New CI for NixOS infra/nix

[Mic92]

With the sunset of magic nix cache our CI will slow down both in the infra repo and the nix repo. Here a few options with decreasing preference.
Builds in both repos are not security relevant as we only test without using the resulting artifacts:

1. Deploy buildbot on ofborg infra. Simon said there should be enough building capacity and it's just a matter of current priorities (time)
2. Use nix-community build infra. Easy to setup and well maintained. People will probably argue against it with artificial reasons.
3. Use GitHub runner with cachix or flakehub cache. This will be the slowest variant (needs to download from the cache all the time) also it requires only few changes in the existing ci integration. Also doesn't work for pull requests from outside the repo.

We could also do combinations of the above i.e start with 2 and move on to 1.

I currently use my own buildbot for the wiki infra and the merge-bot. Would be also cool to migrate that to something else.

[sedlund]

For other lurkers that were not aware:
https://determinate.systems/posts/magic-nix-cache-free-tier-eol/

[zowoq]

Use nix-community build infra.

We want to keep our build infra (not just our cache) separate from the NixOS org until the legal issues surrounding distributing unfree packages are addressed.

[Mic92]

@zowoq could you clarify who "we" is?

[Mic92]

Since we are out of time, I went for cachix. I talked to the people working on ofborg and they still need some time. At the time, only I have administrative access to the cache. I requested org access to fix that: #544

[Mic92]

Follow up NixOS/org#65