From d523c7c7a4aca39e0c24b669c242755371afdceb Mon Sep 17 00:00:00 2001
From: Tom Alexander <tom@fizz.buzz>
Date: Mon, 13 Jul 2026 20:44:46 -0400
Subject: [PATCH] Remove the passing of nix cache creds.

There is no way to include them when fetching from a substituter.
---
 .webhook_bridge/pipeline-build-homepage-staging.yaml | 8 --------
 docker/server/Dockerfile                             | 2 --
 2 files changed, 10 deletions(-)

diff --git a/.webhook_bridge/pipeline-build-homepage-staging.yaml b/.webhook_bridge/pipeline-build-homepage-staging.yaml
index bb2f437..657f2e1 100644
--- a/.webhook_bridge/pipeline-build-homepage-staging.yaml
+++ b/.webhook_bridge/pipeline-build-homepage-staging.yaml
@@ -142,8 +142,6 @@ spec:
               - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
               - --opt
               - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-              - --secret
-              - id=cache_token,src=/workspace/nix-cache-creds/CACHE_GET_TOKEN
           - name: BUILDKITD_TOML
             value: |
               debug = true
@@ -157,8 +155,6 @@ spec:
             workspace: git-source
           - name: dockerconfig
             workspace: docker-credentials
-          - name: nix-cache-creds
-            workspace: nix-cache-creds
         runAfter:
           - fetch-repository
     finally:
@@ -223,7 +219,6 @@ spec:
     workspaces:
       - name: git-source
       - name: docker-credentials
-      - name: nix-cache-creds
   workspaces:
     - name: git-source
       volumeClaimTemplate:
@@ -238,9 +233,6 @@ spec:
     - name: docker-credentials
       secret:
         secretName: harbor-plain
-    - name: nix-cache-creds
-      secret:
-        secretName: nix-pull-through-cache
   params:
     - name: image-name
       value: "harbor.fizz.buzz/private/homepage-staging"
diff --git a/docker/server/Dockerfile b/docker/server/Dockerfile
index 5f3007d..a43feab 100644
--- a/docker/server/Dockerfile
+++ b/docker/server/Dockerfile
@@ -10,8 +10,6 @@ filter-syscalls = false
 substituters = http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org
 EOF
 
-# RUN --mount=type=secret,id=cache_token echo "extra-access-tokens = ncps.nix-pull-through-cache.svc.cluster.local=PAT:$(cat /run/secrets/cache_token)" >> /etc/nix/nix.conf
-
 RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
 
 COPY . /tmp/build