Move nix-cache's binary cache signing key into sops

nix-serve's secretKeyFile was a manual, undocumented-outside-a-comment
`nix-store --generate-binary-cache-key` step per host -- easy to miss on
a fresh nix-cache instance (as lxc-nix-cache testing just found: systemd
fails the unit with EXIT_CREDENTIALS when LoadCredential can't find the
source file, which nginx then reports as a 502 from clients). It also
can't be regenerated per-host safely: modules/nix-cache/client.nix
hardcodes every client's trust in one specific public key, so every
nix-cache instance has to share the exact same keypair.

Sourced from secrets/nix-cache.yaml's new cache-priv-key entry instead,
via the same sops-nix pattern every other secret in this repo already
uses. Verified the added value derives to the exact public key
modules/nix-cache/client.nix already trusts before committing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

docs/nix-cache.md

@@ -11,19 +11,38 @@ This repository configures `nix-cache` as a **binary cache server** and a **remo
 - Client hosts import `modules/nix-cache/client.nix` and, when remote building is enabled, `modules/nix-cache/remote-builder-client.nix`.
 - The `nix-cache` host imports `modules/nix-cache/server.nix`.
 
-## Binary cache signing keys (on nix-cache)
+## Binary cache signing key
+
+`modules/nix-cache/client.nix` hardcodes every client's trust in one
+specific public key (`cache.local-1:usoWYanY3Kpq2+kDIS2nhWoLZiRxanmdysdzqCFBHW4=`).
+That means whichever host is currently playing the `nix-cache` role has to
+use that *exact* keypair — not a freshly generated one — or no client will
+accept substitutes from it (they'd just silently fall back to building
+from source). So unlike most per-host secrets, this one can't be
+self-generated on first boot; it's managed via sops-nix like every other
+secret in this repo, sourced from `secrets/nix-cache.yaml`'s
+`cache-priv-key` entry (`modules/nix-cache/server.nix`).
+
+**Adding or rotating the value:**
 
 ```bash
-sudo install -d -m 0700 /etc/nix
-sudo nix-store --generate-binary-cache-key nix-cache-1   /etc/nix/cache-priv.pem   /etc/nix/cache-pub.pem
-sudo chmod 0600 /etc/nix/cache-priv.pem
-sudo chmod 0644 /etc/nix/cache-pub.pem
-cat /etc/nix/cache-pub.pem
+nix-shell -p sops --run 'sops secrets/nix-cache.yaml'
 ```
 
-Do not commit private keys.
-Do not commit new password hashes or live credentials. Existing committed hashes
-should be rotated and moved to host-local secret management.
+Add (or replace) a `cache-priv-key` entry with the private key file's exact
+contents. If you don't have it yet, generate a keypair once:
+
+```bash
+nix-store --generate-binary-cache-key nix-cache-1 cache-priv.pem cache-pub.pem
+```
+
+— paste `cache-priv.pem`'s contents into the `cache-priv-key` entry above,
+delete both local files afterward, and update
+`trusted-public-keys` in `modules/nix-cache/client.nix` (and every already-built
+client) to match `cache-pub.pem` if this is a genuine rotation rather than
+a first-time bootstrap. Any `nixos-configurations.*-nix-cache` host picks
+the new key up automatically on next activation — no more manual
+`/etc/nix/cache-priv.pem` install step.
 
 ## Remote builder SSH keys