From 09f461123fb0d4b44909fd44ca1ef01b69f56edb Mon Sep 17 00:00:00 2001
From: Zuckerberg <zuckerberg@neet.dev>
Date: Wed, 18 Feb 2026 19:53:34 -0800
Subject: [PATCH] Add Attic binary cache and containerize gitea runner

Replace nix-serve-only setup with Attic for managed binary caching with
upstream filtering and GC. Move gitea actions runner from host into an
isolated NixOS container with private networking. nix-serve kept alongside
Attic during migration.
---
 .gitea/workflows/check-flake.yaml      |  21 +++-
 common/binary-cache.nix                |  11 +-
 common/server/atticd.nix               |  31 +++++
 common/server/default.nix              |   1 +
 common/server/gitea-actions-runner.nix | 158 ++++++++-----------------
 secrets/attic-netrc.age                | Bin 0 -> 2336 bytes
 secrets/atticd-credentials.age         | Bin 0 -> 4908 bytes
 secrets/binary-cache-push-sshkey.age   | Bin 831 -> 0 bytes
 secrets/gitea-actions-runner-token.age | Bin 589 -> 589 bytes
 secrets/secrets.nix                    |   9 +-
 10 files changed, 119 insertions(+), 112 deletions(-)
 create mode 100644 common/server/atticd.nix
 create mode 100644 secrets/attic-netrc.age
 create mode 100644 secrets/atticd-credentials.age
 delete mode 100644 secrets/binary-cache-push-sshkey.age

diff --git a/.gitea/workflows/check-flake.yaml b/.gitea/workflows/check-flake.yaml
index a073f32..d8bf265 100644
--- a/.gitea/workflows/check-flake.yaml
+++ b/.gitea/workflows/check-flake.yaml
@@ -16,4 +16,23 @@ jobs:
           fetch-depth: 0
 
       - name: Check Flake
-        run: nix flake check --all-systems --print-build-logs --log-format raw --show-trace
\ No newline at end of file
+        run: nix flake check --all-systems --print-build-logs --log-format raw --show-trace
+
+      - name: Push to cache
+        env:
+          XDG_CONFIG_HOME: ${{ runner.temp }}/.config
+        run: |
+          set -euo pipefail
+          attic login local "${{ vars.ATTIC_ENDPOINT }}" "${{ secrets.ATTIC_TOKEN }}"
+          # Get all system toplevel store paths, keeping only those valid in the local store
+          toplevels=$(nix eval .#nixosConfigurations --apply 'cs: map (n: "${cs.${n}.config.system.build.toplevel}") (builtins.attrNames cs)' --json \
+            | jq -r '.[]' \
+            | xargs -I{} sh -c 'nix path-info {} >/dev/null 2>&1 && echo {}' || true)
+          echo "Found $(echo "$toplevels" | wc -l) valid system toplevels"
+          # Expand to full closures, deduplicate, and filter out paths already
+          # signed by cache.nixos.org — only our custom builds need caching
+          paths=$(echo "$toplevels" \
+            | xargs nix path-info -r --json \
+            | jq -r '[to_entries[] | select(.value.signatures | all(startswith("cache.nixos.org") | not)) | .key] | unique[]')
+          echo "Pushing $(echo "$paths" | wc -l) unique paths to cache"
+          echo "$paths" | xargs attic push local:nixos
diff --git a/common/binary-cache.nix b/common/binary-cache.nix
index dcb0018..06f4dbb 100644
--- a/common/binary-cache.nix
+++ b/common/binary-cache.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:
 
 {
   nix = {
@@ -6,11 +6,11 @@
       substituters = [
         "https://cache.nixos.org/"
         "https://nix-community.cachix.org"
-        "http://s0.koi-bebop.ts.net:5000"
+        "http://s0.koi-bebop.ts.net:28338/nixos"
       ];
       trusted-public-keys = [
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU="
+        "nixos:SnTTQutdOJbAmxo6AQ3cbRt5w9f4byMXQODCieBH3PQ="
       ];
 
       # Allow substituters to be offline
@@ -19,6 +19,11 @@
       # and use this flag as intended for deciding if it should build missing
       # derivations locally. See https://github.com/NixOS/nix/issues/6901
       fallback = true;
+
+      # Authenticate to private nixos cache
+      netrc-file = config.age.secrets.attic-netrc.path;
     };
   };
+
+  age.secrets.attic-netrc.file = ../secrets/attic-netrc.age;
 }
diff --git a/common/server/atticd.nix b/common/server/atticd.nix
new file mode 100644
index 0000000..9aefc5a
--- /dev/null
+++ b/common/server/atticd.nix
@@ -0,0 +1,31 @@
+{ config, lib, ... }:
+
+{
+  config = lib.mkIf (config.thisMachine.hasRole."binary-cache") {
+    services.atticd = {
+      enable = true;
+      environmentFile = config.age.secrets.atticd-credentials.path;
+      settings = {
+        listen = "[::]:28338";
+
+        chunking = {
+          nar-size-threshold = 64 * 1024; # 64 KiB
+
+          # The preferred minimum size of a chunk, in bytes
+          min-size = 16 * 1024; # 16 KiB
+
+          # The preferred average size of a chunk, in bytes
+          avg-size = 64 * 1024; # 64 KiB
+
+          # The preferred maximum size of a chunk, in bytes
+          max-size = 256 * 1024; # 256 KiB
+        };
+
+        compression.type = "zstd";
+        garbage-collection.default-retention-period = "6 months";
+      };
+    };
+
+    age.secrets.atticd-credentials.file = ../../secrets/atticd-credentials.age;
+  };
+}
diff --git a/common/server/default.nix b/common/server/default.nix
index c0e0f8a..a7c20cf 100644
--- a/common/server/default.nix
+++ b/common/server/default.nix
@@ -12,6 +12,7 @@
     ./mailserver.nix
     ./nextcloud.nix
     ./gitea-actions-runner.nix
+    ./atticd.nix
     ./librechat.nix
     ./actualbudget.nix
     ./unifi.nix
diff --git a/common/server/gitea-actions-runner.nix b/common/server/gitea-actions-runner.nix
index fa03f46..aa68cc1 100644
--- a/common/server/gitea-actions-runner.nix
+++ b/common/server/gitea-actions-runner.nix
@@ -1,132 +1,78 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, ... }:
 
-# Gitea Actions Runner. Starts 'host' runner that runs directly on the host inside of a nixos container
-# This is useful for providing a real Nix/OS builder to gitea.
-# Warning, NixOS containers are not secure. For example, the container shares the /nix/store
-# Therefore, this should not be used to run untrusted code.
-# To enable, assign a machine the 'gitea-actions-runner' system role
-
-# TODO: skipping running inside of nixos container for now because of issues getting docker/podman running
+# Gitea Actions Runner inside a NixOS container.
+# The container shares the host's /nix/store (read-only) and nix-daemon socket,
+# so builds go through the host daemon and outputs land in the host store.
+# Warning: NixOS containers are not fully secure — do not run untrusted code.
+# To enable, assign a machine the 'gitea-actions-runner' system role.
 
 let
   thisMachineIsARunner = config.thisMachine.hasRole."gitea-actions-runner";
   containerName = "gitea-runner";
+  giteaRunnerUid = 991;
+  giteaRunnerGid = 989;
 in
 {
   config = lib.mkIf (thisMachineIsARunner && !config.boot.isContainer) {
-    # containers.${containerName} = {
-    #   ephemeral = true;
-    #   autoStart = true;
 
-    #   # for podman
-    #   enableTun = true;
+    containers.${containerName} = {
+      autoStart = true;
+      ephemeral = true;
 
-    #   # privateNetwork = true;
-    #   # hostAddress = "172.16.101.1";
-    #   # localAddress = "172.16.101.2";
+      bindMounts = {
+        "/run/agenix/gitea-actions-runner-token" = {
+          hostPath = "/run/agenix/gitea-actions-runner-token";
+          isReadOnly = true;
+        };
+        "/var/lib/gitea-runner" = {
+          hostPath = "/var/lib/gitea-runner";
+          isReadOnly = false;
+        };
+      };
 
-    #   bindMounts =
-    #     {
-    #       "/run/agenix/gitea-actions-runner-token" = {
-    #         hostPath = "/run/agenix/gitea-actions-runner-token";
-    #         isReadOnly = true;
-    #       };
-    #       "/var/lib/gitea-runner" = {
-    #         hostPath = "/var/lib/gitea-runner";
-    #         isReadOnly = false;
-    #       };
-    #     };
+      config = { config, lib, pkgs, ... }: {
+        system.stateVersion = "25.11";
 
-    #   extraFlags = [
-    #     # Allow podman
-    #     ''--system-call-filter=thisystemcalldoesnotexistforsure''
-    #   ];
+        services.gitea-actions-runner.instances.inst = {
+          enable = true;
+          name = containerName;
+          url = "https://git.neet.dev/";
+          tokenFile = "/run/agenix/gitea-actions-runner-token";
+          labels = [ "nixos:host" ];
+        };
 
-    #   additionalCapabilities = [
-    #     "CAP_SYS_ADMIN"
-    #   ];
+        # Disable dynamic user so runner state persists via bind mount
+        systemd.services.gitea-runner-inst.serviceConfig.DynamicUser = lib.mkForce false;
+        users.users.gitea-runner = {
+          uid = giteaRunnerUid;
+          home = "/var/lib/gitea-runner";
+          group = "gitea-runner";
+          isSystemUser = true;
+          createHome = true;
+        };
+        users.groups.gitea-runner.gid = giteaRunnerGid;
 
-    #   config = {
-    #     imports = allModules;
+        nix.settings.experimental-features = [ "nix-command" "flakes" ];
 
-    #     # speeds up evaluation
-    #     nixpkgs.pkgs = pkgs;
-
-    #     networking.hostName = lib.mkForce containerName;
-
-    #     # don't use remote builders
-    #     nix.distributedBuilds = lib.mkForce false;
-
-    #     environment.systemPackages = with pkgs; [
-    #       git
-    #       # Gitea Actions rely heavily on node. Include it because it would be installed anyway.
-    #       nodejs
-    #     ];
-
-    #     services.gitea-actions-runner.instances.inst = {
-    #       enable = true;
-    #       name = config.networking.hostName;
-    #       url = "https://git.neet.dev/";
-    #       tokenFile = "/run/agenix/gitea-actions-runner-token";
-    #       labels = [
-    #         "ubuntu-latest:docker://node:18-bullseye"
-    #         "nixos:host"
-    #       ];
-    #     };
-
-    #     # To allow building on the host, must override the the service's config so it doesn't use a dynamic user
-    #     systemd.services.gitea-runner-inst.serviceConfig.DynamicUser = lib.mkForce false;
-    #     users.users.gitea-runner = {
-    #       home = "/var/lib/gitea-runner";
-    #       group = "gitea-runner";
-    #       isSystemUser = true;
-    #       createHome = true;
-    #     };
-    #     users.groups.gitea-runner = { };
-
-    #     virtualisation.podman.enable = true;
-    #     boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-    #   };
-    # };
-
-    # networking.nat.enable = true;
-    # networking.nat.internalInterfaces = [
-    #   "ve-${containerName}"
-    # ];
-    # networking.ip_forward = true;
-
-    # don't use remote builders
-    nix.distributedBuilds = lib.mkForce false;
-
-    services.gitea-actions-runner.instances.inst = {
-      enable = true;
-      name = config.networking.hostName;
-      url = "https://git.neet.dev/";
-      tokenFile = "/run/agenix/gitea-actions-runner-token";
-      labels = [
-        "ubuntu-latest:docker://node:18-bullseye"
-        "nixos:host"
-      ];
+        environment.systemPackages = with pkgs; [
+          git
+          nodejs
+          jq
+          attic-client
+        ];
+      };
     };
 
-    environment.systemPackages = with pkgs; [
-      git
-      # Gitea Actions rely heavily on node. Include it because it would be installed anyway.
-      nodejs
-    ];
-
-    # To allow building on the host, must override the the service's config so it doesn't use a dynamic user
-    systemd.services.gitea-runner-inst.serviceConfig.DynamicUser = lib.mkForce false;
+    # Matching user on host — the container's gitea-runner UID must be
+    # recognized by the host's nix-daemon as trusted (shared UID namespace)
     users.users.gitea-runner = {
+      uid = giteaRunnerUid;
       home = "/var/lib/gitea-runner";
       group = "gitea-runner";
       isSystemUser = true;
       createHome = true;
     };
-    users.groups.gitea-runner = { };
-
-    virtualisation.podman.enable = true;
-    boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+    users.groups.gitea-runner.gid = giteaRunnerGid;
 
     age.secrets.gitea-actions-runner-token.file = ../../secrets/gitea-actions-runner-token.age;
   };
diff --git a/secrets/attic-netrc.age b/secrets/attic-netrc.age
new file mode 100644
index 0000000000000000000000000000000000000000..c3feeafb9d0bbcd7811ed85cd99ed691e0d496e4
GIT binary patch
literal 2336
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSHbWO_iO;<=NP4p-T
z2}t!aEX@q9Ffw!V3)a_m^G=OS%d|+%NG=QT4GT{)56d!jbL7f(PxQz$3N6d>5B7^R
z^w!Rb%yu^oDb34EPAc~+OG<PrEX&IDj0j2hD@V7@&pf3lD_tQX*Er3%#ND?jG$Jv`
z(?i?B&(y-jtEe(9EiK>GKg=z>ASov`BFQT|JDIDr*uucTJ0daBG{-5pw4yxSJuSf0
zC@0t{%RJ4+vfMev#JeOZDKtz!#RT29tiVJMM@I$yFz4Xl5(5(xlXPFR;^Zn{vvkXV
zsPJ5)tZ<h~!`$Rdi%et7)By9MtWd6Si;%+N<j_Ks$O2>cP_HBd<77u)-}I0|Kc6tS
z<eZZ9luXx(z{-jWzesf3qFgGCO&k?6(h5rw^K-(?417%dLsLr&(=xN1ygZW9i!;K^
zLxQ~`T`U~aoLvfxGhDfRvrEI%f)fj>0$h`$%#4c7eJv|f-3mi|e0&`%40Aj(@{|1?
zD@?OoebdoxD>u$7wMbV;am)2JF$oC@HO+U7GD`BVG|Nl%Pxa0VG4d@dtMD{5Eb)%e
zPfB-6G>qhm@Qd^<F08Z&Eiv?~sPfczHPsIf&ooGPicIz`&3E&$@U#rD%ylgecQrt_
zEw!w$EG=E3%FQv;Jj%l;-zCvEHMKaasysX0vCuHpE2FR|*E=FN+%PCJ$+WDbBHfXz
zz$DKny(HYQxT+*C(pW#jG%_qTQa>cr(5O_~*rz-tEj85JB{#&k%nKuxggb>8dXy`;
zhi15DT4V-ilz9{drWF(?mXsKKg*uvKT7=}LSa@rjM;JJ2`<NOer#o_4RyY?GnFUnl
z<a-<C6h!%DnplPv6#C_cSz1~elqS3S6_<u(MR|B9dFG@0&CD^xNIzY{D8R_k#M_|A
z&pp_ns@NyL(#@nY%Rt-MDZkvSIJHXOJKZPE*{{MYJtUvYyu#DS*QKh;*EG^CIj<x!
zGu^DXG$6vl-$mauGRGs!Fg?RdzckFC%BvXNwv2!R!@P0@Gr!OP^FYV)6rXfox5DtU
z?8K5N7oRkj<bqOtw<xbteHRODcS9$yWXEhS!|(vJsDhM`&~kt6;;c}&(5UcKSN%{&
zx8$Jgv=sf&?5L8cC{HK-^z>|W+n{OEzck1*vdq~rJv7xYATKg3G&jjNEz(FkGcDIW
z%fK};FQ~}FOy9RG)vcT>vDC*TJGIo<$<?LI*U-l+FiktuJ1flJx4_c1FssPZD>NXg
z)YB}Z)Wj3rHfWm6@hOWea?SVjj|#BNGz_jR%kmD7Ffl2}b`5tfb#*p2Dk}>q@H7bV
zbTi<}PjXLkGf67(wJ6ii^7E+hb~X))EG}?!j&L_jH7h90@hu2Rb}TRPOiM<$4Vos6
zjf~O)qH=w*Djh@9oWfI$lFP%ha@`WsjJ(r=$}02SqmnXQOM}t^-SWA-96g-FgY!Le
zBD8&SqjG(<lLGUcvr8Qdvnm|@QX?z8ODjFgqD<V1ssg!mb#)btToPR(jH|Np{0oc%
zJu|~RDngv{)ARjJy^2yJ{EO3!%Q8!%lKtFEoej7SCRlyk_h{nMHF;~lKV83q^Y6px
zs`U#a|9zQxYv*(op~w4^x7dBqn1A<F{o>`DpDkTs=TotJ%MYb(OONQk+4ru1T~E(B
z_m5c<dr(gDA9s!Ei^>W(eg-a7FWmdVU+VszwbBC9rp8Q*_Fa{^y-eBb`FF06n$MTt
zmApA*Y`dz(sAk8*ME0L|c{CQD|0}^;xM|tvt#gZxZJ2dIS;=<(%g(P?c05n#s5Z{i
zk5vm7`9JGK`hVe#_uaOy|5&p3yPE%AzvP^+Svz*$-cS<u_;TRR`~%zi?mr5STAq+D
zawB2G1i5#n%QE|S?(1V<f0FJl)hl*AX{KiW5&;gI-FtTJPcN@*VwrOKQ}v_o;_{tR
z>p2%l>s%F^dOhj-!x`tMRnBbMv&X_Y*--1?b+-RE)wwOc|39=*V~_B4Nx^c7B%c$^
zk0jP?T=P7#HQl_F=XpyyS4ig+$zNQ_(!5Q#q^7bYx5*y7{byfjgreQ+sS>k0w0?bO
zFg#Jep#8?-$96hf|IM5;X-9yF+Nu5tW~=&+=Pi6!q4IT-@0RmT#mr7S^~^TR{O~rx
zZhOJ?eGlhJ1bp_bpCo-Kt@VbY-_xxfv2nMj*ex!%zb9?1ZE@7OV7>Q&*DpiWrj+V_
zbeJ}qTXXB#p8R_+b4)o_`DE@Eijums|9NiRQ|-GCBa$Y5eIlYi;o*z>m9jtljxDJ%
znP{r;{_Lku)p=h-D%blverC}4I`>5MFWWcs6<hcYo@dH7cXU%K4UxO3R=dUc-IW;v
z_K7Un5^rztHcJFlB~OrL65V}pb%p)%edqag-|g&MTW@7^^z3cDhj$jsrJDvn4z7E#
z_4uL(52sH%zcF){q*2+V^NZ9P75wk-;=UGi<L#G_hwa__K5zHU_F8^P)OPOsnv&)O
zk>cB5*qP^fFKpRsc{6?g9og&d|9-#d(Vg?zYW*2M)sFbJVL|HryVuDlwLCarZ@cN_
z0a@|nGtZwsioNml%0<UH0$bf$L%pWNDAgQzcI>s?`eHTiz<I@$zrNRQIlj*z&BI*H
z*682jgs{g^Y^#>&o6pShNzLU`WVx%qL007bEaRY)F9avnbKB2qus2b$e|PSM`r@_L
zbB|Z$C;$8$sh+HGbIY!G?FS#eWvmmOFYPt;sfd*M-|rcbbG!w&f4tWGVnMLeqd$kf
zlo`%$a@DFl{P<jKb<nBOWUJFG&KWy*^St5cUtAK|vReA*waUcn3%%yt*gSow-HfW2
x+Key5jfxKaK0Nn!kmzInCpr;q3KtDm-CCG-#=r1KdZ(kFxVRwW_dJ<)9{~3bqlEwf

literal 0
HcmV?d00001

diff --git a/secrets/atticd-credentials.age b/secrets/atticd-credentials.age
new file mode 100644
index 0000000000000000000000000000000000000000..ed5fcda82129be30d443f1e16dbc4a65b286493c
GIT binary patch
literal 4908
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCU72q-YjD_5v2Ez2p2
zOsj~<FRRQd3k}Y-Eb#PC^Ylo~&Pj6(@$k)Ybn-IKE_5vk^W}02FH5WpO|(oa4M_|#
zO;4>%%PvSUt<1>tG)YX-clR*Lt8noMODy!&FGsg6%B9lS#8JW7)1o*(E6LBjG$TDH
zve=}wuqxb9KP1n`*vu=UJkmSg-`L&9EIh};xtPm6)z2wdyC@?xB`n#X(A&vEKiJ<h
z!#lz(H`CKMJ;PYPL_5T@EYZxzG7{aka^t*Gi*yC=@X8|p@{-)_vgEQn)5yx4vfvPd
zQe*EZSAEZHZRh;lD5vt!%Hq=8tYWS}w~(+(=SYJ*cR%;gpg@=OsA6x^@|+64k}@MB
zKO?_NeFIM)?U1y}FjsWjQp*a<($W=5jibuTOwvr8oyy!p+;Y=B%CqxaiV`hTlERJB
zLj6rc()@#?j7@?|b4<8=%8V=mN}PN>-7N~svMjQLjrG%v&Ah83jV-(bqntg;GAsR^
zD~dBxO#-=eb#)bzBXTX%Gm}l+gR9a*e9ZDvD@qK*-75mz3ri9covVU;JwrWn@(s*A
z10A`N4s2K5c>K_dS#6sP7TB_G)okXRR9B`Ma7J$7ri9h~F4rx#bP1kVBC5LOcjGAz
zYnlH^g&&IFMuqDbrj|9|U}HFK?xW@N<*aNSV_)B-jFjX_!Tbu7d}C|(ALc(|{9<c7
zo1mGSjqJ%z`9D49+WrL}`y;-#N3y5$>DjB@o2T8F=%lN^<oSVPA8q_O_Y|7*D^{`E
z&bq*Ilh1)gsnGwFl%^qrRn`ALajoXBpYB^MA9ZqN|0Kph7WJi5y*CKmnb9O9q&`jF
zLMf<LTzT2MS!*iKZJJtkR%V~c`^76dRrT(~?EUBAy+i*-L(<>N+KiFUxpn;S>+MvD
zJ(xTt=EFIkYfrQuF1-@a6dENgl9xT}NMXv=y9W-O)nvTo)}{9#eR6xWmHtvz(|#{y
z%@8K@d@i1tiI)~0doZ7QwpFcKa`U0ZMOp`wjHF}?_AEWKBCBslt>s<!*Ud5(1*H!R
zTylSwv;T9twr#=wr;d@n>sFXuUwSKK(UJ`fZ@(q4du#k+m)bJ9tS84#KMOWd?9kl$
z^`@TYuKWX&uicPm-ufc5OC;iA(XF?&8k-OA)_Q!Ya!UulQ%hb|v#U&&jjE;DxkzKZ
zNvX$9IcKWo>iOR@+G7}MZJgMCj<HmHm971=nf%kUTjGM`&sgmdY^YaYI3ti!7F?JU
z%3qLvw4~weg)=5T6NCy~SasN$MGbBQ?|$ZCxo_9&Q)+YWF4uO-b(qH*&Hv%E+_sIb
zOm{D==baR=XVU`zRA;d{hWpRFQ8&_Dep)6a_hO-f`*Ar*o!9zDcihl0-C`yYxIN=Y
z$o2>Yv4aeYuWwlr$*Z+_dwhwe#a!pAJ;tkk|GvLHFDPgCnFjs?n<wszxv}uh2CYMG
zQ;!+X@|4+Y{`zNTPlJj~-L?finTKSjD+-lzMmBzq_MKC_WR`u#JGaEir{5<$-ljD<
ziD$aU9np8Dwu|^VI<77JQ<250F0NC0wZ#A8^5PDq-5C#_+*6$*SXUf&Tl%3~u6iS%
z?$ZQypMS<z9t1P3kQRx5RkkSqbEwo$TkeotjlD|t5#9%*Iu!UrEFyQVI9lXzZu1Mj
zmD3}xr!xxNQtyh<+IVDUp8xx(`phedTedoV|LZy}m;1T6Tf{<+iv{d<vtrMGlq%ix
zYx3j!Znmmhxm$beN*5PhetffIB9q{A`}Gz7h1zROt=7I{x7=gMDyhBUQ0~H1@9;wZ
zrpmsjYAgwJgvDpeh#yF{^qJkX>8H)qUkBR$80Gpe%6h32sQl0S$|MsHlSL2v7wuc#
zwrJ^xn00Eui%u;wu6n&o{Xd(za`>eG{3@51Ju<%e%2s<tc<zGaiLCNDOpWs-UUz+W
zl)QD}?JNlf^{US@C#LG`bGr5L<5fG}ZvNRZPp-c=h)geUmYflI-z%@_f60~48#s^r
zJyLbNa>XI<#kMC6a_V<5iI=Aeet+<MLG%Wl&;6&|Ol`}{q)spHEc^7!KXuKL(7v;|
zn_KNeGXi-WDz6<l6#qtm>EnTNzD*Y&+C6lWoD@FKa%O>O@JVkaTj}LI(kka#u1RoY
z8n4aKVsra&Cu>QL+wRTN)t;sPfAb^D-L@%Khvk^Uq`c6A0#>UXsy>Zt#lFTzB_CS+
zwd<7yTlw6I&<(ns&z#~ny$lT8Uee|E=3s41Wt7m`rqzlfeER<%PDqws{`sGM*8Z>~
zIve|VW7o87xK!`S6qR(~z|)&Y`ciAAJg}5WJLGwR=O!b=)<c~FwJV;ps`qqmUD@)B
z#p?Tm81FyFnWTT*Gd%Zic|e0@a^#eSo^9JhZ~l&4;(74f)*Y{m)jzAS9In$WHa&LQ
zf5x8oYnvbZK3B^+<%z)h%A?sEWqX?Un!n%Ez99AGQ=PJwX}PM;e(7yr#c<)M>ESPX
z`#2J}H9Wp_`$dP*r>|-&%N9N^IlMHaH14!r_9C;Nt?|qBU6<Zh^L}lv5p84Iu3)!l
z8UK&Hd0b3iOiw(?I2!Qtfn+$3POW+Vq^u6nx9g`)2}=FW`N3UwzF2u*hpP926KS{H
zOCRs%bF4OT=*(t{|8jt*<LA*+Te;k4*Zxen(-W4OBbxlthMkeSXVHG=ILY0P2Giz#
z-*5DDTE%zn<2iL|+a_5};$S;8@iK$TzT{jFvujPYA(0$m9e>O&MfzG8Gk8vlcTrX5
z+<mU1$U5u(ngciaS}%q!(vS5Gi-`C*d7De^XMdRwY|9?WU7zau;q-Ou^(`j5#1=i=
zkuY`lzSzuDu1mR?3X=a!>Z`Q5`7Gzus{Vrif2E{a{<!Q-uP9&e;<>^sq4SH@_Xo`R
z{z8`hWBdV87k@6%H#t0&%UMoT-6)USYcWCHKDT>a(GjtQUc2UfiJG~3&+lbvUwG_J
zSg1|o=8(AE)akS}x@K~|pGC>T{#W*Q%j14O{^V59rybj{eQnS#EA_}(;Z=`(LR_cs
z%ZsmEyEI_snd=wJRi|}IvGd%0`*?18jM|#xhps*CH_0!QXZO6p;1THdDcU<x_RpfE
z|LV#;GAb1x?jL%}XAlz3TX}|man$5p>6f_juDYuH@w8+=s#?mDJM;O~#oG*?a2}K0
zk~{r`L--fHWsk0y`QM*?a9W&v&fXH|3D?AHa+@`nBqw~X@1Ly9<Hy1^U#a%Xm1Ciq
zw$|US3F^;vpX#qH%_W=S@@}K!`!gPe%}zCU3RIe2Ox;|z{QQ(<M^0W4_FP|ftF`Qo
zlU>*^>z({6N;%afDSKoTj5th=Hgw#+<5zIMRQ6*>XoSV@SsGW_#aMOD*IctX<!je&
zAirX+aKew9|DKpcsNB!;(^|JiZJYgVW+`=*4L1~QqAmzr*bx{j-+4v-PHda^39TNn
zEa8QF-yAOevZ?0u+Y>!+_f48VS@eQls&iGV!G%>~E4WsR?^1R4x+=D~&yAf$g5$;6
zb1PkZ9Zv7FWSF$_+jH~D0w?s2{WMmzIpcMI(X3lXatr=28D=h;XC?Y($p>c6`Jby2
z|FDLA*s^b*i7%tnliW2)ii`GzUJ<r%R}3(^<9WDvs@*@YztcL8@>~th6<M>*<9N|>
zUvc9{t(#o6IZNIs9)1+KVddG*?epxW?>n-1<DIm_Edh`BXg^7l&Ty%@>{)WU$mQj-
zEBAj-&kWjdO}d}w&aZj=FHN|&`|Ra-ze}X`lSy~$woBobaz-kTC9~d7EmnERc&lKi
z#ol}2N8hVvbv@mFHQryx`pE(Z=NHdR=9D~S+ERJADw)M*Q%auij^ob!4<=3dF1h+b
z_My27XBCdrGFcwAY}~VFN!#DJwPqKR+^)=1y>2hQ#>4FWv7;9I3)bqiKbeuZh;Pz`
z$!328+H_Wnuh8}~Q?h=4^Z3L$@n8NaOf6e_e^Q@la?J|H#}C-wJ?`jKvfWcVRWGA=
z!ix1TcD=mN(c@74uPQ*hAb7?TgK~z0OIwZoX6m;nEcLaKW_-J6>YPazSGGzmoo?xC
zT~}1b@KFBY6_(2(;<2lmqYSq_kzYDzh5xqfSJxswx{7A%++Duu0&kZYSCaJl9SM!o
zXZ*W=t~h&%h^FAm*9pl}g+r`AEMpZecRC{|Y1sM6bdK(U$1Sfus>m(n`z~o^@;znp
zfi4eS<ECG)a%atJP7p7)J|K0?BU|U+nrDCYezvMbc)q@?u+V6gK4XS}=xfU?cTF!D
z?S+?aPlzbd&`m$iTjrHfx7k!={zLuhK(UjG8$Mdkj4P9~ir8ms5$p6<Z9&zKIY;&y
zw#{pvm~~~T?SzPm<9eOC+iGuW74j<Tom|b6Q{fPMGcERC>xV-JZno%gnSKjOVP@p}
z&TBuXY@*Qp_$BYEyr+a6=bReM@<reE<idxOX4FRQxjXCH&+q%+%$}sMa_Rnqw)3Z*
z|NG{&e#!iJ@8uVcud4Yu%P26b%je0`KNBqEWxM`deNZcRY_s(8YZ^D#n0;A(TtHeU
zA+~3}$J$@{6>+ndl`(d>|9LUZUA@MCWv6h(r^S-Zp>mV;-g~V2#w=ayrf<Jj{LWLQ
zU47yjtTz{wMqOSVk>S{@oh|yA%Xjhv>C$tBd!p@sPSccLpS}6pq)j!754DsuZ|$0u
z6kL~4-^jZpiZN_sw_IJ)WAEsb*Z%8YnVaUCT@zqBx4}f}BkQ@6Z`yftJ8o?#U^gh<
zw|3o&wTI@cXtT34_DPZp&*n^uou_8dcl=XT_=!E*96M%8H8D3mIO(%A{lV?6ycTCq
zePDLJsWk7?#Mk|c->(%YSNXl-MZ;qq+ixGLvNKN~PUu>@!*B<a*wYC|1sE@^IsQbS
zx&5KcM1Jlt!RV<Mjb5!Q`tEYAgM-0x_NrI`@5pbP1)7Eah$LR_XAT#ZKD|fm%%eUI
z@n-I6vo|<uva>4RSZnRIFqdWW`Zd!Je2$DT{H5LKvpnfxXxwChbKYxXI+nibaBW_)
zTwA8Aj>Y(k{C@L&2Y<eL_U__;=dAyo#xv$$TI}tqbhN8z`HUyOUF<82e!7&OO^wgJ
zlU!*%$&B6paK3h!&ZPVKmAQBN(>eEW#p$?Cl(MsZxQgY4&d)vNSBeXk6fE%h+x(l$
z{nMS&OKaFB?*EbTZr{1%*(W((xvV*0=6g#{kHPZO{qshKS&1{Rhdus%I<&Yr@598%
zM>0<egPDEL&yC+#di%Ljv~ZS}%*$!rQ58|!zAoChJcBcl(KYj`R>?AkMX}${m`=|Y
zZTP+M)QL_F%dWc6S=R2lQl@Gt(+%}X<|TZ3nAQ?~sNmJ?DYvIhn*KQ4@70wJ-(NqP
zKmFZ>&u4$Q=&Fh?F<KUu{{E7LkeuX;f9E#)S=WDJxwwhvsP5(BNn+QGsvg|+U==p`
zyDO-RDS2P1w2FbkA>EC)p8oxH;FZebZEwY27)@}O(JVjDzc_Ve+OvrbZPS)dKT+zr
z{@MJS8>gIl@q~-9Y45*(3DsAkjvAZQ_47@)Ql6RhV|}xu*3QH({!iYKA*L<dKRSK$
zqM!L}G5#XS;qSuOwReG-!=puJdb+-IC*N^3X^iG9D}KxU)BN_aMAe9Q%rQ$>n4MMH
znv-RE{_gR;#ro<0+B{r(L%rhn`TkqDF>%#lzo|FXv+5k%ZfVYGaz7EZ^61C8U#_pT
z?A*yKZQPMENm%T%^wK12Q-%B6FDD2b6I*_3snz>iJ(C#4o=@r4nvwoQIin?YOVxf}
zYggMlf-<Qrwz}I-Jw3Qv&t1KHgP@sMdVxrT+QRdS_2u_HZhp1y*FNj?PS!Tx#OuWT
zd5;qKIowVMy;>fU7~{UZr^DT0SLL^ZrQ%+9B=!naMyGtMu{Yr=lA5%jgK5XMH#({P
zY){=&x4ezXzY=uBV$IW|U(XwzkoWpp^K+xmlr5KER$p%Jee&a*bMvEr{@O`@p4z*<
zjM|@esqVp#l~<2{*kOBe@z?c_Po1)q;f#ngaQky$a!U7!8*a*eLT$4ST>q&zQRhLQ
z^Wpv<Q_Fed|E(`p*Hqjfp|&M0xNuSLvdZ<Zw#M&zwRB^7O-Rh1=esi(c=I3o=CXLA
zQ|`R~2GKziXJ)UOz4X2I6(xB#U%{#;uHB6)l9HbePP6{ReQfT;oxi8?-L=<A`enF(
zj{C~ZjptRg`;GrEwwifON-o>0B8vH}_5z7lf6ZSjRc(E6bmOP+*1CO8fpe06Ej#&2
z_t$Budj?A3X5M;!`U@_r2V_0gJQ%7g(j(Wz?Ko-WwXWBvYvPT?8kT(9;jEVL!y;Lq
zr=H4wkFjEoOhdq-yjC&4%Cg2AOodziE`G=O*Pv3-XWGot2hT2kahths<;5-g0-pyL
z&2ayfE!@0$`?LMA;XCeD*PPJOxp{NW`STWHsfCG-)w&^Gi-Y%Mo<97~b5qfq1#gVF
zcV1^ZA@I^Hv8B3w&-QuqgeSjiRrzZ>=^6jG${ubeza?+~zsSxvw7)om;pDpG4>Xvk
z^7%~p`Ly$8SpUqgZeDp;zCOG5!tol5i@M5R89&Ce^K-w-R9*CPHaT-vK+o{+8(*2E
zq#wHj&;6BhzWHpyzT*tNI+GveD1I@E*>NT?A!JwSx##67wl^lMZQXf4m)GR$QRZT4
P<B9bt_e&aWepCSfzSSH<

literal 0
HcmV?d00001

diff --git a/secrets/binary-cache-push-sshkey.age b/secrets/binary-cache-push-sshkey.age
deleted file mode 100644
index 3fdb50c14b14d5038c2a80244d6c740f6375a1e5..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 831
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCTSa;Y>naa0J*H23sz
ztnw@_voy?4w9GQdF3*i}^bM;D%`I{ZEA>oH3bf32F-s}P@Z~BG_AfQfHwo7_3ri^o
zaw_poOz{lQu`r7;whT{7GcPVk^$&0<G&Zb^vOu@3+&Hh)B3&UPtIWqcSKGA0IN3YH
z)GWut!^lA2C%GgtAlJaqEFw=k$<HV((IvegBa$m1NI%^p%f&b+zt}m%BFNG(+#=mH
zGB{8>GR3q!)za9^!ZAPGTtC?)KO5b))Uv{|v~&fxs8EkegYb0M@UYOtlmM6DsH(E`
zqV&QF|B&*G!hrlzqh!;RV8_s0!*ni}<ZR2r$m9S+ZGYFq?5vO+k0fvNko2f1-;f-A
zZG+&{LQl606ORa|!elO8U0nrN*DODaByGPabJIxo!idrmKj)xaj~t88#FB#I6u*Mv
zu$+K&Z)4-2ViT@w50_iay_~+`!Ef1B=G_IF5B_tw`f*RV%fEob<yxjBo5<Jp=L)+o
z7q7q4J>yCl+kffH4X!1go%j8gh}U#%YuPY4<71fc`W<rf_nfRc!Z?L}^3&RfYFniD
zg)*P<`t!;l^2wX6e>k0M1(j!d{6Dvejj_c$@TJDrPv7`s6}yrx8`qeJO00X)Q4u-g
zw}XK#U(t;2#D7YEHuc>7rC)7sC7O4fpSdw{%kJ8U?&IQJA1-y@$&QH?j;plGyyhfy
z{=@b|ECo+aE<9wsx1sM_boZ4PS5gxCCW^V77u)BVA>E|M_&lIt^8OPmYJNzo+Wc&t
z*XJCUS1a6Kb~9(U&}7!hj3r0xj@%cX{U+Y+PKC48ejSgvJAz5?MK8Y%wOBku`}89>
zk*BAxHN4#M;<x8>tDM4p?xLAi3;*zB%bGvy*%G?)Ez{YC7rt|!i#J^={}|7_Q`qr+
zr=+Tl{_3tp(@&Wi%7&!eH?6)et|P8}_E1lXCI9|X>%yMn?OXLvIelP^cyiNl`jON<
zitf$F+|0k#bnlbgbg*JhG~d^zYZ47i2K!#0`OT^FTrEK7HPbJKIdW+;&DC<R0RTeg
BQ}qA<

diff --git a/secrets/gitea-actions-runner-token.age b/secrets/gitea-actions-runner-token.age
index 8bdbd5103d2fe4dbb0bdc69af5ed4a73b88f521e..5ff450e3e1ccd08861c267d8f12589dd476bd844 100644
GIT binary patch
delta 517
zcmX@ha+YO+PQAZTSb$MZS%9IJWnfBZkh7nAQBp=ovVKlgZe^yir$J&tSw^~NVu)E-
zI+u59ibt7tk!NUtp=+d{g|l}~V1R3}TWMalms_|+VUTfto~cVwL|J)$GMBEMLUD11
zZfc5=si~o*LX=CTv5BLCwxdT_u3t$}WPpEFS$Mi{rdv*?XPH|@Ku~~RidmFTWPWK%
za!!Vufr*nRSB|f5p=XY<wzq#}iIJI$QEHS~qIr5)P>8#GRIzDPR8mxARl0#?dQMvQ
z#E;_P76BF&E<QzN8QK9Al_mOl*;VBc+Qq3B#;)Fm=23Zpc|j&oo{5Gj0h#$+fn}cM
z7Or_gmU%%1`YFXBE<qN>9wnLP*-jS8;Q`*ho{nJ!-lo205pEWf;~B;43&S&03j>S2
z9h3Z`Od>0M0?dp<lYK05b0U+IQbLUiee<hQDpEpADqUT<e8Q@{!@V++{Hg+SDoiT9
zBlYtF%1evF%Zl^Dd@a%pO@j>e({hu{E6gLgbaizVywWp+tDMb?v#b0A-3u&&_0to>
zOH&iw-A%#@tFlvlit>vi@(caa6HSXlxyp|%RoKnq?vNt3^!LHW>5q=`h&a11Giedi
z@3;JaJ4-Ai()#z$?l-zix5jB6ir4efns`QcxnIv~y;r|Z`UEoUJfwTF!%V4fn)B2t
JyCb_#0stH?x8wi-

delta 517
zcmX@ha+YO+PQ7z*kda4GQ9x)~Vyb_-W1?|ciAiN?pnp+eWvM}7o|{u{NQjZYNl;2&
zGFM(?W@bQcp1w(7Zc(ynn7_BSer|3_mA8v!MM{~gn^|yfP-Z};exh4pF_*5LLUD11
zZfc5=si~o*LX=CTv5BKXa&As~c6z00U|D2jo>`tprCV;kL8-Zsaj=QGL19^_TZutv
zQh`}|x_6cZmxZIVb5WtYb9Pu#shh7~zPq<?ikW%7Z%I^mMxcjNW_qZ3NJ?RTVWow^
z#E;_P?%|asMTXub#SvkFC1%dvg@q|u9+pP>KFQ{ZPFaPCMt&9s`Gu+eDdnMD$(HVE
z&e`6ci50%-#oplsIT4<LS(#3z$!4Lh+M(G&DJB&;>4u)BUcru&;~B;4y-lLbT?zv-
zbG*YXvt85Nd|ax$%#)4W%>v4@f-)*HoI_ko%MC)xEiyv60*k|3j559blad3>Ju1VT
zBl0ZM1H#Kv%kzx9a`pWqeH;y4OU-<P0t~acbaizVT-;OjO+B<N%d!n!-Lv#_vqSUB
zs<KVOoK3yLTs+IeQWISw%q?6!f-*Bbxn2d#KP_;1)9+Q6u8Aw8lpZ))B-XZH$y?^Q
z(#jU!H4l%itoUrKux`__1;1u$dFe&QAATF6+E}tx<A3C-ty?VE^#c=E7R8>;z4-sq
Kv?aSHG6Mko+_??_

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 7e4131f..f9d042e 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -7,6 +7,9 @@ let
 
   # nobody is using this secret but I still need to be able to r/w it
   nobody = sshKeys.userKeys;
+
+  # For secrets that all machines need to know
+  everyone = roles.personal ++ roles.server;
 in
 
 with roles;
@@ -22,8 +25,10 @@ with roles;
   # nix binary cache
   # public key: s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU=
   "binary-cache-private-key.age".publicKeys = binary-cache;
-  # public key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB
-  "binary-cache-push-sshkey.age".publicKeys = nobody; # this value is directly given to gitea
+
+  # attic binary cache
+  "atticd-credentials.age".publicKeys = binary-cache;
+  "attic-netrc.age".publicKeys = everyone;
 
   # vpn
   "pia-login.age".publicKeys = pia;