updated documentation

docs/nix-cache.md

@@ -8,6 +8,8 @@ This repository configures `nix-cache` as a **binary cache server** and a **remo
 - Every machine still keeps and uses its own local `/nix/store`.
 - Clients prefer `http://nix-cache` for substitutes and keep `https://cache.nixos.org/` as fallback.
 - Clients can offload builds to `nix-cache` through SSH (`nix.distributedBuilds`).
+- Client hosts import `modules/nix/cache-client.nix` and, when remote building is enabled, `modules/nix/remote-builder-client.nix`.
+- The `nix-cache` host imports `modules/nix/cache-server.nix`.
 
 ## Binary cache signing keys (on nix-cache)
 
@@ -20,6 +22,8 @@ cat /etc/nix/cache-pub.pem
 ```
 
 Do not commit private keys.
+Do not commit new password hashes or live credentials. Existing committed hashes
+should be rotated and moved to host-local secret management.
 
 ## Remote builder SSH keys
 
@@ -33,6 +37,9 @@ sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
 
 On `nix-cache`, install the matching public key used by `nixremote` authorized keys.
 
+The committed `nixremote` authorized keys are public SSH keys only. Keep the
+matching private keys on client hosts and out of the repository.
+
 ## Manual verification
 
 After deployment: