base substitutor list on whether it is an installer

machine/not522/installer/default.nix

@@ -39,9 +39,5 @@ in {
       exec ${pkgs.disko}/bin/disko-install --flake "${nixos-config}#not522" --disk main "${nixos-config.nixosConfigurations.not522.config.disko.devices.disk.main.device}"
     '')
   ];
-  nix.settings.substituters = lib.mkForce [
-    "https://attic.chir.rs/chir-rs/"
-    "https://hydra.chir.rs"
-    "https://cache.nixos.org"
-  ];
+  isInstaller = true;
 }

machine/pc-installer/default.nix

@@ -18,9 +18,5 @@
       ./graphical.nix
     ];
   };
-  nix.settings.substituters = lib.mkForce [
-    "https://attic.chir.rs/chir-rs/"
-    "https://hydra.chir.rs"
-    "https://cache.nixos.org"
-  ];
+  isInstaller = true;
 }

modules/default.nix

@@ -16,4 +16,5 @@ with lib; {
     "${home-manager}/nixos"
   ];
   options.isGraphical = mkEnableOption "Whether or not this configuration is a graphical install";
+  options.isInstaller = mkEnableOption "Whether or not this configuration is an installer and has no access to secrets";
 }

modules/nix/default.nix

@@ -1,13 +1,19 @@
-{config, ...}: {
+{
+  config,
+  lib,
+  ...
+}:
+with lib; {
   imports = [
     ./link-inputs.nix
     ./lix.nix
     ./autoupdater.nix
   ];
   nix.settings = {
-    substituters = [
-      "https://attic.chir.rs/chir-rs/"
-      "https://hydra.int.chir.rs"
+    substituters = mkMerge [
+      ["https://attic.chir.rs/chir-rs/"]
+      (mkIf (!config.isInstaller) ["https://hydra.int.chir.rs"])
+      (mkIf config.isInstaller ["https://hydra.chir.rs"])
     ];
     trusted-public-keys = [
       "nixcache:8KKuGz95Pk4UJ5W/Ni+pN+v+LDTkMMFV4yrGmAYgkDg="