Tor Hidden Services, easy to set up on the server side, can be annoying on the client side but HTTP and SSH are fine. Can be a bit slow but IMHO still usable.

I’ve been using the unstable channel and am rarely seeing packages being built locally. But yeah, there’s no negative caching, if it’s something that fails to build in NixOS CI, local build will be attempted and will fail again.

Package update must build successfully before it’s merged to git, and a git master must build basic system successfully before it’s pushed to unstable channel. Requiring all packages to build successfully is infeasible for unstable, that’s what stable releases are for.

Do you have this problem with some particular packages, or is it always something else?