feat(ci): add build-and-cache job for all nixosConfigurations

- Build all 6 machines (nix-book, boxy, zix790prors, nix-deck, john-endesktop, live-usb) in parallel matrix
- Only runs on push to main after check passes
- Signs closures with NIX_SIGNING_KEY secret
- Pushes to cache via SSH using CACHE_SSH_KEY, CACHE_HOST, CACHE_USER secrets
- Skips Darwin as no builder available

Required Gitea secrets:
- NIX_SIGNING_KEY: Cache signing private key
- CACHE_SSH_KEY: SSH key for cache server access
- CACHE_HOST: Cache server hostname
- CACHE_USER: SSH user for cache server

Closes: x-iyz0w

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

flake.lock

@@ -8,17 +8,17 @@
         ]
       },
       "locked": {
-        "lastModified": 1770604276,
+        "lastModified": 1769840331,
-        "narHash": "sha256-U5u6LI8KyKf4J5fl3BfOT7woLa2tJ4JVR3y33Fa6UAs=",
+        "narHash": "sha256-Yp0K4JoXX8EcHp1juH4OZ7dcCmkopDu4VvAgZEOxgL8=",
         "owner": "steveyegge",
         "repo": "beads",
-        "rev": "bcfaed92f67238b9f4844445dca8b9fcb7abeaf3",
+        "rev": "93965b4abeed920a4701e03571d1b6bb75810722",
         "type": "github"
       },
       "original": {
         "owner": "steveyegge",
         "repo": "beads",
-        "rev": "bcfaed92f67238b9f4844445dca8b9fcb7abeaf3",
+        "rev": "93965b4abeed920a4701e03571d1b6bb75810722",
         "type": "github"
       }
     },

flake.nix

@@ -48,7 +48,7 @@
     beads = {
       # v0.49.1 has dolt server mode support (gt-1mf.3)
       # Pinned to 259ddd92 - uses Go 1.24 compatible with nixpkgs
-      url = "github:steveyegge/beads/bcfaed92f67238b9f4844445dca8b9fcb7abeaf3";
+      url = "github:steveyegge/beads/93965b4abeed920a4701e03571d1b6bb75810722";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
 

roles/common.nix

@@ -23,13 +23,7 @@
         max-jobs = "auto";
         trusted-users = [ "johno" ];
         substituters = [
-          "https://nix-cache.johnogle.info"
         ];
-        trusted-public-keys = [
-          "nix-cache.johnogle.info-1:G0ZGQwcSC4+4SDDFHZI/ZX3a6uFrs/5cjA5Jvaypj0I="
-        ];
-        fallback = true;
-        connect-timeout = 5;
       };
 
       gc = {

roles/kodi/default.nix

@@ -47,23 +47,23 @@ in
       if cfg.jellyfinScaleFactor != null
       then pkgs.symlinkJoin {
         name = "jellyfin-media-player-scaled";
-        paths = [ pkgs.qt-pinned.jellyfin-media-player ];
+        paths = [ pkgs.jellyfin-media-player ];
         nativeBuildInputs = [ pkgs.makeWrapper ];
         postBuild = ''
           mkdir -p $out/bin
           rm -f $out/bin/jellyfin-desktop
-          makeWrapper ${pkgs.qt-pinned.jellyfin-media-player}/bin/jellyfin-desktop $out/bin/jellyfin-desktop \
+          makeWrapper ${pkgs.jellyfin-media-player}/bin/jellyfin-desktop $out/bin/jellyfin-desktop \
             --add-flags "--tv --scale-factor ${toString cfg.jellyfinScaleFactor}"
 
           # Update .desktop file to include scale factor and TV mode arguments
           mkdir -p $out/share/applications
           rm -f $out/share/applications/org.jellyfin.JellyfinDesktop.desktop
-          substitute ${pkgs.qt-pinned.jellyfin-media-player}/share/applications/org.jellyfin.JellyfinDesktop.desktop \
+          substitute ${pkgs.jellyfin-media-player}/share/applications/org.jellyfin.JellyfinDesktop.desktop \
             $out/share/applications/org.jellyfin.JellyfinDesktop.desktop \
             --replace-fail "Exec=jellyfin-desktop" "Exec=jellyfin-desktop --tv --scale-factor ${toString cfg.jellyfinScaleFactor}"
         '';
       }
-      else pkgs.qt-pinned.jellyfin-media-player;
+      else pkgs.jellyfin-media-player;
   in mkIf cfg.enable
     {
       users.extraUsers.kodi = {