From 4de92dcbe813b65c92d7f77b3449268a7b066d73 Mon Sep 17 00:00:00 2001 From: "Finn@MiBook" Date: Mon, 5 Oct 2026 14:35:19 +0200 Subject: [PATCH] fix(nix): stop automatic rebuilds and nightly GC from tripping GitHub's rate limit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit autoUpgrade was silently failing daily on both hosts (legacy channel path, no --flake set) without reaching the network — disabled outright since rebuilds should only happen manually. Separately, nix-gc.timer's nightly sweep was deleting eval-time-only flake input sources (not part of the runtime closure), forcing the next evaluation to cold-refetch hermes-agent's entire dependency tree from GitHub in one burst, which alone was enough to hit the unauthenticated codeload rate limit. keep-outputs/keep-derivations stop GC from evicting those sources. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01TJS8qsYPXSUm5mdWGdaHjF --- machines/core/nix.nix | 7 +++++++ machines/jupiter/configuration.nix | 5 ++++- machines/mibook/configuration.nix | 5 ++++- 3 files changed, 15 insertions(+), 2 deletions(-) diff --git a/machines/core/nix.nix b/machines/core/nix.nix index 6a23115..022c67e 100644 --- a/machines/core/nix.nix +++ b/machines/core/nix.nix @@ -12,6 +12,13 @@ settings = { auto-optimise-store = true; + # Without these, gc sweeps away eval-time-only sources (flake inputs, + # their build deps) since they're not part of the runtime closure. + # The next evaluation then cold-refetches everything from GitHub, + # which is enough on its own to trip GitHub's unauthenticated rate + # limit for large dependency trees (e.g. hermes-agent's). + keep-outputs = true; + keep-derivations = true; }; gc = { diff --git a/machines/jupiter/configuration.nix b/machines/jupiter/configuration.nix index 9a54eaa..231461f 100644 --- a/machines/jupiter/configuration.nix +++ b/machines/jupiter/configuration.nix @@ -72,6 +72,9 @@ system = { stateVersion = "23.05"; - autoUpgrade.enable = true; + # Was silently failing daily (legacy channel path, no --flake set) without + # ever reaching the network. Disabled rather than fixed: rebuilds should + # only happen when triggered manually. + autoUpgrade.enable = false; }; } diff --git a/machines/mibook/configuration.nix b/machines/mibook/configuration.nix index 80d4d66..30c4a05 100644 --- a/machines/mibook/configuration.nix +++ b/machines/mibook/configuration.nix @@ -61,6 +61,9 @@ system = { stateVersion = "23.05"; - autoUpgrade.enable = true; + # Was silently failing daily (legacy channel path, no --flake set) without + # ever reaching the network. Disabled rather than fixed: rebuilds should + # only happen when triggered manually. + autoUpgrade.enable = false; }; }