{
  nix.settings = {
    secret-key-files = /var/nix/cache-priv-key.pem;
  };
}