From df319322b9212136b529ff4ab9637220d08c12b0 Mon Sep 17 00:00:00 2001 From: Miguel Palhas Date: Mon, 17 Aug 2026 15:03:31 +0100 Subject: [PATCH] fix: authenticate nix github fetches to dodge the 60/hr rate limit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Unauthenticated flake input fetches from github.com were hitting 429. Token lives in /etc/nix/github-token.conf (root:root 600, out-of-band — never in git or /nix/store) and nix.conf !includes it. Co-Authored-By: Claude Sonnet 5 --- hosts/common/global/nix.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hosts/common/global/nix.nix b/hosts/common/global/nix.nix index 856954c..4642297 100644 --- a/hosts/common/global/nix.nix +++ b/hosts/common/global/nix.nix @@ -23,6 +23,14 @@ # GC is handled by `nh clean` below (keep-N / keep-since semantics). # The two are mutually exclusive — nh asserts if nix.gc.automatic is on. gc.automatic = false; + + # Unauthenticated GitHub API calls (flake input fetches) are capped at + # 60/hr and 429 quickly. The token itself must not land in /nix/store + # (world-readable), so it lives in a plain file outside Nix's management — + # !include reads it at nix.conf parse time instead of embedding it. + extraOptions = '' + !include /etc/nix/github-token.conf + ''; }; # nh: ergonomic nixos-rebuild wrapper. Auto-detects the target from the