Decouple central nix cache push from activation

services/app-server/nix/nixos/module.nix

@@ -115,6 +115,12 @@ in
         default = "/quixos/nix-cache/central-push-token";
         description = "SSM parameter containing the central push token.";
       };
+
+      pushJobs = lib.mkOption {
+        type = lib.types.ints.positive;
+        default = 1;
+        description = "Maximum number of parallel Attic upload jobs for central closure uploads.";
+      };
     };
   };
 
@@ -305,13 +311,17 @@ in
 
     systemd.services.quixos-nix-cache-push = lib.mkIf cfg.nixCache.enable {
       description = "Upload central system closure to Quixos Nix cache";
-      wantedBy = [ "multi-user.target" ];
       after = [ "network-online.target" ];
       wants = [ "network-online.target" ];
       path = [ pkgs.attic-client pkgs.awscli2 pkgs.coreutils ];
+      unitConfig = {
+        StartLimitBurst = 5;
+        StartLimitIntervalSec = "30min";
+      };
       serviceConfig = {
         Type = "oneshot";
-        RemainAfterExit = true;
+        Restart = "on-failure";
+        RestartSec = "2min";
         WorkingDirectory = "/tmp";
       };
       script = ''
@@ -330,10 +340,21 @@ in
         )"
 
         attic login --set-default quixos ${lib.escapeShellArg cfg.nixCache.endpoint} "$token" >/dev/null
-        attic push ${lib.escapeShellArg cfg.nixCache.cacheName} /run/current-system
+        attic push --jobs ${toString cfg.nixCache.pushJobs} ${lib.escapeShellArg cfg.nixCache.cacheName} /run/current-system
       '';
     };
 
+    systemd.timers.quixos-nix-cache-push = lib.mkIf cfg.nixCache.enable {
+      description = "Periodically upload central system closure to Quixos Nix cache";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnActiveSec = "1min";
+        OnUnitActiveSec = "6h";
+        RandomizedDelaySec = "30s";
+        Unit = "quixos-nix-cache-push.service";
+      };
+    };
+
     services.caddy = {
       enable = true;
       package = pkgs.caddy.withPlugins {