{ lib, pkgs, ... }:
{
  nix.extraOptions = ''
    experimental-features = nix-command flakes
  '';

  # Provision a useful nixpkgs in NIX_PATH and flake registry on infra
  # machines.
  nixpkgs.flake = {
    source = lib.cleanSource pkgs.path;
    setNixPath = true;
    setFlakeRegistry = true;
  };

  # Use our cache and trust its signing key. Still use cache.nixos.org as
  # fallback.
  nix.settings.substituters = [ "https://bagel-cache.s3-web.delroth.net/" ];
  nix.settings.trusted-public-keys = [
    "cache.forkos.org:xfXIUJO1yiEITJmYsVmNDa9BFSlgTh/YqZ+4ei1EhQg="
  ];
}