Wire nix-cache as a substituter into the installer image

Without this the installer only ever sees cache.nixos.org, which
doesn't carry sops-install-secrets — it's built straight from the
sops-nix flake's own Go source, not part of nixpkgs. Every install had
to compile it from scratch, which is what ran an 8GB LXC container's
disk out of space (Go toolchain fetch plus a large module tree of
small files, all on the same disk that needs to hold the rest of the
system).

Once sops-install-secrets has been built once anywhere and served via
the existing nix-cache/nix-serve setup (naturally happens the next
time nix-cache itself gets switched with the sops-nix changes), every
future install of any type fetches the pre-built binary instead of
rebuilding.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

common.nix

@@ -5,6 +5,24 @@
 
   time.timeZone = "Australia/Brisbane";
 
+  # Without this, the installer only ever sees cache.nixos.org, which
+  # doesn't carry sops-install-secrets (it's built straight from the
+  # sops-nix flake's own Go source, not part of nixpkgs) — every install
+  # would otherwise compile it from scratch, which is what ran an 8GB LXC
+  # container's disk out of space. Push a built copy to nix-cache once
+  # (from a machine with real disk headroom) and every future install,
+  # of any type, fetches instead of rebuilding.
+  nix.settings = {
+    substituters = [
+      "http://nix-cache"
+      "https://cache.nixos.org/"
+    ];
+    trusted-public-keys = [
+      "cache.local-1:usoWYanY3Kpq2+kDIS2nhWoLZiRxanmdysdzqCFBHW4="
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+    ];
+  };
+
   environment.systemPackages = with pkgs; [
     git
     curl