Add central Nix builder and binary cache

modules/services/harmonia/meta.nix

@@ -0,0 +1,3 @@
+{
+  description = "Harmonia binary cache backed by the local Nix store";
+}

modules/services/harmonia/nixos.nix

@@ -0,0 +1,19 @@
+let
+  signingKeyPath = "/run/secrets/harmonia/signing-key";
+in
+{
+  services.harmonia.cache = {
+    enable = true;
+    signKeyPaths = [ signingKeyPath ];
+
+    settings = {
+      bind = "0.0.0.0:5000";
+      priority = 30;
+    };
+  };
+
+  # Keep activation usable while the host-specific SOPS secret is bootstrapped.
+  # Once the secret exists, starting the socket also starts Harmonia on demand.
+  systemd.sockets.harmonia.unitConfig.ConditionPathExists = signingKeyPath;
+  systemd.services.harmonia.unitConfig.ConditionPathExists = signingKeyPath;
+}