Plan self-hosted Attic cache for CI-built Nix artifacts

[genebean]

Goal

Stand up a self-hosted Nix binary cache with Attic and use CI to prebuild
expensive local packages and custom flake inputs.

Proposed Approach

Run atticd on nixnuc with local disk storage and SQLite to start. Expose it
over the internal network or Tailscale, then add the cache URL and public key to
the fleet-wide Nix settings.

Start with manual pushes, then add CI-driven pushes once the cache is proven.

Candidate Artifacts

• handbrake-qsv, exposed from this flake as the bigboy-overridden HandBrake
  package
• ytdlfin, built from its own repo CI and consumed here as a flake input
• cup-collector, built from its own repo CI and consumed here as a flake input
• host-specific closures or SD images where useful

CI Shape

Each app/service repo should build and push its own default package when it
changes. This keeps build failures close to the code that caused them.

This repo should build and push packages or closures that are defined here or
depend on local overlays, such as handbrake-qsv.

Example flow:

attic login homelab "$ATTIC_ENDPOINT" "$ATTIC_TOKEN"
attic use dots

out=$(nix build --no-link --print-out-paths .#handbrake-qsv)
nix path-info -r "$out" | xargs attic push dots

CI should configure Attic as a substituter before building, so runners pull
previous cache hits before compiling missing paths.

Open Questions

• Should Attic be exposed only over Tailscale, or also behind nginx on a public
  hostname?
• Which repo should own fleet-wide substituter configuration once the cache is
  live?
• Should pushes be manual at first, or should we add a post-build hook after
  validating Attic reliability?