Speed up attic

Replace nix-serve-only setup with Attic for managed binary caching with
upstream filtering and GC. Move gitea actions runner from host into an
isolated NixOS container with private networking. nix-serve kept alongside
Attic during migration.

.gitea/workflows/check-flake.yaml

@@ -5,6 +5,7 @@ on: [push]
 env:
   DEBIAN_FRONTEND: noninteractive
   PATH: /run/current-system/sw/bin/
+  XDG_CONFIG_HOME: ${{ runner.temp }}/.config
 
 jobs:
   check-flake:
@@ -15,6 +16,11 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Configure Attic cache
+        run: |
+          attic login local "${{ vars.ATTIC_ENDPOINT }}" "${{ secrets.ATTIC_TOKEN }}"
+          attic use local:nixos
+
       - name: Check Flake
         run: nix flake check --all-systems --print-build-logs --log-format raw --show-trace
 
@@ -25,11 +31,8 @@ jobs:
             | xargs -I{} nix build ".#nixosConfigurations.{}.config.system.build.toplevel" --no-link --print-build-logs --log-format raw
 
       - name: Push to cache
-        env:
-          XDG_CONFIG_HOME: ${{ runner.temp }}/.config
         run: |
           set -euo pipefail
-          attic login local "${{ vars.ATTIC_ENDPOINT }}" "${{ secrets.ATTIC_TOKEN }}"
           # Get all system toplevel store paths
           toplevels=$(nix eval .#nixosConfigurations --apply 'cs: map (n: "${cs.${n}.config.system.build.toplevel}") (builtins.attrNames cs)' --json | jq -r '.[]')
           echo "Found $(echo "$toplevels" | wc -l) system toplevels"

common/server/atticd.nix

@@ -7,25 +7,55 @@
       environmentFile = config.age.secrets.atticd-credentials.path;
       settings = {
         listen = "[::]:28338";
+        database.url = "postgresql:///atticd?host=/run/postgresql";
+        require-proof-of-possession = false;
 
+        # Disable chunking — the dedup savings don't justify the CPU/IO
+        # overhead for local storage, especially on ZFS which already
+        # does block-level compression.
         chunking = {
-          nar-size-threshold = 64 * 1024; # 64 KiB
-
-          # The preferred minimum size of a chunk, in bytes
-          min-size = 16 * 1024; # 16 KiB
-
-          # The preferred average size of a chunk, in bytes
-          avg-size = 64 * 1024; # 64 KiB
-
-          # The preferred maximum size of a chunk, in bytes
-          max-size = 256 * 1024; # 256 KiB
+          nar-size-threshold = 0;
+          min-size = 16 * 1024;
+          avg-size = 64 * 1024;
+          max-size = 256 * 1024;
         };
 
-        compression.type = "zstd";
+        # Let ZFS handle compression instead of double-compressing.
+        compression.type = "none";
+
         garbage-collection.default-retention-period = "6 months";
       };
     };
 
+    # PostgreSQL for atticd
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "atticd" ];
+      ensureUsers = [{
+        name = "atticd";
+        ensureDBOwnership = true;
+      }];
+    };
+
+    # Use a static user so the ZFS mountpoint at /var/lib/atticd works
+    # (DynamicUser conflicts with ZFS mountpoints)
+    users.users.atticd = {
+      isSystemUser = true;
+      group = "atticd";
+      home = "/var/lib/atticd";
+    };
+    users.groups.atticd = { };
+
+    systemd.services.atticd = {
+      after = [ "postgresql.service" ];
+      requires = [ "postgresql.service" ];
+      serviceConfig = {
+        DynamicUser = lib.mkForce false;
+        User = "atticd";
+        Group = "atticd";
+      };
+    };
+
     age.secrets.atticd-credentials.file = ../../secrets/atticd-credentials.age;
   };
 }

machines/storage/s0/hardware-configuration.nix

@@ -45,6 +45,12 @@
       fsType = "zfs";
       options = [ "zfsutil" "X-mount.mkdir" ];
     };
+  fileSystems."/var/lib/atticd" =
+    {
+      device = "rpool/nixos/var/lib/atticd";
+      fsType = "zfs";
+      options = [ "zfsutil" "X-mount.mkdir" ];
+    };
   fileSystems."/var/log" =
     {
       device = "rpool/nixos/var/log";
@@ -72,5 +78,5 @@
     };
   };
 
-  powerManagement.cpuFreqGovernor = "powersave";
+  powerManagement.cpuFreqGovernor = "schedutil";
 }