feat: Do hydra builds against the cache directly

Also adds automated signing

fix #52

config/services/hydra.nix

@@ -2,7 +2,7 @@
   imports = [
     ./postgres.nix
     ../../modules/hydra.nix
-    ./nix-cache-upload.nix
+    #./nix-cache-upload.nix
   ];
   services.hydra = {
     enable = true;
@@ -13,6 +13,7 @@
       <gitea_authorization>
         darkkirb = #gitea_token#
       </gitea_authorization>
+      store_uri = s3://nix-cache?scheme=https&endpoint=cache.int.chir.rs&secret-key=/var/lib/hydra/queue-runner/cache-priv-key.pem&multipart-upload=true
     '';
     giteaTokenFile = "/run/secrets/services/hydra/gitea_token";
   };