sops-nix for secrets
nixos substituters
nix nvd post build