fix binary caching

flake.nix

@@ -1,6 +1,19 @@
 {
   description = "multi-machine nixos config";
 
+  nixConfig = {
+    extra-substituters = [
+      "https://cache.nixos.org"
+      "https://nix-community.cachix.org"
+      "https://quickshell.cachix.org"
+    ];
+    extra-trusted-public-keys = [
+      "cache.nixos.org-1:6NCHd7NZLnR7ERU5yZ30jSimkE8jZNoy0LsbwSKh6hI="
+      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkqAbxg648yyCFKExbg/M="
+      "quickshell.cachix.org-1:vBm3s5tZThc5KDLj6zhHVCMp8wX/AZJwle9wqdi81ts="
+    ];
+  };
+
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";

modules/base.nix

@@ -20,6 +20,8 @@
   nixpkgs.config.allowUnfree = true;
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
 
+  nix.settings.trusted-users = [ "root" "@wheel" ];
+
   environment = {
     systemPackages = with pkgs; [
       vim
@@ -49,15 +51,6 @@
 
   system.stateVersion = "25.11"; # set per machine
 
-  nix.settings.substituters = [
-    "https://cache.nixos.org"
-    "https://nix-community.cachix.org"
-  ];
-  nix.settings.trusted-public-keys = [
-    "cache.nixos.org-1:6nchdd59x431o0gwypbmraurkbj16zpmqfgspcdshjy="
-    "nix-community.cachix.org-1:mb9fsh9qf2dcimdsuo8zy7bkq5cx+/rkcwyvrcyg3fs="
-  ];
-
   imports = [
     ./zen.nix
   ];