feat: switch fi (darwin) to Determinate Nix, keep caches declarative

flake.nix

@@ -99,6 +99,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     commutecompass.url = "github:Multipixelone/commutecompass";
+    determinate.url = "https://flakehub.com/f/DeterminateSystems/determinate/3";
     euphony = {
       url = "github:Multipixelone/euphony/nix-build";
       inputs.nixpkgs.follows = "nixpkgs";

modules/fi/determinate.nix

@@ -0,0 +1,36 @@
+{ inputs, config, ... }:
+{
+  # Determinate Nix manages /etc/nix on this host instead of nix-darwin.
+  # `determinate.darwinModules.default` forces `nix.enable = false` (so
+  # nix-darwin no longer writes /etc/nix/nix.conf) and exposes Determinate's
+  # own declarative surface under `determinateNix.*`, which writes
+  # /etc/nix/nix.custom.conf and /etc/determinate/config.json. This keeps the
+  # store intact (no reinstall) while everything below stays in the flake.
+  configurations.darwin.fi.module = {
+    imports = [ inputs.determinate.darwinModules.default ];
+
+    determinateNix = {
+      # `enable` defaults to true once the module is imported; spelled out here
+      # so the intent is visible at the host level.
+      enable = true;
+
+      # Custom Nix settings -> /etc/nix/nix.custom.conf. Determinate already
+      # turns on nix-command + flakes and trusts cache.nixos.org / the FlakeHub
+      # cache, so these are all `extra-*` (additive) to avoid clobbering its
+      # defaults. Substituters reuse the repo-wide `caches` aggregate
+      # (modules/nixpkgs/substituters.nix) so the Mac stays in sync with the
+      # NixOS hosts and the flake's own nixConfig.
+      customSettings = {
+        extra-experimental-features = [ "pipe-operators" ];
+        trusted-users = [
+          "@admin"
+          config.flake.meta.owner.username
+        ];
+        extra-substituters = map (c: c.url) config.caches;
+        extra-trusted-public-keys = map (c: c.key) config.caches;
+      };
+    };
+  };
+
+  flake-file.inputs.determinate.url = "https://flakehub.com/f/DeterminateSystems/determinate/3";
+}

modules/fi/linux-builder.nix

@@ -2,9 +2,15 @@
   configurations.darwin.fi.module = {
     # NixOS-as-QEMU micro-VM so the Mac natively builds the repo's Linux
     # packages/wrappers (aarch64-linux via HVF fast; x86_64-linux via TCG slow)
-    # instead of relying on ARM CI runners. Routes via ssh-ng build-machine
-    # at linux-builder@localhost:31022.
-    nix.linux-builder = {
+    # instead of relying on ARM CI runners. Routes via an ssh-ng build-machine
+    # at builder@localhost:31022.
+    #
+    # This is Determinate's port of nix-darwin's `nix.linux-builder` (the same
+    # Nixpkgs darwin.linux-builder VM); nix-darwin's own block can't be used
+    # because it asserts `nix.enable`, which Determinate forces off. Determinate
+    # also ships a native (Virtualization.framework) Linux builder, but this VM
+    # keeps the existing tuning verbatim.
+    determinateNix.nixosVmBasedLinuxBuilder = {
       enable = true;
       ephemeral = true;
       systems = [

modules/fi/system.nix

@@ -7,18 +7,10 @@
     system.primaryUser = config.flake.meta.owner.username;
     system.configurationRevision = inputs.self.rev or inputs.self.dirtyRev or null;
 
-    nix.enable = true;
-    nix.settings = {
-      experimental-features = [
-        "nix-command"
-        "flakes"
-        "pipe-operators"
-      ];
-      trusted-users = [
-        "@admin"
-        config.flake.meta.owner.username
-      ];
-    };
+    # Nix itself (experimental-features, trusted-users, substituters) is managed
+    # by Determinate Nix via `determinateNix.*` in ./determinate.nix — the
+    # determinate module forces `nix.enable = false`, so nix-darwin's `nix.*`
+    # settings would be inert here.
 
     # /etc/zsh* managed by nix-darwin (PATH in non-interactive shells); HM's
     # ~/.zshrc is sourced from the system /etc/zshrc.