docs: update nix-cache-reprovision plan with Harmonia progress

- Phase 4 now in progress
- Harmonia configured on nix-cache02 with new signing key
- Trusted public key deployed to all hosts
- Cache tested successfully from testvm01
- Actions runner removed from scope

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docs/plans/nix-cache-reprovision.md

@@ -11,7 +11,7 @@ Reprovision `nix-cache01` using the OpenTofu workflow, and improve the build/cac
 **Phase 1: New Build Host** - COMPLETE
 **Phase 2: NATS Build Triggering** - COMPLETE
 **Phase 3: Safe Flake Update Workflow** - NOT STARTED
-**Phase 4: Decommission Old System** - NOT STARTED
+**Phase 4: Complete Migration** - IN PROGRESS (Harmonia configured, DNS cutover pending)
 
 ## Completed Work
 
@@ -54,6 +54,14 @@ The `homelab-deploy` tool was extended with a builder mode:
 - Single host build: `build nixos-servers testvm01` (~30s)
 - All hosts build: `build nixos-servers all` (16 hosts in ~226s)
 
+### Harmonia Binary Cache
+
+- Parameterized `services/nix-cache/harmonia.nix` to use hostname-based Vault paths
+- Parameterized `services/nix-cache/proxy.nix` for hostname-based domain
+- New signing key: `nix-cache02.home.2rjus.net-1`
+- Vault secret: `hosts/nix-cache02/cache-secret`
+- Removed unused Gitea Actions runner from nix-cache01
+
 ## Current State
 
 ### Old System (nix-cache01)
@@ -66,9 +74,10 @@ The `homelab-deploy` tool was extended with a builder mode:
 - Running at 10.69.13.25
 - Builder service active, responding to NATS build requests
 - Metrics exposed on port 9973 (`homelab-deploy-builder` job)
-- Does NOT yet have:
-  - Harmonia (binary cache server)
-  - Cache signing key
+- Harmonia binary cache server running
+- New signing key configured (`nix-cache02.home.2rjus.net-1`)
+- Currently serving at `https://nix-cache02.home.2rjus.net` (for testing)
+- Trusted public key deployed to all hosts
 
 ## Remaining Work
 
@@ -81,13 +90,16 @@ The `homelab-deploy` tool was extended with a builder mode:
 
 ### Phase 4: Complete Migration
 
-1. **Add Harmonia to nix-cache02** - Copy cache signing key, configure service
-2. **Update DNS** - Point `nix-cache.home.2rjus.net` to nix-cache02
-3. **Increase RAM** - Bump to 24GB after nix-cache01 is gone
-4. **Decommission nix-cache01**:
+1. ~~**Add Harmonia to nix-cache02**~~ ✅ Done - new signing key, parameterized service
+2. ~~**Add trusted public key to all hosts**~~ ✅ Done - `system/nix.nix` updated
+3. ~~**Test cache from other hosts**~~ ✅ Done - verified from testvm01
+4. **Update proxy** - Add `nix-cache.home.2rjus.net` to nix-cache02's Caddy config
+5. **Increase RAM** - Bump to 24GB after nix-cache01 is gone
+6. **Decommission nix-cache01**:
    - Remove from `terraform/vms.tf`
    - Remove old build script (`services/nix-cache/build-flakes.nix`, `build-flakes.sh`)
    - Archive or delete host config
+   - Remove old signing key from `system/nix.nix` trusted-public-keys
 
 ### Phase 5: Scheduled Builds (Optional)