{
  flake.modules.nixos.local-cache =
    { config, pkgs, ... }:
    {
      age.secrets.attic-token.file = ../../secrets/attic-token.age;

      nix.settings = {
        substituters = [
          "https://nix-cache.aquaticservers.com/aquatic-cache"
        ];

        trusted-public-keys = [
          "aquatic-cache:OM2zZiadzy8zsXWfLOeZgAUe82TN+GSTcByzraoMxQ8="
        ];
        netrc-file = config.age.secrets.attic-token.path;
        
        post-build-hook = pkgs.writeShellScript "attic-push" ''
          set -eu
          set -f
          export PATH="${pkgs.attic-client}/bin:$PATH"
        
          TOKEN=$(${pkgs.gawk}/bin/awk '/^password/ {print $2}' ${config.age.secrets.attic-token.path})
          attic login aquatic-cache https://nix-cache.aquaticservers.com "$TOKEN"
          attic push aquatic-cache $OUT_PATHS
        '';
      };
    };
}