disable tailscale on installers

machine/not522/installer/default.nix

@@ -39,9 +39,5 @@ in {
       exec ${pkgs.disko}/bin/disko-install --flake "${nixos-config}#not522" --disk main "${nixos-config.nixosConfigurations.not522.config.disko.devices.disk.main.device}"
     '')
   ];
-  nix.settings.substituters = lib.mkForce [
-    "https://attic.chir.rs/chir-rs/"
-    "https://hydra.chir.rs"
-    "https://cache.nixos.org"
-  ];
+  isInstaller = true;
 }

machine/pc-installer/default.nix

@@ -18,9 +18,5 @@
       ./graphical.nix
     ];
   };
-  nix.settings.substituters = lib.mkForce [
-    "https://attic.chir.rs/chir-rs/"
-    "https://hydra.chir.rs"
-    "https://cache.nixos.org"
-  ];
+  isInstaller = true;
 }

modules/default.nix

@@ -16,4 +16,5 @@ with lib; {
     "${home-manager}/nixos"
   ];
   options.isGraphical = mkEnableOption "Whether or not this configuration is a graphical install";
+  options.isInstaller = mkEnableOption "Whether or not this configuration is an installer and has no access to secrets";
 }

modules/nix/default.nix

@@ -1,13 +1,19 @@
-{config, ...}: {
+{
+  config,
+  lib,
+  ...
+}:
+with lib; {
   imports = [
     ./link-inputs.nix
     ./lix.nix
     ./autoupdater.nix
   ];
   nix.settings = {
-    substituters = [
-      "https://attic.chir.rs/chir-rs/"
-      "https://hydra.int.chir.rs"
+    substituters = mkMerge [
+      ["https://attic.chir.rs/chir-rs/"]
+      (mkIf (!config.isInstaller) ["https://hydra.int.chir.rs"])
+      (mkIf config.isInstaller ["https://hydra.chir.rs"])
     ];
     trusted-public-keys = [
       "nixcache:8KKuGz95Pk4UJ5W/Ni+pN+v+LDTkMMFV4yrGmAYgkDg="

services/tailscale.nix

@@ -1,10 +1,17 @@
-{config, ...}: {
-  services.tailscale = {
-    enable = true;
-    authKeyFile = config.sops.secrets."services/tailscale/authKey".path;
+{
+  config,
+  lib,
+  ...
+}:
+with lib; {
+  config = mkIf (!config.isInstaller) {
+    services.tailscale = {
+      enable = true;
+      authKeyFile = config.sops.secrets."services/tailscale/authKey".path;
+    };
+    sops.secrets."services/tailscale/authKey".sopsFile = ./tailscale.yaml;
+    environment.persistence."/persistent".directories = [
+      "/var/lib/tailscale"
+    ];
   };
-  sops.secrets."services/tailscale/authKey".sopsFile = ./tailscale.yaml;
-  environment.persistence."/persistent".directories = [
-    "/var/lib/tailscale"
-  ];
 }