first 'working' hyperland config, no bar yet

modules/nixos/nix/default.nix

@@ -8,14 +8,37 @@ with lib;
 with lib.wyrdgard;
 let
   cfg = config.wyrdgard.nix;
+
+  substituters-submodule = types.submodule (
+    { name, ... }:
+    {
+      options = with types; {
+        key = mkOpt (nullOr str) null "The trusted public key for this substituter.";
+      };
+    }
+  );
 in
 {
   options.wyrdgard.nix = with types; {
     enable = mkBoolOpt true "Whether or not to manage nix configuration.";
     package = mkOpt package pkgs.lix "Which nix package to use.";
+
+    default-substituter = {
+      url = mkOpt str "https://cache.nixos.org" "The url for the substituter.";
+      key =
+        mkOpt str "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+          "The trusted public key for the substituter.";
+    };
+
+    extra-substituters = mkOpt (attrsOf substituters-submodule) { } "Extra substituters to configure.";
   };
 
   config = mkIf cfg.enable {
+    assertions = mapAttrsToList (name: value: {
+      assertion = value.key != null;
+      message = "plusultra.nix.extra-substituters.${name}.key must be set";
+    }) cfg.extra-substituters;
+
     environment.systemPackages = with pkgs; [
       snowfallorg.flake
       nixfmt-rfc-style
@@ -43,6 +66,12 @@ in
             auto-optimise-store = true;
             trusted-users = users;
             allowed-users = users;
+            substituters = [
+              cfg.default-substituter.url
+            ] ++ (mapAttrsToList (name: value: name) cfg.extra-substituters);
+            trusted-public-keys = [
+              cfg.default-substituter.key
+            ] ++ (mapAttrsToList (name: value: value.key) cfg.extra-substituters);
           }
           // (lib.optionalAttrs config.wyrdgard.tools.direnv.enable {
             keep-outputs = true;