From 2298cc5f8d192bdb60cdad9fdf76095cb37b3487 Mon Sep 17 00:00:00 2001
From: Kieran Klukas <kieran@dunkirk.sh>
Date: Fri, 21 Aug 2026 15:27:39 +0000
Subject: [PATCH] ci+nix: use prattle's attic cache to skip rebuilding custom packages

---
 .github/workflows/deploy.yaml | 17 +++++++++++++++++
 modules/nixos/nix-cache.nix | 12 ++++++++++++
 2 file(s) changed, 29 insertion(s)(+), 0 deletion(s)(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -121,8 +121,15 @@
     steps:
       - uses: actions/checkout@v6
 
+      # Pull custom packages (knot, herald, …) from prattle's attic cache so the
+      # runner substitutes them instead of recompiling. Reachable once Tailscale
+      # is up (below), which is before the build in Deploy. Public cache, no token.
       - name: Install Nix
         uses: DeterminateSystems/determinate-nix-action@v3
+        with:
+          extra-conf: |
+            extra-substituters = http://prattle:8091/dots
+            extra-trusted-public-keys = dots:Mgol9jjaoUcN6pfgLetO3fe/JAm/fVpKXYBZaQ1MhFM=
 
       - name: Setup Tailscale
         uses: tailscale/github-action@v4
@@ -148,6 +155,16 @@ --skip-checks \
             --ssh-user kierank \
             --ssh-opts="-o StrictHostKeyChecking=accept-new" \
             .#${{ matrix.node }}
+
+      # Push what we just built so the next run substitutes it. attic skips
+      # anything already on cache.nixos.org, so this uploads only our own paths.
+      - name: Cache build in attic
+        env:
+          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
+        run: |
+          nix run nixpkgs#attic-client -- login prattle http://prattle:8091 "$ATTIC_TOKEN"
+          nix build .#nixosConfigurations.${{ matrix.node }}.config.system.build.toplevel --no-link --print-out-paths \
+            | xargs nix run nixpkgs#attic-client -- push dots
 
   rollback:
     needs: [pre-deploy, deploy]
diff --git a/modules/nixos/nix-cache.nix b/modules/nixos/nix-cache.nix
new file mode 100644
--- /dev/null
+++ b/modules/nixos/nix-cache.nix
@@ -0,0 +1,12 @@
+{ ... }:
+{
+  # Pull custom-built packages (knot, herald, the tangled bits) from prattle's
+  # tailnet-only attic cache instead of recompiling them on every deploy. The
+  # cache is public, so no token is needed to pull — the tailscale0 firewall is
+  # the gate. These are extra-* keys, so cache.nixos.org is still tried first and
+  # an unreachable prattle just falls back to it.
+  nix.settings = {
+    extra-substituters = [ "http://prattle:8091/dots" ];
+    extra-trusted-public-keys = [ "dots:Mgol9jjaoUcN6pfgLetO3fe/JAm/fVpKXYBZaQ1MhFM=" ];
+  };
+}

--
tangled.sh