Require nix cache metadata by default

tofu/README.md

@@ -110,6 +110,12 @@ Attic cache named `quixos`, then publishes:
 Use the `hosts_entry` output to add an internal `/etc/hosts` mapping on clients
 instead of creating private Route53 records.
 
+Central treats the nix-cache as required by default. If the cache host has not
+published `/quixos/nix-cache/public-key` yet, `tofu/central` fails instead of
+silently applying without cache wiring. For the first bootstrap apply only, set
+`nix_cache_bootstrap_optional = true`; remove it once the cache has published
+its key.
+
 The central app server uses the recommended AMI published by the AMI builder:
 
 ```hcl

tofu/central/main.tf

@@ -43,6 +43,13 @@ data "external" "nix_cache_public_key" {
 
 resource "random_id" "central" {
   byte_length = 4
+
+  lifecycle {
+    precondition {
+      condition     = !var.nix_cache_enable || var.nix_cache_bootstrap_optional || var.nix_cache_public_key != null || try(data.external.nix_cache_public_key[0].result.value != "", false)
+      error_message = "nix_cache_enable is true, but the nix-cache public key is not available. Apply tofu/nix-cache and wait for it to publish /quixos/nix-cache/public-key, set nix_cache_public_key explicitly, or set nix_cache_bootstrap_optional=true for the first bootstrap apply."
+    }
+  }
 }
 
 locals {

tofu/central/variables.tf

@@ -151,7 +151,13 @@ variable "app_server_ref_is_rev" {
 variable "nix_cache_enable" {
   type        = bool
   default     = true
-  description = "Configure the central app server to pull from and push to the internal Quixos Nix cache when cache metadata is available."
+  description = "Require the central app server to pull from and push to the internal Quixos Nix cache."
+}
+
+variable "nix_cache_bootstrap_optional" {
+  type        = bool
+  default     = false
+  description = "Temporarily allow central to apply before the nix-cache host has published its public key. Leave false for normal operation so broken cache bootstrap fails loudly."
 }
 
 variable "nix_cache_state_bucket" {
@@ -175,5 +181,5 @@ variable "nix_cache_state_region" {
 variable "nix_cache_public_key" {
   type        = string
   default     = null
-  description = "Optional Attic public key override. When unset, central tries to read it from the nix-cache SSM output parameter and skips cache wiring if it is not published yet."
+  description = "Optional Attic public key override. When unset, central reads the key from the nix-cache SSM output parameter."
 }