Add central Nix builder and binary cache

modules/systems/nix/build-server/meta.nix

@@ -0,0 +1,3 @@
+{
+  description = "Central Nix build server policy and persistent fleet roots";
+}

modules/systems/nix/build-server/nixos.nix

@@ -0,0 +1,33 @@
+{ primaryUser, ... }:
+let
+  GiB = 1024 * 1024 * 1024;
+in
+{
+  nix = {
+    nrBuildUsers = 64;
+
+    settings = {
+      # Limit concurrent derivations so build scratch and memory usage remain
+      # bounded. Each derivation may still use every vCPU exposed to the VM.
+      max-jobs = 2;
+      cores = 0;
+
+      # Keep enough room for large desktop, browser, and CUDA closures.
+      min-free = 64 * GiB;
+      max-free = 128 * GiB;
+    };
+  };
+
+  systemd.services.nix-daemon.serviceConfig = {
+    MemoryAccounting = true;
+    MemoryMax = "90%";
+    OOMScoreAdjust = 500;
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/nix-fleet 0750 ${primaryUser} users - -"
+    "d /var/lib/nix-fleet/roots 0750 ${primaryUser} users - -"
+    "d /var/lib/nix-fleet/roots/build 0750 ${primaryUser} users - -"
+    "d /var/lib/nix-fleet/roots/deploy 0750 ${primaryUser} users - -"
+  ];
+}

modules/systems/nix/homelab-cache/common.nix

@@ -0,0 +1,22 @@
+{ lib, ... }:
+let
+  publicKeyFile = ./public-key;
+  hasPublicKey = builtins.pathExists publicKeyFile;
+  publicKey = if hasPublicKey then lib.removeSuffix "\n" (builtins.readFile publicKeyFile) else "";
+in
+{
+  assertions = [
+    {
+      assertion = hasPublicKey;
+      message = ''
+        systems.nix.homelab-cache requires
+        modules/systems/nix/homelab-cache/public-key
+      '';
+    }
+  ];
+
+  nix.settings = lib.mkIf hasPublicKey {
+    extra-substituters = [ "http://nix-builder:5000" ];
+    extra-trusted-public-keys = [ publicKey ];
+  };
+}

modules/systems/nix/homelab-cache/meta.nix

@@ -0,0 +1,3 @@
+{
+  description = "Homelab Harmonia binary-cache client settings";
+}

modules/systems/sops/nixos.nix

@@ -1,8 +1,3 @@
 {
   services.pcscd.enable = true;
-
-  sops.secrets."users/moons/hashedPassword" = {
-    sopsFile = ../../../secrets/common/system.yaml;
-    neededForUsers = true;
-  };
 }