Add nix-netrc secret to picard, pike, kirk and sisko

hosts/default.nix

@@ -59,6 +59,7 @@
           "git-workspace-tokens".owner = "ccr";
           "autistici-password".owner = "ccr";
           "restic-hetzner-password" = { };
+          "nix-netrc" = { };
         };
       };
 
@@ -87,6 +88,7 @@
           "restic-hetzner-password" = { };
           "forgejo-runners-token".owner = "nixuser";
           "forgejo-nix-access-tokens".owner = "nixuser";
+          "nix-netrc" = { };
         };
       };
 
@@ -120,6 +122,7 @@
           };
           "matrix-registration-shared-secret".owner = "matrix-synapse";
           "arbi-config".owner = "arbi";
+          "nix-netrc" = { };
         };
       };
 
@@ -143,6 +146,7 @@
           "cachix-personal-token".owner = "ccr";
           "git-workspace-tokens".owner = "ccr";
           "autistici-password".owner = "ccr";
+          "nix-netrc" = { };
         };
       };
 

modules/nix/default.nix

@@ -20,20 +20,20 @@
         "root"
         "@wheel"
       ];
-      netrc-file = "/etc/nix/netrc";
+      netrc-file = config.age.secrets.nix-netrc.path;
       substituters = [
-        #   "s3://cache?profile=default&region=eu-south-1&scheme=https&endpoint=cache.aciceri.dev"
         "https://cache.iog.io"
         "https://cache.lix.systems"
         "https://nix-community.cachix.org"
-        "https://mlabs.cachix.org"
+        # "https://mlabs.cachix.org"
+        "http://sisko.wg.aciceri.dev:8081/nixfleet"
       ];
       trusted-public-keys = [
-        #   "cache.aciceri.dev~1:nJMfcBnYieY2WMbYDG0s9S5qUhU+V4RPL+X9zcxXxZY="
         "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ="
         "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "mlabs.cachix.org-1:gStKdEqNKcrlSQw5iMW6wFCj3+b+1ASpBVY2SYuNV2M="
+        # "mlabs.cachix.org-1:gStKdEqNKcrlSQw5iMW6wFCj3+b+1ASpBVY2SYuNV2M="
+        "nixfleet:Bud23440n6mMTmgq/7U+mk91zlLjnx2X3lQQrCBCCU4="
       ];
       deprecated-features = [ "url-literals" ];
     };

secrets/secrets.nix

@@ -157,6 +157,13 @@ with keys.users;
     ccr-ssh
     sisko
   ];
+  "nix-netrc.age".publicKeys = [
+    ccr-ssh
+    sisko
+    pike
+    picard
+    kirk
+  ];
 
   # WireGuard
   "picard-wireguard-private-key.age".publicKeys = [