trim

Replace nix-serve-only setup with Attic for managed binary caching with
upstream filtering and GC. Move gitea actions runner from host into an
isolated NixOS container with private networking. nix-serve kept alongside
Attic during migration.

.gitea/workflows/check-flake.yaml

@@ -5,7 +5,6 @@ on: [push]
 env:
   DEBIAN_FRONTEND: noninteractive
   PATH: /run/current-system/sw/bin/
-  XDG_CONFIG_HOME: ${{ runner.temp }}/.config
 
 jobs:
   check-flake:
@@ -16,11 +15,6 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Configure Attic cache
-        run: |
-          attic login local "${{ vars.ATTIC_ENDPOINT }}" "${{ secrets.ATTIC_TOKEN }}"
-          attic use local:nixos
-
       - name: Check Flake
         run: nix flake check --all-systems --print-build-logs --log-format raw --show-trace
 
@@ -31,8 +25,11 @@ jobs:
             | xargs -I{} nix build ".#nixosConfigurations.{}.config.system.build.toplevel" --no-link --print-build-logs --log-format raw
 
       - name: Push to cache
+        env:
+          XDG_CONFIG_HOME: ${{ runner.temp }}/.config
         run: |
           set -euo pipefail
+          attic login local "${{ vars.ATTIC_ENDPOINT }}" "${{ secrets.ATTIC_TOKEN }}"
           # Get all system toplevel store paths
           toplevels=$(nix eval .#nixosConfigurations --apply 'cs: map (n: "${cs.${n}.config.system.build.toplevel}") (builtins.attrNames cs)' --json | jq -r '.[]')
           echo "Found $(echo "$toplevels" | wc -l) system toplevels"

common/server/atticd.nix

@@ -7,55 +7,25 @@
       environmentFile = config.age.secrets.atticd-credentials.path;
       settings = {
         listen = "[::]:28338";
-        database.url = "postgresql:///atticd?host=/run/postgresql";
-        require-proof-of-possession = false;
 
-        # Disable chunking — the dedup savings don't justify the CPU/IO
-        # overhead for local storage, especially on ZFS which already
-        # does block-level compression.
         chunking = {
-          nar-size-threshold = 0;
+          nar-size-threshold = 64 * 1024; # 64 KiB
-          min-size = 16 * 1024;
+
-          avg-size = 64 * 1024;
+          # The preferred minimum size of a chunk, in bytes
-          max-size = 256 * 1024;
+          min-size = 16 * 1024; # 16 KiB
+
+          # The preferred average size of a chunk, in bytes
+          avg-size = 64 * 1024; # 64 KiB
+
+          # The preferred maximum size of a chunk, in bytes
+          max-size = 256 * 1024; # 256 KiB
         };
 
-        # Let ZFS handle compression instead of double-compressing.
+        compression.type = "zstd";
-        compression.type = "none";
-
         garbage-collection.default-retention-period = "6 months";
       };
     };
 
-    # PostgreSQL for atticd
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = [ "atticd" ];
-      ensureUsers = [{
-        name = "atticd";
-        ensureDBOwnership = true;
-      }];
-    };
-
-    # Use a static user so the ZFS mountpoint at /var/lib/atticd works
-    # (DynamicUser conflicts with ZFS mountpoints)
-    users.users.atticd = {
-      isSystemUser = true;
-      group = "atticd";
-      home = "/var/lib/atticd";
-    };
-    users.groups.atticd = { };
-
-    systemd.services.atticd = {
-      after = [ "postgresql.service" ];
-      requires = [ "postgresql.service" ];
-      serviceConfig = {
-        DynamicUser = lib.mkForce false;
-        User = "atticd";
-        Group = "atticd";
-      };
-    };
-
     age.secrets.atticd-credentials.file = ../../secrets/atticd-credentials.age;
   };
 }

machines/storage/s0/hardware-configuration.nix

@@ -45,12 +45,6 @@
       fsType = "zfs";
       options = [ "zfsutil" "X-mount.mkdir" ];
     };
-  fileSystems."/var/lib/atticd" =
-    {
-      device = "rpool/nixos/var/lib/atticd";
-      fsType = "zfs";
-      options = [ "zfsutil" "X-mount.mkdir" ];
-    };
   fileSystems."/var/log" =
     {
       device = "rpool/nixos/var/log";
@@ -78,5 +72,5 @@
     };
   };
 
-  powerManagement.cpuFreqGovernor = "schedutil";
+  powerManagement.cpuFreqGovernor = "powersave";
 }