
        run: |
          echo "${{ secrets.FLAKEHUB_TOKEN }}" | determinate-nixd auth login token --token-file /dev/stdin

and now i dont get that issue anymore, so there actually might be something wrong with the Github authentification
https://github.com/ojsef39/dotfiles.nix/blob/db68f305c24b1059e848fa38ac75fb10db54fa35/.github/workflows/validate.yml