feat: oh ah

.gitea/workflows/check-nix-download-buffer.yaml

@@ -17,6 +17,7 @@ jobs:
     env:
       NIX_CONFIG: |
         fallback = false
+        http2 = false
         extra-substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
         trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
     steps:
@@ -25,6 +26,7 @@ jobs:
           set -eu
           nix --version
           nix config show download-buffer-size
+          nix config show http2
           nix config show fallback
           nix config show substituters
 

.gitea/workflows/deploy-hectic-lab.yaml

@@ -18,6 +18,7 @@ jobs:
     env:
       NIX_CONFIG: |
         fallback = true
+        http2 = false
         extra-substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
         trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
     steps:
@@ -32,6 +33,7 @@ jobs:
           set -eu
           uname -a
           nix --version
+          nix config show http2
           nix config show fallback
           nix config show download-buffer-size
           nix config show substituters

.gitea/workflows/deploy-neuro.yaml

@@ -18,6 +18,7 @@ jobs:
     env:
       NIX_CONFIG: |
         fallback = true
+        http2 = false
         extra-substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
         trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
     steps:
@@ -32,6 +33,7 @@ jobs:
           set -eu
           uname -a
           nix --version
+          nix config show http2
           nix config show fallback
           nix config show substituters
           nix config show trusted-public-keys

.gitea/workflows/runner-nix-smoke.yaml

@@ -20,6 +20,11 @@ jobs:
   smoke:
     name: nix label and flake smoke
     runs-on: nix
+    env:
+      NIX_CONFIG: |
+        http2 = false
+        extra-substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
+        extra-trusted-public-keys = hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4.2.2
@@ -28,6 +33,7 @@ jobs:
         run: |
           set -eu
           nix --version
+          nix config show http2
           nix config show substituters
           nix config show trusted-public-keys
 

docs/attic-cache.md

@@ -286,10 +286,11 @@ own whole-batch deadline. The legacy `/previous/` endpoint stays read-only.
 The host's Attic package also restricts its AWS SDK rustls connector to HTTP/1.1
 after observed S3 `REFUSED_STREAM` failures. This is a reproducible, host-scoped
 derived Cargo vendor tree; the pinned input tree and Cargo.lock are unchanged.
-TLS certificate verification remains enabled, and client-to-nginx HTTP/2 is not
-disabled. The pinned crate path makes upstream changes fail visibly during a
-future upgrade. This mitigates the observed transport error, not every possible
-Hetzner S3 timeout.
+TLS certificate verification remains enabled. Nix clients now force HTTP/1.1 for
+cache pulls because the cache endpoint has produced HTTP/2 framing errors; the
+Attic upload client separately uses HTTP/1.1 upstream. The pinned crate path
+makes upstream changes fail visibly during a future upgrade. This mitigates the
+observed transport error, not every possible Hetzner S3 timeout.
 
 ### Cache pulls do not work
 

infra/gitea-runners/image/README.md

@@ -71,7 +71,8 @@ top-level `flake.nix`:
 ```text
 experimental-features = nix-command flakes
 substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
-trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gW4x6l1xP+GxgH0r7u+f6p1VFlr0= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
+http2 = false
+trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
 sandbox = false
 ```
 

package/gitea-runner-controller/hcloud.sh

@@ -65,10 +65,11 @@ gcr_vm_list_managed() {
 gcr_vm_build_userdata() {
     vm_name="$1"; label="$2"; reg_token="$3"
 
-    nix_conf='accept-flake-config = true
+nix_conf='accept-flake-config = true
 experimental-features = nix-command flakes
+http2 = false
 substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
-trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gW4x6l1xP+GxgH0r7u+f6p1VFlr0= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
+trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
 sandbox = false'
 
     runner_config="log:
@@ -233,8 +234,9 @@ gcr_bootstrap_script() {
     label="$1"; reg_token="$2"; ttl_min="$3"; runner_name="$4"
     nix_conf='accept-flake-config = true
 experimental-features = nix-command flakes
+http2 = false
 substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
-trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gW4x6l1xP+GxgH0r7u+f6p1VFlr0= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
+trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
 sandbox = false'
 
     runner_config="log:

package/gitea-runner-nix-image/default.nix

@@ -56,7 +56,8 @@ dockerTools.buildLayeredImageWithNixDb {
     accept-flake-config = true
     experimental-features = nix-command flakes
     substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
-    trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gW4x6l1xP+GxgH0r7u+f6p1VFlr0= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
+    http2 = false
+    trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
     trusted-users = root
     sandbox = false
     EOF