replace http cache with build machines and ssh

hosts/nuc/default.nix

@@ -12,7 +12,6 @@
       ./modules/nextcloud
       ./modules/vaultwarden
       ./modules/nginx
-      ./modules/nix-serve
     ];
 
   boot = {
@@ -26,6 +25,12 @@
     cores = 3;
     auto-optimise-store = true;
   };
+
+  sops.secrets."store/secretkey" = { };
+  nix.extraOptions = ''
+    secret-key-files = ${config.sops.secrets."store/secretkey".path}
+  '';
+
   environment.persistence."/nix/persist/system" = {
     directories = [
       "/etc/ssh"
@@ -75,8 +80,8 @@
   users.users.root.initialHashedPassword = "$y$j9T$hYM7FT2hn3O7OWBn9uz8e0$XquxONcPSke6YjdRGwOzGxC0/92hgP7PIB0y0K.Qdr/";
   users.users.root.openssh.authorizedKeys.keyFiles = [
     ../../keys/ssh/rouven-thinkpad
+    ../../keys/ssh/root-thinkpad
     ../../keys/ssh/rouven-pixel
-    # ../../keys/ssh/rouven-smartcard
   ];
 
   system.stateVersion = "22.11";

hosts/nuc/modules/nix-serve/default.nix

@@ -1,18 +0,0 @@
-{ config, ... }:
-let
-  domain = "cache.rfive.de";
-in
-{
-  sops.secrets."nix-serve/secretkey" = { };
-  services.nix-serve = {
-    enable = true;
-    secretKeyFile = config.sops.secrets."nix-serve/secretkey".path;
-  };
-  services.nginx.virtualHosts."${domain}" = {
-    enableACME = true;
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:${toString config.services.nix-serve.port}";
-    };
-  };
-}

hosts/thinkpad/default.nix

@@ -1,6 +1,5 @@
 { config, pkgs, lib, ... }:
 {
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
 
   imports =
     [
@@ -28,8 +27,32 @@
     tmp.useTmpfs = true;
   };
 
-  nix.settings = {
-    auto-optimise-store = true;
+  nix = {
+    settings = {
+      experimental-features = [ "nix-command" "flakes" ];
+      auto-optimise-store = true;
+      substituters = [
+        "ssh-ng://nuc.lan"
+      ];
+      trusted-public-keys = [
+        "nuc.lan:mLrambwSWwqlqe04cSxylWbl5cIIiZsEvmgq2+NT/ww="
+      ];
+    };
+    distributedBuilds = true;
+    extraOptions = ''
+      builders-use-substitutes = true
+    '';
+    buildMachines = [
+      {
+        hostName = "nuc.lan";
+        system = "x86_64-linux";
+        protocol = "ssh-ng";
+        maxJobs = 2;
+        speedFactor = 1;
+        supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+        mandatoryFeatures = [ ];
+      }
+    ];
   };
 
   environment.persistence."/nix/persist/system" = {
@@ -37,6 +60,7 @@
       "/etc/nixos" # bind mounted from /nix/persist/system/etc/nixos to /etc/nixos
       "/etc/ssh"
       "/etc/secureboot"
+      "/root/.ssh"
     ];
     files = [
       "/etc/machine-id"