From 7f9e1d2da04583c05b47308ef400eca8f123d9ab Mon Sep 17 00:00:00 2001 From: Patrick Mulligan Date: Mon, 2 Mar 2026 14:58:26 -0500 Subject: [PATCH] fix(nix): prevent local builds on ATM hardware (max-jobs = 0) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ATM should never compile from source — only download pre-built binaries from cachix/cache.nixos.org. If a derivation isn't cached, the upgrade fails cleanly instead of trying to build on the mSATA. Co-Authored-By: Claude Opus 4.6 --- flake.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/flake.nix b/flake.nix index 39f925a..3a07c1e 100644 --- a/flake.nix +++ b/flake.nix @@ -108,7 +108,10 @@ security.sudo.wheelNeedsPassword = false; # Allow lamassu user to use nix commands + pull from aiolabs binary cache + # max-jobs = 0: never build locally — only download from substituters. + # If a derivation isn't cached, the build fails instead of compiling on the ATM. nix.settings = { + max-jobs = 0; trusted-users = [ "root" "lamassu" ]; substituters = [ "https://cache.nixos.org" "https://aiolabs.cachix.org" ]; trusted-public-keys = [