feat: workflow save to cache

nixos/system/hectic-lab/attic.nix

@@ -3,6 +3,7 @@
   ...
 }: {
   config,
+  pkgs,
   ...
 }: {
   hectic.services.attic = {
@@ -17,6 +18,20 @@
     };
   };
 
+  # Slow S3 chunk reads can exceed the SDK's default 20-second stall grace.
+  services.atticd.package = pkgs.attic-server.overrideAttrs (old: {
+    postPatch = (old.postPatch or "") + ''
+      substituteInPlace server/src/storage/s3.rs \
+        --replace-fail 'let mut builder = S3ConfigBuilder::from(&shared_config);' \
+          'let mut builder = S3ConfigBuilder::from(&shared_config)
+              .stalled_stream_protection(
+                  aws_sdk_s3::config::StalledStreamProtectionConfig::enabled()
+                      .grace_period(Duration::from_secs(120))
+                      .build(),
+              );'
+    '';
+  });
+
   services.nginx.virtualHosts."cache.${domain}" = {
     enableACME = true;
     forceSSL   = true;
@@ -25,6 +40,10 @@
     '';
     locations."/" = {
       proxyPass = "http://127.0.0.1:8081";
+      extraConfig = ''
+        # Allow quiet periods while Attic fetches NAR chunks from object storage.
+        proxy_read_timeout 300s;
+      '';
     };
   };
 }