docs: mark nix-cache01 decommission complete

Phase 4 fully complete. nix-cache01 has been:
- Removed from repo (host config, build scripts, flake entry)
- Vault resources cleaned up
- VM deleted from Proxmox

nix-cache02 is now the sole binary cache host.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docs/plans/nix-cache-reprovision.md

@@ -11,7 +11,7 @@ Reprovision `nix-cache01` using the OpenTofu workflow, and improve the build/cac
 **Phase 1: New Build Host** - COMPLETE
 **Phase 2: NATS Build Triggering** - COMPLETE
 **Phase 3: Safe Flake Update Workflow** - NOT STARTED
-**Phase 4: Complete Migration** - COMPLETE (cleanup pending)
+**Phase 4: Complete Migration** - COMPLETE
 
 ## Completed Work
 
@@ -64,21 +64,20 @@ The `homelab-deploy` tool was extended with a builder mode:
 
 ## Current State
 
-### Old System (nix-cache01) - PENDING DECOMMISSION
+### nix-cache02 (Active)
-- Running at 10.69.13.15
-- No longer serving the canonical `nix-cache.home.2rjus.net` (now serves `nix-cache01.home.2rjus.net`)
-- Still has the old `build-flakes.sh` timer (every 30 min) - to be removed
-- Ready for decommission
-
-### New System (nix-cache02) - NOW ACTIVE
 - Running at 10.69.13.25
-- **Now serving `https://nix-cache.home.2rjus.net`** (canonical URL)
+- Serving `https://nix-cache.home.2rjus.net` (canonical URL)
 - Builder service active, responding to NATS build requests
 - Metrics exposed on port 9973 (`homelab-deploy-builder` job)
 - Harmonia binary cache server running
-- New signing key: `nix-cache02.home.2rjus.net-1`
+- Signing key: `nix-cache02.home.2rjus.net-1`
-- Trusted public key deployed to all hosts
+- Prod tier with `build-host` role
-- Promoted to prod tier with `build-host` role
+
+### nix-cache01 (Decommissioned)
+- VM deleted from Proxmox
+- Host configuration removed from repo
+- Vault AppRole and secrets removed
+- Old signing key removed from trusted-public-keys
 
 ## Remaining Work
 
@@ -89,19 +88,20 @@ The `homelab-deploy` tool was extended with a builder mode:
 3. Test manually with `workflow_dispatch`
 4. Monitor first automated run
 
-### Phase 4: Complete Migration
+### Phase 4: Complete Migration ✅
 
 1. ~~**Add Harmonia to nix-cache02**~~ ✅ Done - new signing key, parameterized service
 2. ~~**Add trusted public key to all hosts**~~ ✅ Done - `system/nix.nix` updated
 3. ~~**Test cache from other hosts**~~ ✅ Done - verified from testvm01
 4. ~~**Update proxy and DNS**~~ ✅ Done - `nix-cache.home.2rjus.net` CNAME now points to nix-cache02
 5. ~~**Deploy to all hosts**~~ ✅ Done - all hosts have new trusted key
-6. **Increase RAM** - Bump to 24GB after nix-cache01 is gone
+6. ~~**Decommission nix-cache01**~~ ✅ Done - 2026-02-10:
-7. **Decommission nix-cache01**:
+   - Removed `hosts/nix-cache01/` directory
-   - Remove from `terraform/vms.tf`
+   - Removed `services/nix-cache/build-flakes.{nix,sh}`
-   - Remove old build script (`services/nix-cache/build-flakes.nix`, `build-flakes.sh`)
+   - Removed Vault AppRole and secrets
-   - Archive or delete host config
+   - Removed old signing key from `system/nix.nix`
-   - Remove old signing key from `system/nix.nix` trusted-public-keys
+   - Removed from `flake.nix`
+   - Deleted VM from Proxmox
 
 ### Phase 5: Scheduled Builds (Optional)