Add compose and attic configurations

Add compose directory to store docker/podman compose files for running
on the TrueNAS box
Add attic configurations to auto-listen on all my home boxes to upload
builds
Update nix-conf to support reading from the Attic server

modules/nix-conf.nix

@@ -42,7 +42,7 @@ in
         substituters =
           (lib.optionals cfg.cache [
             "http://chronicles.shire-zebra.ts.net:9000/binary-cache/"
-            "http://nas1.shire-zebra.ts.net:8080/nixos"
+            "http://nas1.shire-zebra.ts.net:8080/default"
           ])
           ++ [
             "https://ai.cachix.org"

modules/nixos/home.nix

@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.greg.home;
@@ -13,7 +18,33 @@ with lib;
   };
 
   config = mkIf cfg {
-    time.timeZone = "America/Chicago";
+    age.secrets.attic.file = ../../secrets/attic.age;
     networking.domain = "thehellings.lan";
+    time.timeZone = "America/Chicago";
+
+    systemd.services.attic-client = {
+      enable = true;
+      description = "Attic client watch-store service";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        Restart = "on-failure";
+        RestartSec = "5s";
+      };
+      preStart = ''
+        set -x
+        mkdir -p $XDG_CONFIG_HOME/attic
+        cp ${config.age.secrets.attic.path} $XDG_CONFIG_HOME/attic/config.toml
+      '';
+      script = "${pkgs.attic-client}/bin/attic watch-store default";
+      environment = {
+        XDG_CONFIG_HOME = "/var/lib/attic-client";
+      };
+    };
+
+    systemd.tmpfiles.rules = [
+      "d /var/lib/attic-client 0755 root root -"
+    ];
   };
 }

modules/nixos/remote-builder.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 
@@ -40,35 +39,9 @@ with lib;
     greg.tailscale.enable = true;
 
     # The builder user needs to be trusted to submit builds
-    nix.settings =
-      let
-        upload = getExe (
-          pkgs.writeShellScriptBin "upload-to-cache.sh" ''
-            set -eu
-            set -f
-            export AWS_SHARED_CREDENTIALS_FILE=${config.age.secrets.cache-credentials.path}
-            export IFS=' '
-            ${getExe config.nix.package} store sign --recursive --key-file "${config.age.secrets.private-cache.path}" "$@"
-            ${getExe config.nix.package} copy --to "s3://binary-cache/?scheme=http&endpoint=nas.home%3A9000&profile=default" "$@"
-          ''
-        );
-        uploadRunner = getExe (
-          pkgs.writeShellScriptBin "uploade-to-cache-runner.sh" ''
-            sum=$(printf "$OUT_PATHS" | ${lib.getExe' pkgs.coreutils-full "sha256sum"} | cut -d " " -f1)
-            ${lib.getExe' config.systemd.package "systemd-run"} \
-                --unit "upload-$(${lib.getExe' pkgs.coreutils "date"} +%s%3N)-$sum" \
-                --property Type=exec \
-                --property CollectMode=inactive \
-                --property Group=nixbld \
-                ${upload} $OUT_PATHS
-          ''
-        );
-      in
-      {
-        post-build-hook = uploadRunner;
-        secret-key-files = config.age.secrets.private-cache.path;
-        trusted-users = [ config.users.users.remote-builder-user.name ];
-      };
+    nix.settings = {
+      trusted-users = [ config.users.users.remote-builder-user.name ];
+    };
 
     users.users.remote-builder-user = {
       openssh.authorizedKeys.keys = [