feat(devpkg): configurable Nix binary cache via DEVBOX_NIX_BINARY_CACHE

[abueide]

Summary

Fixes #2599.

Devbox hardcodes https://cache.nixos.org as the Nix binary cache it queries for prebuilt package outputs. This makes devbox run fail in network-restricted environments (such as enterprise CI runners with no public internet egress), even when an internal mirror that serves the identical store paths is configured as a Nix substituter.

The hardcoded URL (internal/devpkg/narinfo_cache.go) is used in two places:

1. The narinfo precheck — readCaches seeds its cache list with this URL, and FillNarInfoCache runs unconditionally at the start of every devbox run (via flakePlan). fetchNarInfoStatusFromHTTP does a 5s HEAD to <cache>/<hash>.narinfo; on a network error it returns the error, and fetchNarInfoStatusOnce propagates it.
2. The fromStore of the builtins.fetchClosure expressions in the generated flake.nix.

So on a locked-down runner, devbox run fails hard with:

Error: error running script "..." in Devbox: Head "https://cache.nixos.org/<hash>.narinfo": context deadline exceeded

…even when the toolchain is fully available from an internal substituter. Setting substituters in nix.conf does not help: builtins.fetchClosure contacts its fromStore directly and ignores substituters, and the Go-level precheck has its own hardcoded URL.

This PR adds a DEVBOX_NIX_BINARY_CACHE environment variable that overrides the default cache, following the same pattern as the existing DEVBOX_SEARCH_HOST override. When unset, behavior is unchanged (https://cache.nixos.org), so this is fully backwards compatible. Pointed at an internal mirror that proxies cache.nixos.org, devbox run then works with no public egress:

export DEVBOX_NIX_BINARY_CACHE="https://nix-cache.internal.example.com/mirror"
devbox run ...

Changes

• envir: add a DevboxNixBinaryCache (DEVBOX_NIX_BINARY_CACHE) constant to the central env-var registry.
• devpkg: replace the binaryCache constant with a BinaryCache() accessor that resolves the env var via envir.GetValueOrDefault, defaulting to https://cache.nixos.org; readCaches uses it.
• shellgen: the generated flake's fromStore now uses the http(s) cache the output was actually found in, via a new fetchClosureStore template helper that falls back to the configured binary cache for s3:// caches fetchClosure cannot use directly.

How was it tested?

go test ./internal/devpkg/... ./internal/shellgen/...
go tool golangci-lint run --timeout 5m

• New unit tests: TestBinaryCache (internal/devpkg) covers the default and the override; TestFetchClosureStore (internal/shellgen) covers http(s) pass-through, the s3 fallback, and the configured fallback.
• Existing golden-file flake tests are unchanged when the variable is unset.
• Verified end-to-end: with DEVBOX_NIX_BINARY_CACHE set, the generated flake.nix emits fromStore = "<mirror>" and the narinfo precheck targets the mirror; unset, it remains https://cache.nixos.org.

Community Contribution License

All community contributions in this pull request are licensed to the project
maintainers under the terms of the
Apache 2 License.

By creating this pull request, I represent that I have the right to license the
contributions to the project maintainers under the Apache 2 License as stated in
the
Community Contribution License.

[Copilot]

Pull request overview

This PR makes Devbox’s Nix binary cache configurable via DEVBOX_NIX_BINARY_CACHE, replacing the previously hardcoded https://cache.nixos.org in both the Go-level narinfo precheck and the generated flake.nix builtins.fetchClosure fromStore value. This enables devbox run to work in network-restricted environments when an internal mirror/proxy is available.

Changes:

• Introduces envir.DevboxNixBinaryCache and devpkg.BinaryCache() (defaulting to https://cache.nixos.org, overridable via env var).
• Updates narinfo cache discovery to seed read caches from devpkg.BinaryCache() instead of a constant.
• Updates flake generation to set fromStore based on the cache URI actually used, with tests added for both BinaryCache() and fetchClosureStore() behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/shellgen/tmpl/flake.nix.tmpl	Uses fetchClosureStore to dynamically set builtins.fetchClosure.fromStore.
internal/shellgen/generate.go	Adds fetchClosureStore template helper and wires it into template functions.
internal/shellgen/generate_internal_test.go	Adds unit tests for fetchClosureStore.
internal/envir/env.go	Registers the new DEVBOX_NIX_BINARY_CACHE env var constant with documentation.
internal/devpkg/narinfo_cache.go	Adds BinaryCache() and uses it to seed cache URIs instead of a hardcoded constant.
internal/devpkg/narinfo_cache_test.go	Adds unit tests for BinaryCache() default/override behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.