By: ananjiani <ananjiani@noreply.codeberg.org>
feat(attic): take Attic off Cloudflare, give denethor NixCI (#366) ## Why Through Cloudflare, anyone could read the `middle-earth` Attic cache with no login, including whole host systems. ## What - **Off the internet:** remove the `attic.dimensiondoor.xyz` tunnel route (theoden) and DNS record (`terraform/dns.tf`). - **erebor → Tailscale:** pull, push (`attic-watch-store`), and Gatus now use `http://100.64.0.3:8080`. Tested live from erebor: `nix-cache-info` 200, erebor system narinfo 200. - **denethor → NixCI:** replaces public Attic with `cache.nix-ci.com`, using a hand-placed `/etc/nix/nix-ci-netrc` (root 0400, already on the host, NixCI returned 200 for denethor's system). No SOPS yet. - **No duplication:** Attic skips paths signed by `nix-ci`. - **wsl-work:** drop the dead public Attic substituter. ## After merge - `cd terraform && tofu apply` to delete the DNS record. - Rotate the NixCI token (it was exposed in an agent transcript), update `nix_ci_netrc` in sops and `/etc/nix/nix-ci-netrc` on denethor. ## Checked - erebor, theoden, denethor, wsl-work evaluate; `tofu validate` passes; pre-commit hooks pass. - Not built: full closures (NixCI will). Co-authored-by: Ammar Nanjiani <ammar.nanjiani@gmail.com> Reviewed-on: https://codeberg.org/ananjiani/infra/pulls/366