feat(kodi): use qt-pinned nixpkgs for jellyfin-media-player

Decouple jellyfin-media-player from main nixpkgs update cycle by
sourcing it from pkgs.qt-pinned namespace. This allows the Qt-heavy
package to update on its own Renovate schedule, avoiding massive
qt5webengine rebuilds when updating other packages.

x-xiiep

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -18,50 +18,3 @@ jobs:
         run: nix flake check
         env:
           NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"
-
-  build-and-cache:
-    runs-on: ubuntu-latest
-    needs: check
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    strategy:
-      fail-fast: false
-      matrix:
-        machine:
-          - nix-book
-          - boxy
-          - zix790prors
-          - nix-deck
-          - john-endesktop
-          - live-usb
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: https://git.johnogle.info/johno/gitea-actions/nix-setup@v1
-
-      - name: Build ${{ matrix.machine }}
-        id: build
-        run: |
-          OUT_PATH=$(nix build .#nixosConfigurations.${{ matrix.machine }}.config.system.build.toplevel --no-link --print-out-paths)
-          echo "out_path=$OUT_PATH" >> "$GITHUB_OUTPUT"
-        env:
-          NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"
-
-      - name: Sign and push to cache
-        run: |
-          # Write signing key
-          echo "${{ secrets.NIX_SIGNING_KEY }}" > /tmp/signing-key
-          chmod 600 /tmp/signing-key
-
-          # Sign the closure
-          nix store sign --key-file /tmp/signing-key -r "${{ steps.build.outputs.out_path }}"
-
-          # Setup SSH key for cache push
-          mkdir -p ~/.ssh
-          echo "${{ secrets.CACHE_SSH_KEY }}" > ~/.ssh/cache_key
-          chmod 600 ~/.ssh/cache_key
-          ssh-keyscan -H ${{ secrets.CACHE_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
-
-          # Push to cache
-          nix copy --to "ssh-ng://${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }}?ssh-key=$HOME/.ssh/cache_key" "${{ steps.build.outputs.out_path }}"
-        env:
-          NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"

machines/john-endesktop/configuration.nix

@@ -54,7 +54,6 @@ with lib;
       4000  # nfs callback
       4001  # nlockmgr
       4002  # mountd
-      5000  # harmonia binary cache
       20048 # mountd
     ];
     allowedUDPPorts = [
@@ -149,16 +148,6 @@ with lib;
     };
   };
 
-  # Harmonia binary cache server
-  # Replaces the broken k8s deployment with native NixOS service
-  services.harmonia = {
-    enable = true;
-    signKeyPath = "/etc/harmonia/signing-key.private";
-    settings = {
-      bind = "[::]:5000";
-    };
-  };
-
   # Time zone
   time.timeZone = "America/Los_Angeles"; # Adjust as needed
 

roles/common.nix

@@ -23,13 +23,7 @@
         max-jobs = "auto";
         trusted-users = [ "johno" ];
         substituters = [
-          "https://nix-cache.johnogle.info"
         ];
-        trusted-public-keys = [
-          "nix-cache.johnogle.info-1:G0ZGQwcSC4+4SDDFHZI/ZX3a6uFrs/5cjA5Jvaypj0I="
-        ];
-        fallback = true;
-        connect-timeout = 5;
       };
 
       gc = {