autoUpgrade was silently failing daily on both hosts (legacy channel path,
no --flake set) without reaching the network — disabled outright since
rebuilds should only happen manually. Separately, nix-gc.timer's nightly
sweep was deleting eval-time-only flake input sources (not part of the
runtime closure), forcing the next evaluation to cold-refetch hermes-agent's
entire dependency tree from GitHub in one burst, which alone was enough to
hit the unauthenticated codeload rate limit. keep-outputs/keep-derivations
stop GC from evicting those sources.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TJS8qsYPXSUm5mdWGdaHjF
Add an 8G swapfile for headroom during nix builds (7.7G RAM, no prior
swap) and bring nodejs (bundles npm) into the development profile.
Also picks up latest flake.lock input updates.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5fRUDLRzDhoKhEqa69cyR
Proves the sops-nix pipeline end to end on mibook: encrypts a
throwaway secret to the operator + mibook host keys, declares it in
machines/mibook/secrets.nix, and verifies it decrypts to
/run/secrets/placeholder (root:root, 0400) on nixos-rebuild switch.
Also removes the dead `let secrets = config.sops.secrets;` binding
from both environments.nix files — leftover from an earlier abandoned
plan, never referenced.
finn.markwitzandClaude Sonnet 5