feat(nix): add harmonia cache to nix.settings

Configure all NixOS machines to use the internal harmonia binary cache:
- Add nix-cache.johnogle.info as substituter
- Add harmonia signing public key to trusted-public-keys
- Enable fallback for local builds when cache unreachable
- Set 5s connect-timeout for faster fallback

Refs: x-qdkuu

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -18,50 +18,3 @@ jobs:
         run: nix flake check
         env:
           NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"
-
-  build-and-cache:
-    runs-on: ubuntu-latest
-    needs: check
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    strategy:
-      fail-fast: false
-      matrix:
-        machine:
-          - nix-book
-          - boxy
-          - zix790prors
-          - nix-deck
-          - john-endesktop
-          - live-usb
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: https://git.johnogle.info/johno/gitea-actions/nix-setup@v1
-
-      - name: Build ${{ matrix.machine }}
-        id: build
-        run: |
-          OUT_PATH=$(nix build .#nixosConfigurations.${{ matrix.machine }}.config.system.build.toplevel --no-link --print-out-paths)
-          echo "out_path=$OUT_PATH" >> "$GITHUB_OUTPUT"
-        env:
-          NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"
-
-      - name: Sign and push to cache
-        run: |
-          # Write signing key
-          echo "${{ secrets.NIX_SIGNING_KEY }}" > /tmp/signing-key
-          chmod 600 /tmp/signing-key
-
-          # Sign the closure
-          nix store sign --key-file /tmp/signing-key -r "${{ steps.build.outputs.out_path }}"
-
-          # Setup SSH key for cache push
-          mkdir -p ~/.ssh
-          echo "${{ secrets.CACHE_SSH_KEY }}" > ~/.ssh/cache_key
-          chmod 600 ~/.ssh/cache_key
-          ssh-keyscan -H ${{ secrets.CACHE_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
-
-          # Push to cache
-          nix copy --to "ssh-ng://${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }}?ssh-key=$HOME/.ssh/cache_key" "${{ steps.build.outputs.out_path }}"
-        env:
-          NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"

flake.lock

@@ -8,17 +8,17 @@
         ]
       },
       "locked": {
-        "lastModified": 1770685931,
-        "narHash": "sha256-sOdxPktaKRuRE83Z2shWUejzGXa72T0r9XjWmPx9b9A=",
+        "lastModified": 1769840331,
+        "narHash": "sha256-Yp0K4JoXX8EcHp1juH4OZ7dcCmkopDu4VvAgZEOxgL8=",
         "owner": "steveyegge",
         "repo": "beads",
-        "rev": "e9a0287d6c4d1c6f402321bdd45f2a2483e62114",
+        "rev": "93965b4abeed920a4701e03571d1b6bb75810722",
         "type": "github"
       },
       "original": {
         "owner": "steveyegge",
         "repo": "beads",
-        "rev": "e9a0287d6c4d1c6f402321bdd45f2a2483e62114",
+        "rev": "93965b4abeed920a4701e03571d1b6bb75810722",
         "type": "github"
       }
     },

flake.nix

@@ -48,7 +48,7 @@
     beads = {
       # v0.49.1 has dolt server mode support (gt-1mf.3)
       # Pinned to 259ddd92 - uses Go 1.24 compatible with nixpkgs
-      url = "github:steveyegge/beads/e9a0287d6c4d1c6f402321bdd45f2a2483e62114";
+      url = "github:steveyegge/beads/93965b4abeed920a4701e03571d1b6bb75810722";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
 

machines/john-endesktop/configuration.nix

@@ -54,7 +54,6 @@ with lib;
       4000  # nfs callback
       4001  # nlockmgr
       4002  # mountd
-      5000  # harmonia binary cache
       20048 # mountd
     ];
     allowedUDPPorts = [
@@ -149,16 +148,6 @@ with lib;
     };
   };
 
-  # Harmonia binary cache server
-  # Replaces the broken k8s deployment with native NixOS service
-  services.harmonia = {
-    enable = true;
-    signKeyPath = "/etc/harmonia/signing-key.private";
-    settings = {
-      bind = "[::]:5000";
-    };
-  };
-
   # Time zone
   time.timeZone = "America/Los_Angeles"; # Adjust as needed
 

roles/common.nix

@@ -26,7 +26,7 @@
           "https://nix-cache.johnogle.info"
         ];
         trusted-public-keys = [
-          "nix-cache.johnogle.info-1:G0ZGQwcSC4+4SDDFHZI/ZX3a6uFrs/5cjA5Jvaypj0I="
+          "nix-cache.johnogle.info-1:IC5x8BxnrqkU9XqhMdDnZLtSg9Y3rBJVXhve5DJ92J0="
         ];
         fallback = true;
         connect-timeout = 5;

roles/kodi/default.nix

@@ -47,23 +47,23 @@ in
       if cfg.jellyfinScaleFactor != null
       then pkgs.symlinkJoin {
         name = "jellyfin-media-player-scaled";
-        paths = [ pkgs.qt-pinned.jellyfin-media-player ];
+        paths = [ pkgs.jellyfin-media-player ];
         nativeBuildInputs = [ pkgs.makeWrapper ];
         postBuild = ''
           mkdir -p $out/bin
           rm -f $out/bin/jellyfin-desktop
-          makeWrapper ${pkgs.qt-pinned.jellyfin-media-player}/bin/jellyfin-desktop $out/bin/jellyfin-desktop \
+          makeWrapper ${pkgs.jellyfin-media-player}/bin/jellyfin-desktop $out/bin/jellyfin-desktop \
             --add-flags "--tv --scale-factor ${toString cfg.jellyfinScaleFactor}"
 
           # Update .desktop file to include scale factor and TV mode arguments
           mkdir -p $out/share/applications
           rm -f $out/share/applications/org.jellyfin.JellyfinDesktop.desktop
-          substitute ${pkgs.qt-pinned.jellyfin-media-player}/share/applications/org.jellyfin.JellyfinDesktop.desktop \
+          substitute ${pkgs.jellyfin-media-player}/share/applications/org.jellyfin.JellyfinDesktop.desktop \
             $out/share/applications/org.jellyfin.JellyfinDesktop.desktop \
             --replace-fail "Exec=jellyfin-desktop" "Exec=jellyfin-desktop --tv --scale-factor ${toString cfg.jellyfinScaleFactor}"
         '';
       }
-      else pkgs.qt-pinned.jellyfin-media-player;
+      else pkgs.jellyfin-media-player;
   in mkIf cfg.enable
     {
       users.extraUsers.kodi = {