Everything works decently (now using EXWM)

modules/nix/default.nix

@@ -7,6 +7,19 @@
   nix = {
     settings = {
       auto-optimise-store = true;
+      trusted-users = [
+        "root"
+        "ccr"
+        "@wheel"
+      ];
+      trusted-public-keys = [
+        "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ="
+        "mlabs.cachix.org-1:gStKdEqNKcrlSQw5iMW6wFCj3+b+1ASpBVY2SYuNV2M="
+      ];
+      substituters = [
+        "https://cache.iog.io"
+        "https://mlabs.cachix.org/"
+      ];
     };
 
     extraOptions = ''
@@ -21,4 +34,13 @@
 
     optimise.automatic = true;
   };
+
+  age.secrets.mlabs-cachix.file = ../../secrets/mlabs-cachix.age;
+  system.activationScripts = {
+    populate-netrc.text = ''
+      cat <<EOF> /etc/nix/netrc
+      machine mlabs.cachix.org login "" password "$(cat ${config.age.secrets.mlabs-cachix.path})"
+      EOF
+    '';
+  };
 }