e16827c4

By: ananjiani <ananjiani@noreply.codeberg.org>

feat(attic): take Attic off Cloudflare, give denethor NixCI (#366)

## Why
Through Cloudflare, anyone could read the `middle-earth` Attic cache with no login, including whole host systems.

## What
- **Off the internet:** remove the `attic.dimensiondoor.xyz` tunnel route (theoden) and DNS record (`terraform/dns.tf`).
- **erebor → Tailscale:** pull, push (`attic-watch-store`), and Gatus now use `http://100.64.0.3:8080`. Tested live from erebor: `nix-cache-info` 200, erebor system narinfo 200.
- **denethor → NixCI:** replaces public Attic with `cache.nix-ci.com`, using a hand-placed `/etc/nix/nix-ci-netrc` (root 0400, already on the host, NixCI returned 200 for denethor's system). No SOPS yet.
- **No duplication:** Attic skips paths signed by `nix-ci`.
- **wsl-work:** drop the dead public Attic substituter.

## After merge
- `cd terraform && tofu apply` to delete the DNS record.
- Rotate the NixCI token (it was exposed in an agent transcript), update `nix_ci_netrc` in sops and `/etc/nix/nix-ci-netrc` on denethor.

## Checked
- erebor, theoden, denethor, wsl-work evaluate; `tofu validate` passes; pre-commit hooks pass.
- Not built: full closures (NixCI will).

Co-authored-by: Ammar Nanjiani <ammar.nanjiani@gmail.com>
Reviewed-on: https://codeberg.org/ananjiani/infra/pulls/366

Total

1m57s

Timeline