feat: migrate from S3 binary cache to Attic

Replace the S3-based Nix binary cache with Attic, a multi-tenant
binary cache server with better deduplication and garbage collection.

Changes:
- Install attic-client system-wide from nixpkgs
- Update substituter URL from s3.toph.so to cache.toph.so/toph
- Replace S3 cache keys with Attic cache signing key
- Add attic client config for endurance host

The Attic cache provides the same functionality as the S3 cache but
with improved performance and multi-tenancy support.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

flake.lock

@@ -778,11 +778,11 @@
     },
     "master": {
       "locked": {
-        "lastModified": 1767143992,
-        "narHash": "sha256-c3jlq36uxltxGLuQ3KPYfxZkue/LLD0Ct3NdhBUsRyo=",
+        "lastModified": 1771456066,
+        "narHash": "sha256-CLuGt3yg70gnhSam+0qpcWgPnUdY98wVeH4lByklol4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5830d8dfe6ae79365987d78bda3dd4152c271d8b",
+        "rev": "be6cf55e819f4d362aa6be60254bbb2537f9a5cb",
         "type": "github"
       },
       "original": {

home/by-host/endurance/config/attic.nix

@@ -0,0 +1,7 @@
+{...}: {
+  # Attic binary cache client configuration
+  xdg.configFile."attic/config.toml".text = ''
+    [cache.toph]
+    endpoint = "https://cache.toph.so"
+  '';
+}

home/by-host/endurance/config/dev.nix

@@ -15,6 +15,7 @@
     rfc # TUI-based RFC reader
     nix-init # Generate Nix packages from URLs
     install-nothing
+    marimo
 
     # Language Servers
     lua-language-server

home/by-host/endurance/default.nix

@@ -15,6 +15,7 @@
       ./wakatime.nix
       ./gpg
       ./niri
+      ./hyprland
       ./stylix.nix
       ./default-applications.nix
       ./misc/launcher.nix

home/by-host/endurance/hyprland/default.nix

@@ -0,0 +1,15 @@
+{pkgs, ...}: {
+  imports = [
+    ./settings.nix
+    ./keybinds.nix
+    ./window-rules.nix
+  ];
+
+  wayland.windowManager.hyprland.enable = true;
+
+  home.packages = with pkgs; [
+    wl-clipboard
+    cliphist
+    hyprpicker
+  ];
+}

home/by-host/endurance/hyprland/keybinds.nix

@@ -0,0 +1,59 @@
+{pkgs, ...}: {
+  wayland.windowManager.hyprland.settings = {
+    "$mod" = "SUPER";
+
+    bind = [
+      # Apps
+      "$mod, space, exec, fuzzel"
+      "$mod, c, exec, ${pkgs.harbor.spawn-term}/bin/spawn-term"
+      "$mod, e, exec, nautilus"
+      "$mod, d, exec, zeal"
+      "$mod, g, exec, ${pkgs.harbor.hg-picker}/bin/hg-picker"
+
+      # Window management
+      "$mod, q, killactive"
+      "$mod, f, fullscreen, 1"
+      "$mod, t, togglefloating"
+      "$mod, p, pseudo"
+      "$mod SHIFT, j, togglesplit"
+
+      # Focus (vim-style, matching niri keybinds)
+      "$mod, h, movefocus, l"
+      "$mod, l, movefocus, r"
+      "$mod, k, movefocus, u"
+      "$mod, j, movefocus, d"
+
+      # Move windows
+      "$mod CTRL, h, movewindow, l"
+      "$mod CTRL, l, movewindow, r"
+      "$mod CTRL, k, movewindow, u"
+      "$mod CTRL, j, movewindow, d"
+
+      # Workspaces
+      "$mod, 1, workspace, 1"
+      "$mod, 2, workspace, 2"
+      "$mod, 3, workspace, 3"
+      "$mod, 4, workspace, 4"
+      "$mod, 5, workspace, 5"
+
+      # Move to workspace silently
+      "$mod CTRL, 1, movetoworkspacesilent, 1"
+      "$mod CTRL, 2, movetoworkspacesilent, 2"
+      "$mod CTRL, 3, movetoworkspacesilent, 3"
+      "$mod CTRL, 4, movetoworkspacesilent, 4"
+      "$mod CTRL, 5, movetoworkspacesilent, 5"
+    ];
+
+    bindm = [
+      # Mouse: move and resize windows
+      "$mod, mouse:272, movewindow"
+      "$mod, mouse:273, resizewindow"
+    ];
+
+    bindl = [
+      # Scroll through workspaces
+      "$mod, mouse_down, workspace, e+1"
+      "$mod, mouse_up, workspace, e-1"
+    ];
+  };
+}

home/by-host/endurance/hyprland/settings.nix

@@ -0,0 +1,85 @@
+{pkgs, ...}: {
+  wayland.windowManager.hyprland.settings = {
+    monitor = [
+      # Main ultrawide (left)
+      "HDMI-A-1,3840x1080,0x0,1"
+      # Vertical display (right)
+      "DP-3,1920x1080,3840x-430,1,transform,1"
+      # Fallback for any other monitor
+      ",preferred,auto,1"
+    ];
+
+    exec-once = [
+      # Clipboard history
+      "wl-paste --type text --watch cliphist store"
+      "wl-paste --type image --watch cliphist store"
+      # Automount USB drives
+      "udiskie"
+    ];
+
+    env = [
+      "MOZ_ENABLE_WAYLAND,1"
+      "QT_WAYLAND_DISABLE_WINDOWDECORATION,1"
+      "ELECTRON_OZONE_PLATFORM_HINT,auto"
+      "NIXOS_OZONE_WL,1"
+      "XDG_SESSION_TYPE,wayland"
+      "XDG_CURRENT_DESKTOP,Hyprland"
+    ];
+
+    input = {
+      kb_layout = "us";
+      kb_variant = "intl";
+      follow_mouse = 2;
+      sensitivity = 0;
+    };
+
+    general = {
+      gaps_in = 8;
+      gaps_out = 15;
+      border_size = 2;
+      layout = "dwindle";
+    };
+
+    decoration = {
+      rounding = 8;
+      blur = {
+        enabled = true;
+        size = 4;
+        passes = 2;
+        noise = 0.3;
+      };
+      shadow = {
+        enabled = true;
+        range = 4;
+        render_power = 3;
+      };
+    };
+
+    animations = {
+      enabled = true;
+      bezier = "myBezier, 0.05, 0.9, 0.1, 1.05";
+      animation = [
+        "windows, 1, 7, myBezier"
+        "windowsOut, 1, 7, default, popin 80%"
+        "border, 1, 10, default"
+        "fade, 1, 7, default"
+        "workspaces, 1, 6, default"
+      ];
+    };
+
+    # Single tiled window on main monitor: give it breathing room
+    workspace = [
+      "w[t1] m[HDMI-A-1], gapsout:15 840 15 840"
+    ];
+
+    dwindle = {
+      pseudotile = true;
+      preserve_split = true;
+    };
+
+    misc = {
+      disable_hyprland_logo = true;
+      disable_splash_rendering = true;
+    };
+  };
+}

home/by-host/endurance/hyprland/window-rules.nix

@@ -0,0 +1,28 @@
+{...}: {
+  wayland.windowManager.hyprland.settings = {
+    windowrulev2 = [
+      # Privacy: block from screen capture
+      "noscreenshare, class:^(1password)$"
+      "noscreenshare, class:^(thunderbird)$"
+      "noscreenshare, title:^(ld\\.toph\\.so)$"
+
+      # Floating windows
+      "float, class:^(org\\.zealdocs\\.zeal)$"
+      "center 1, class:^(org\\.zealdocs\\.zeal)$"
+      "size 50% 80%, class:^(org\\.zealdocs\\.zeal)$"
+      "minsize 1400 500, class:^(org\\.zealdocs\\.zeal)$"
+
+      "float, class:^(speedcrunch)$"
+      "center 1, class:^(speedcrunch)$"
+      "size 30% 60%, class:^(speedcrunch)$"
+
+      "float, title:^(DevTools)$"
+
+      # Kitty: slight transparency
+      "opacity 0.97 0.97, class:^(kitty)$"
+
+      # JetBrains: suppress phantom windows
+      "nofocus, class:^jetbrains-(?!toolbox), floating:1, title:^win\\d+$"
+    ];
+  };
+}

modules/generic/default.nix

@@ -24,5 +24,6 @@
     just
     nh
     age
+    attic-client
   ];
 }

modules/generic/nix.nix

@@ -32,12 +32,11 @@
       trusted-users = ["root" "@wheel"];
       substituters = [
         "https://cache.nixos.org/"
-        "https://s3.toph.so/nix-cache"
+        "https://cache.toph.so/toph"
       ];
       trusted-public-keys = [
         "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-        "cache.toph.so:sre7NaMFLUyRGuHY5MoC4Il4wD9lC53Ct0D1A/lwb+A="
-        "cache.toph.so-ci:e5n27lZmhhdQvYClj9PZUFJIYwiBfC7eJkEXe8h4PKU="
+        "toph:E/oP7KyljH/yprI5LArxNPpSlQCdo29sMOkh3jm53Yg="
       ];
     };
   };

modules/nixos/profiles/graphical/wm.nix

@@ -32,6 +32,8 @@ in {
       package = pkgs.niri; # TODO: Use input niri pkgs/overlay!
     };
 
+    programs.hyprland.enable = true;
+
     services = {
       xserver = {
         enable = true;
@@ -62,11 +64,15 @@ in {
     xdg.portal = {
       enable = true;
       # xdgOpenUsePortal = true;
-      config.common.default = "gtk";
+      config = {
+        common.default = "gtk";
+        hyprland.default = ["hyprland" "gtk"];
+      };
 
       extraPortals = with pkgs; [
         xdg-desktop-portal-gnome
         xdg-desktop-portal-gtk
+        xdg-desktop-portal-hyprland
       ];
     };
 

overlays/unstable.nix

@@ -17,5 +17,5 @@
     # open-webui
     ;
 
-  inherit (channels.master) install-nothing;
+  inherit (channels.master) install-nothing marimo;
 }

secrets/rekeyed/endurance/0f723801d4717faeb894fd776d38be4e-nix-cache-privkey.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 /u/eYA jAj/U8H5mR2k4JV8FEckBb8vmpGP9LLCFCFATVZd4yA
+WyXJPAyZS2Dq93pK2GuVYNbBIxNyvEVJuVWrpZS89Zs
+-> @W-grease _
+Gd35VA
+--- 6blY/MMnEQunu/tWdJv/oGaqf1i6Pv+xdrqLV0EZNes
+«<EFBFBD>ˆëÇægŒúóþ/½ç
M0•2äPçÿ!°9XU–ÂxÖKï¦(ònÊ“ëçã×…/¯j„[`fÃ<66>.Nf¯f1ã Ã
VíŒë€á!·rÆ}h`êûåÑeƒàsÀ/&8¾£þÅÛ¥«ûSÙ2ËÏ!o£úõ¾NjÞÕpäL?ïX]Ív<C38D>8C