a3a17813

By: Tom Sydney Kerckhove <syd@cs-syd.eu>

Fill and read the NixCI cache from local builds

NixCI rebuilds from scratch what a contributor has already built, which
is most of what it charges us for: the same derivations are built here
first, they just never leave this machine.

The dev shell now points Nix at a post-build-hook that copies every
path it builds to the NixCI cache, and the flake substitutes from that
cache in return. Both directions only need a token in ~/.netrc, so no
system configuration is involved: Nix hands the daemon its own
netrc-file setting, and the hook, which runs as the daemon user, reads
the token through it. A machine with no token, or no network, keeps
building as before, because a post-build-hook that fails fails the
build it was called for.