switch back to post-build-hook

build03/configuration.nix

@@ -14,7 +14,6 @@
     inputs.srvos.nixosModules.hardware-hetzner-online-amd
     ../roles/common.nix
     ../roles/hercules-ci
-    ../roles/watch-store.nix
     ../roles/raid.nix
     ../roles/zfs.nix
     ../roles/remote-builder/aarch64-build04.nix

services/hydra/default.nix

@@ -1,4 +1,20 @@
 { lib, pkgs, config, ... }:
+let
+  upload-to-cachix = pkgs.writeScriptBin "upload-to-cachix" ''
+    #!/bin/sh
+    set -eu
+    set -f # disable globbing
+
+    # skip push if the declarative job spec
+    OUT_END=$(echo ''${OUT_PATHS: -10})
+    if [ "$OUT_END" == "-spec.json" ]; then
+      exit 0
+    fi
+
+    export HOME=/root
+    exec ${pkgs.cachix}/bin/cachix -c ${config.sops.secrets.nix-community-cachix.path} push nix-community $OUT_PATHS > /tmp/hydra_cachix 2>&1
+  '';
+in
 {
   options.services.hydra = {
     adminPasswordFile = lib.mkOption {
@@ -27,7 +43,9 @@
       "https://github.com/nix-community/"
       "https://github.com/NixOS/"
     ];
+    nix.settings.post-build-hook = "${upload-to-cachix}/bin/upload-to-cachix";
 
+    sops.secrets.nix-community-cachix.sopsFile = ../../roles/nix-community-cache/secrets.yaml;
     sops.secrets.id_buildfarm = { };
 
     # delete build logs older than 30 days