From 40b8742a807d3dd3479c9bec0e7d9bdef4851ec9 Mon Sep 17 00:00:00 2001
From: Tom Alexander <tom@fizz.buzz>
Date: Sun, 12 Jul 2026 17:58:06 -0400
Subject: [PATCH] Add nix pull-through cache secrets.

---
 .../keys/package/mrmanager-repo-secrets/package.nix       | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/nix/kubernetes/keys/package/mrmanager-repo-secrets/package.nix b/nix/kubernetes/keys/package/mrmanager-repo-secrets/package.nix
index 60ccdec..7bde62e 100644
--- a/nix/kubernetes/keys/package/mrmanager-repo-secrets/package.nix
+++ b/nix/kubernetes/keys/package/mrmanager-repo-secrets/package.nix
@@ -103,6 +103,11 @@ let
         "homepage-staging" = {
           "oauth2-env" = oauth2_env { dex_id = "homepage-staging"; };
         };
+        "nix-pull-through-cache" = {
+          "auth" = {
+            "CACHE_GET_TOKEN" = (builtins.readFile "${./secrets/nix-pull-through-cache/auth/CACHE_GET_TOKEN}");
+          };
+        };
         "tekton-gateway" = {
           "oauth2-env" = oauth2_env { dex_id = "tekton"; };
         };
@@ -125,6 +130,9 @@ let
           "harbor-plain" = {
             "config.json" = (builtins.readFile "${./secrets/webhook-bridge/harbor-plain/config.json}");
           };
+          "nix-pull-through-cache" = {
+            "CACHE_GET_TOKEN" = (builtins.readFile "${./secrets/nix-pull-through-cache/auth/CACHE_GET_TOKEN}");
+          };
         };
       };
   encrypted_secrets = (