prebuild: nightly macbook closure build on mediaserver

common.nix

@@ -55,6 +55,7 @@ in
     ./services/memos.nix
     ./services/hardware-health.nix
     ./services/wan-watchdog.nix
+    ./services/prebuild.nix
   ];
 
   ### Make build time quicker

services/prebuild.nix

@@ -0,0 +1,39 @@
+# services/prebuild.nix — nightly pre-build of the Macbook's system closure.
+#
+# The Macbook runs with max-jobs = 0 and offloads every build to this host
+# (nix.buildMachines in common.nix). Realising its toplevel here ahead of time
+# turns `update` on the laptop into a pure copy: the offloaded build finds the
+# path already in this store and just ships it back over SSH.
+#
+# --out-link doubles as the gc root, so `clean` doesn't reap the closure
+# before the laptop ever asks for it.
+{ config, lib, pkgs, ... }:
+
+{
+  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
+    systemd.services.prebuild-macbook = {
+      description = "Pre-build the FredOS-Macbook system closure";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      path = [ pkgs.git ];
+      environment.HOME = "/root";
+      serviceConfig = {
+        Type = "oneshot";
+        StateDirectory = "prebuild";
+      };
+      script = ''
+        ${config.nix.package}/bin/nix build --refresh --out-link /var/lib/prebuild/FredOS-Macbook \
+          'git+https://forg.gregersen.it/rope/nixos#nixosConfigurations.FredOS-Macbook.config.system.build.toplevel'
+      '';
+    };
+
+    systemd.timers.prebuild-macbook = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "04:00";
+        Persistent = true;
+        RandomizedDelaySec = "30m";
+      };
+    };
+  };
+}