A self-hosted Nix binary cache in a single Go binary. One static executable is the server, the admin dashboard and the push client. It needs no other services.
- One binary, no dependencies. SQLite or PostgreSQL for metadata, local disk or any S3-compatible bucket for data.
- Deduplicated storage. Content-defined chunking (FastCDC) shares bytes across every path and every cache, and compresses them with zstd at rest.
- Fast pushes. The client uploads only the chunks the server is missing, and can skip
paths an upstream cache such as
cache.nixos.orgalready signed. - Safe by default. Tokens are scoped to a single cache and revoked immediately. Signing keys never leave the server, and incomplete data fails with an error instead of a truncated download.
- Multi-tenant. Workspaces, organizations, roles, quotas and optional self-service signup.
- A real dashboard. Caches, tokens, users, live status and an activity log, in six languages, light and dark.
Run the server:
docker run -d -p 8080:8080 -v xilo-data:/data \
-e XILO_ADMIN_PASSWORD=change-me ghcr.io/stubbedev/xilo:latestOpen http://localhost:8080/admin, sign in as admin, then create a cache and a push
token. On the cache's page you can copy the setup snippets.
Push to it:
xilo login http://localhost:8080 --token <token>
xilo push myteam/mycache ./resultPull from it by adding the cache to nix.conf. xilo use myteam/mycache adds it for you:
extra-substituters = http://localhost:8080/c/myteam/mycache
extra-trusted-public-keys = mycache:<public-key>
Prebuilt binaries, the Nix flake, and the NixOS and home-manager modules are covered in Install.
Cache: dedup and setup snippets |
Status: live health and traffic |
Activities: every admin and API change |
Console: every workspace on the instance |
CI measures these numbers and commits them; none are typed in by hand. Benchmarks explains the method, and Features compares xilo with the alternatives feature by feature.
| Install | Docker, binaries, Nix flake, first run |
| Usage | pulling, pushing, GitHub Actions, CLI, tokens, organizations |
| Configuration | config file, environment, S3, PostgreSQL, NixOS and home-manager modules, TLS |
| Operations | garbage collection, quotas, fsck, backups, upgrades, metrics |
| Features | the full feature list and a comparison with other caches |
| Benchmarks | how xilo compares with other caches, and the regression gate |
| How it works | request path and what a push avoids doing |
| Development | dev shell, recipes, UI stack, test suites |
nix develop # go, templ, air, just, golangci-lint, ...
just dev # live-reload server with demo data on :8090 (admin / demo)
just check # everything CI runsRun just to list every recipe. Development has the rest, including
the UI stack and the test suites. RELEASING.md covers releases and
SECURITY.md covers vulnerability reports.