inject nix conf in daemon

hcl/builder.hcl

@@ -100,6 +100,7 @@ job "builder" {
       command = "nix-daemon"
       volumes = [ 
         "/var/cache/albatros/nix:/nix",
+        "local/nix.conf:/etc/nix/nix.conf",
         "local/pin.sh:/usr/local/bin/pin.sh"
       ]
     }

hcl/nix.conf

@@ -3,7 +3,7 @@ trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDS
 max-jobs = auto
 cores = 0
 log-lines = 200
-filter-syscalls = false
-sandbox = false
+filter-syscalls = true
+sandbox = true
 experimental-features = nix-command flakes
 post-build-hook = /usr/local/bin/pin.sh

hcl/pin.sh

@@ -2,4 +2,3 @@
 set -euxo pipefail
 
 echo "hook on $DRV_PATH"
-echo "hook on $DRV_PATH" 1>&2

main.go

@@ -15,7 +15,7 @@ import (
 	"strings"
 )
 
-// Albatros
+// Albatros CI
 
 type GitUser struct {
 	Name     string `json:"name"`