defaults/base-minimal/default.nix

@@ -52,21 +52,26 @@
 
   # Package management
   nix = {
-    settings = {
-      trusted-users = [
-        "root"
-        "@wheel"
-      ];
-      substituters = [
-        "https://${inputs.self.nixosConfigurations.lindberg-build.config.qois.nixpkgs-cache.hostname}?priority=39"
-        "https://cache.nixos.org?priority=40"
-        "https://attic.qo.is/qois-infrastructure"
-      ];
-      trusted-public-keys = [
-        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-        "qois-infrastructure:lh35ymN7Aoxm5Hz0S6JusxE+cYzMU+x9OMKjDVIpfuE="
-      ];
-    };
+    settings =
+      let
+        substituters = [
+          "https://${inputs.self.nixosConfigurations.lindberg-build.config.qois.nixpkgs-cache.hostname}?priority=39"
+          "https://cache.nixos.org?priority=40"
+          "https://attic.qo.is/qois-infrastructure"
+        ];
+      in
+      {
+        trusted-users = [
+          "root"
+          "@wheel"
+        ];
+        trusted-public-keys = [
+          "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+          "qois-infrastructure:lh35ymN7Aoxm5Hz0S6JusxE+cYzMU+x9OMKjDVIpfuE="
+        ];
+        trusted-substituters = substituters; # For hosts that limit the subst list
+        inherit substituters;
+      };
     gc = {
       automatic = true;
       dates = "weekly";

nixos-configurations/lindberg-build/applications/default.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 {
 
   imports = [
@@ -8,4 +13,11 @@
 
   qois.git-ci-runner.enable = true;
   qois.postgresql.package = pkgs.postgresql_15;
+
+  # Remove substituters that are hosted on this node, to prevent lockups.
+  # The qois-infrastructure cache is not needed,
+  #  since the builds are done (and cached) on this host anyway.
+  nix.settings.substituters = lib.mkForce [
+    "https://cache.nixos.org?priority=40"
+  ];
 }