This PR includes settings for enabling remote build cache options in buck2. Note that remote build execution is another topic and will be addressed with different work.

Adds settings for our remote build cache at https://bb.systeminit.com. Hosting details for this site are in the image below
Sets using and uploading to the remote cache in the platform def. ~~Note that these settings require a later version of buck2, so this PR should be blocked until https://github.com/NixOS/nixpkgs/pull/406786 merges~~
Sets allow_cache_uploads to True in the rust prelude for bins, libs, and tests. This has come up in the buck2 discord as something they might set by default
Adds a wrapper container image for the bb-storage project. This is a component of BuildBarn specifically for caching. Luckily, it's broken out so we can ship it independently

The hosting and access details for buildbarn are below. The buildkite workers talk across vpc endpoints to an nlb that is fronting bb-storage running in an ASG. bb-storage uses local SSDs and EFS as a backend. Local devs will talk across a Global Accelerator to the same nlb.

BB-storage has internal authentication included as part of this PR in form of a tiny go application that uses the bb-storage protobuf to validate pre-created tokens (please forgive my sins). Tokens have been provided to si-ci in this pr. Devs will want to provide this token to their nix environment before starting buck2, otherwise buck2 will yell at you. It is available in our password storage place and be placed in a .env file in the root of the repo.

This PR makes no attempts to optimize how and what we cache. It's possible we may need to adjust other parts of the prelude stack to cache more effectively.

NOTE: in cases where the remote cache is unresolvable, buck2 does not seem to have a way to fallback to just building locally. In those cases, --no-remote-cache must be appended to the command to ensure the entire build happens locally. See this conversation and hope for traction.. Note that this includes cases where the aforementioned token has not been set.

May 14 '25 17:05 sprutton1

Dependency Review

✅ No vulnerabilities or OpenSSF Scorecard issues found.

Scanned Files

None