chore: uniformize on the same nixpkgs...

.gitea/workflows/demo.yaml

@@ -0,0 +1,19 @@
+name: Gitea Actions Demo
+run-name: ${{ gitea.actor }} is testing out Gitea Actions 🚀
+on: [push]
+
+jobs:
+  Explore-Gitea-Actions:
+    runs-on: native
+    steps:
+      - run: echo "🎉 The job was automatically triggered by a ${{ gitea.event_name }} event."
+      - run: echo "🐧 This job is now running on a ${{ runner.os }} server hosted by Gitea!"
+      - run: echo "🔎 The name of your branch is ${{ gitea.ref }} and your repository is ${{ gitea.repository }}."
+      - name: Check out repository code
+        uses: actions/checkout@v4
+      - run: echo "💡 The ${{ gitea.repository }} repository has been cloned to the runner."
+      - run: echo "🖥️ The workflow is now ready to test your code on the runner."
+      - name: List files in the repository
+        run: |
+          ls ${{ gitea.workspace }}
+      - run: echo "🍏 This job's status is ${{ job.status }}."

config/git-gitea.nix

@@ -28,12 +28,26 @@
         type = "tar.gz";
       };
     };
-    # gitea-actions-runner.instances.default = {
-    #   enable = true;
-    #   labels = [
-    #     "test"
-    #     "nixos"
-    #   ];
-    # };
+    gitea-actions-runner.instances.nixos = {
+      name = "nixos";
+      enable = true;
+      hostPackages = with pkgs; [
+        bash
+        coreutils
+        curl
+        gawk
+        gitMinimal
+        gnused
+        wget
+        devenv
+        nodejs
+        nix
+      ];
+      labels = [
+        "native:host"
+      ];
+      tokenFile = config.age.secrets.gitea-action-token.path;
+      url = "https://${tools.build_hostname "git"}";
+    };
   };
 }

containers/git.nix

@@ -19,6 +19,12 @@ in
       importConfig = [
         ../config/git-gitea.nix
       ];
+      additional = {
+        nix.extraOptions = ''
+          extra-substituters = https://devenv.cachix.org https://nixpkgs-python.cachix.org
+          extra-trusted-public-keys = devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw= nixpkgs-python.cachix.org-1:hxjI7pFxTyuTHn2NkvWCrAUcNZLNS3ZAvfYNuYifcEU=
+        '';
+      };
     };
     logging = {
       enable = true;

flake.lock

@@ -109,7 +109,9 @@
         "flake-parts": "flake-parts_2",
         "git-hooks": "git-hooks",
         "nix": "nix",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
         "lastModified": 1766415291,
@@ -259,7 +261,9 @@
     "generators": {
       "inputs": {
         "nixlib": "nixlib",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
         "lastModified": 1764234087,
@@ -427,17 +431,17 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1761313199,
-        "narHash": "sha256-wCIACXbNtXAlwvQUo1Ed++loFALPjYUA3dpcUJiXO44=",
-        "owner": "cachix",
-        "repo": "devenv-nixpkgs",
-        "rev": "d1c30452ebecfc55185ae6d1c983c09da0c274ff",
+        "lastModified": 1766309749,
+        "narHash": "sha256-3xY8CZ4rSnQ0NqGhMKAy5vgC+2IVK0NoVEzDoOh4DA4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a6531044f6d0bef691ea18d4d4ce44d0daa6e816",
         "type": "github"
       },
       "original": {
-        "owner": "cachix",
-        "ref": "rolling",
-        "repo": "devenv-nixpkgs",
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
         "type": "github"
       }
     },
@@ -456,53 +460,6 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1736657626,
-        "narHash": "sha256-FWlPMUzp0lkQBdhKlPqtQdqmp+/C+1MBiEytaYfrCTY=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "2f9e2f85cb14a46410a1399aa9ea7ecf433e422e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1766309749,
-        "narHash": "sha256-3xY8CZ4rSnQ0NqGhMKAy5vgC+2IVK0NoVEzDoOh4DA4=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a6531044f6d0bef691ea18d4d4ce44d0daa6e816",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1728956102,
-        "narHash": "sha256-J8zo+UYNjHATsxn2/ROl8iaji2RgLm+sG7b3VcD36YM=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "3d85bae2431f20ab1ac5cf14d03d314dffe629af",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "pyproject-build-systems": {
       "inputs": {
         "nixpkgs": [
@@ -560,7 +517,7 @@
         "devenv": "devenv",
         "flake-utils": "flake-utils_2",
         "generators": "generators",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs",
         "terranix": "terranix"
       }
     },
@@ -627,7 +584,9 @@
     "terranix": {
       "inputs": {
         "flake-parts": "flake-parts_3",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
         "systems": "systems_4"
       },
       "locked": {

flake.nix

@@ -3,10 +3,22 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    flake-utils.url = "github:numtide/flake-utils";
-    generators.url = "github:nix-community/nixos-generators";
-    terranix.url = "github:terranix/terranix";
-    devenv.url = "github:cachix/devenv";
+    flake-utils = {
+      url = "github:numtide/flake-utils";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    generators = {
+      url = "github:nix-community/nixos-generators";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    terranix = {
+      url = "github:terranix/terranix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    devenv = {
+      url = "github:cachix/devenv";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     authentik-nix = {
       url = "github:nix-community/authentik-nix";
       inputs.nixpkgs.follows = "nixpkgs";

secrets/gitea-action-token.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 jxhkLg +nJfyxntIaggZaWMizEypE0ll5yfe0k5DqHeMmQBxRU
+TIYZaF/gT00Z9EjBWq6cr6vJr35c+dHOR9guLKzm680
+-> ssh-ed25519 tqMvRA 6P23pOjZiB0TGsG9oM6NWK8IwranIHEPk74uScEWvV4
+lUE7CH4hHe9oJU3Fw8Dley81XWfkUWMNRwdq6JJLSFc
+-> ssh-ed25519 UpdoSw Uuc0b1ogxc6kYMvYoV4foVV+Fx8YQWTBqeM6KsDfiDs
+4L1kpqir9owTX09913E2GLPQJBkdegwm53H87yl/WDY
+--- UGe/Omeq2jrrSCXr9qjdEhhNE6Ir/d3q/gEesJ+cjgM
+æš‹€HØÍÁ-$*jâ pƒîw<C3AE>œ€ía¨<61>`uÞ®_W9D¾®#ÀÖ©®<C2A9>-”Äz<µêM+þ›¾Ïÿ‹òVï$·»<C2B7>`«ÐüÜA¦)

secrets/metrics-pve.age

@@ -1,9 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 jxhkLg s68L/ORJQ1LJF5F3CZ8z/2FmCYlXllFHrJjMxov0qlc
-42ABucRpgxxvNWm/ufA7V/b7m2XWK+3xcHzymPF0VaQ
--> ssh-ed25519 tqMvRA na19byAvI21z/+ODPL3qafqdVd32oLdAN88tp0f0GU8
-6RSTSy0TCy1BVcyqijU/Dg5eBkREEiT5off75G+Flm8
--> ssh-ed25519 hKRBdw 2/X+Dv3TEt21SF1i6tQ9AMLfd7KQ2NCyiiZzHIMFrUo
-Em8FjDhe9J6G+awK9zsdrd+LtC5DT7u4+tvVSb1/pYY
---- t+oO9p9wqHWOuUsy2EdGff7SkywtlWyk3PhXriJ5rLk
-ÿ<>‘<>º
FLWΣæŸï½YƒêAØÎѳåvºŸ+kÚöŸ³\SFûÝâC/9FßW#ÔÒ›yÛ•øwµö'm^šÚ^%„Þÿ<Pýf–rE'æHÙ	y²áØ•É€ˆÿºåÛöNôÒ¸”piõRJ

+-> ssh-ed25519 jxhkLg uJnDmE99mLaYH9pL+eHhoY8U0PHOz5ISj2fF8N0HCwY
++Nuk+39ZVdDVfypo5zPItI51Ep0ztYBVGEshYe4oJJk
+-> ssh-ed25519 tqMvRA 9A79nIinxtnfDR5IqU1DpFMLEmgD1ukquSQwy9xrgQw
+HvytTNHUPMCF/SrLu1GIMqAihmSnKGeXWU3XQbOEVTo
+-> ssh-ed25519 hKRBdw 1the4xRyYnb/JkSwhgx3ToUNfHdDJ529oBJQD/h2+wI
+newJdp5+Q8ktGgCM4ismTRzAM9Fb8pbiIM6CmHcFZ4U
+--- EGRZ1p0FNtLwNsUz4HMmqVwg8RTvJGxRyTMlyraVubQ
+ÆÛ²r¾À<EFBFBD>72Ï“£›†;k¦Ñm"›xxRQ;ø©%ÈZâIÙÈD*W߯o
+PÑHðÞ¿œÇϵvuS)<29>BÏÚ<C38F>NX¬ötBÈ	´[åäž2ö¿«}Ì

secrets/mqtt-exporter-environment.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 jxhkLg zgYm0/IF1/Xdj7JBp+oICW/bEuZZD5rWRmrXCGx1qXI
-OXZHX6sVWb7YKg0xApx/yRTRQ4O6U/7Awuh3LtWDZJ0
--> ssh-ed25519 tqMvRA WxKTFFHFMROV3FGz5n5En8Ng3ZA6ri7lTln+LmBW5Ds
-BJ9hp5Xf43hOFVlXVdu5rQCVYgfvn2K6JRmK/mnB2Ps
--> ssh-ed25519 5VK9ng 3HOprdaCdSOsxy4H4HulGTgxmKNHq3M+1eeGLxtXH34
-WLZ1xsVS3dg5yP5FabuIEjm/lgl3GLq9fbhfDgQ0nXM
---- aAncZ/pY0yGb3QZeBpew12pY8ubrL2PO0l8DZqTcRMY
-¢Öî*Å…:ëA«yø"ò«EyÚ©NCQŠÆÇh­¸;ä[à9Õ}L«;ci÷z
)ÌIª’Yt+¾´ú–“e
+-> ssh-ed25519 jxhkLg FSTFFz4Mm+x7AxDxwbxj+/lMb4Fkv+iZsyH2OEzSFUk
+SSjo0GgqU6pvGHc0x1pF4SmYhsU6U2oPd7Y5gzJ0ymQ
+-> ssh-ed25519 tqMvRA GAnhEWv/rQUTFEkXpB6SwdTrDRYC2Qt779bOgmbgGH0
+SYQNpeGfl2Tm3BMujTa7zSldKy2KgEtwERa4LPS6Yz0
+-> ssh-ed25519 5VK9ng ODLHF2pTlRAxAbenhcu8DOMek585/+DELiQLNbS5rxE
+LGrDab6vZUfN3aKtLGPEI9xtY97i2PDu8w0J+jMaMOQ
+--- 6zu2BQaxC/wqbqVYThd47VBVTCbhn8/3CobsymC/4tY
+<EFBFBD>+Qo÷,nTú‰r ©hu‘^HüêûëÕGõ3W—}î}¥ø¾èŸVZåÎ’÷ˆ”íbEîÌá=ùXÐ

secrets/mqtt-password-frigate.age

@@ -1,10 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 jxhkLg irrsKDDay7MES1geZ15cqL3AyqBBzJ0mEC1kVeX97TE
-9dOyx3LRjDa6RREeHel08qKEMtmTvuH3o3Rit/lq9pI
--> ssh-ed25519 tqMvRA pWZspBwWS1WDlHBMW4V3FzhmrHY+pSGGnoVLgqXK51M
-ob4bkKrj/UIpQlZpqra6hH3fS6p9aSCz0z1EYc+85cs
--> ssh-ed25519 5VK9ng Ws1aNLFLK7OaDzX3x2h9QuJJ143Nx6jvxbVqhTYsahc
-2Pn1ndhbAO7axpfmfmaeLo37zSy2ZbIjpstwMJMERVM
---- WtjXEKoVwsTHH7OjsMlTAc6iVjh35tiRwBKcMgsqnDU
-q4|žA<C5BE>"2À·d&4‚,;uH0
-ÜîOñ¼-`FGÿ<16>×X
+-> ssh-ed25519 jxhkLg RWH08YdNHhsdgZ9YZrAWqu5huQgj14jkeqVjpuN+lyQ
+lMFUOLayKFT/CFJObzv+iBCNtD50Zkut3V613VpAZlw
+-> ssh-ed25519 tqMvRA bw7k2SUQgI/0VuBLFb9DCcIhkMOkfi6y/F48VmioR2c
+J13aDSFG4MsSbws6fvOgw1yMj1SKPCtwhDGCJuqM9G8
+-> ssh-ed25519 5VK9ng fy3OVO8F4TtYtht0S3V6OFeqsVgC/0g21VrNDrYJSUk
+ahlR/jiWB/M4ZIoVkuyByM9Z6v9ILv4a7d7NnY2Sb+0
+--- q3dyXg0DIpWfmLsEeAtwvp7rjZ221mO9yU5jwiu9+FQ
+%/7oàKð“5%„Í™0áãÕìx[vdWNsjUáîøÛ?
/

secrets/mqtt-password-ha.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 jxhkLg Uc9jtkuMKoM3Dq9XrknXoDQB2RmegRPI8C8Sl6bk6xY
-WUE0ti7WHxO9xBtQRIqh12LdV7c25paqBVXPFwmgXYc
--> ssh-ed25519 tqMvRA bfIfKq+o0mdMIxJ6PoGS9fOH7EE+XEeCCe5xUms0CE4
-+NGLKID+i6adDd9o5FvkJhiUJzHDCtQ2ryYZ7AxqJpg
--> ssh-ed25519 5VK9ng tdcfRS2iT1z8cDR0Wxia60Yg8/bRmov5TgA88R7Sixg
-8wNwRPn6xdMfjf5lUGu16yd5HamnC2urrp1XsYBoZdw
---- 880QcBbcatDgFTx0Ywqw7XRhKjRLAkh282Ur5YJeGlw
-&,æÜ&6¢G}îÆ[ÁŽ¼²BQ^7ÕÜn@IÖ¶5<>	¸9Â<39>ñÓDëz»P†Ɇ@{
+-> ssh-ed25519 jxhkLg JUUIovAr7FZ7vkhABo8YLAgxbpkr0O6uyCbxBPQADBE
+0LbgfLtBhMyB9Orj0HK3ZjkPYoDuHqLlo0nsMiHSLpg
+-> ssh-ed25519 tqMvRA pYB48098noHg4YlkbpYJv453TbpI3LwNhbjEpjrP0B0
+zHMsrI6CzIIOKSncU8fs99U1Qjn+sEaaAvnULYHlau4
+-> ssh-ed25519 5VK9ng A1t9lgjd6de3R2MoLmq6W88GRWdPZUnFermr/+IniQc
+SOLpjw/a5iVfE0jspqPfTsyS/Kiu3aSs+gmBsGWOwhk
+--- WjIuYWhSKjjrjH9f/uzDbM16kuDJ31U2Q2kGKLOIiNQ
+ÚÛXºÆ’K© ,ðv2…e[ î’1[ö8>(ØJPݧ>åRò›@Ÿôµ®ÿ|ý	w

secrets/mqtt-password-z2m.age

@@ -1,10 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 jxhkLg NrGG8qgpth4esKSjjEX5KZlVevWZ5KpPd3yNOOJCblE
-9GcLLdSiUFbR0pqjUdr2GB4EEwivBWeLne2To2O0T/M
--> ssh-ed25519 tqMvRA Cdfw+1e6E9tV2me/22OPjb7w0ncoS0TgFlcscZ17RDc
-Wucu5fsX2auUZ6B6+NncOFqTlSr7v+qhOhY+mwqI758
--> ssh-ed25519 5VK9ng hlWUcnMHVCa7eqfg20vcQ/f5jnZghCmoF+CX32gd80U
-WXxYipBo4pgZ9nxqiVT1GRePAXqDWqnb5Eq23qbTrug
---- GcWiqMDG56mMLPju+NaLmBBpfJ7LAmeQ43+4FCN6cA0
-8sóŸ¦iK¯Ä^_¡’æ=«ì+ºOœo	ŸQ®
-âŠ\‚÷þI+¤
qÁû 
+-> ssh-ed25519 jxhkLg vh8sd9xV/Q806xIXK6cYV79dGcCYhS1AopbQHyOH30I
+AfuLD7D5vwEaC3v7t5qtQ8EsYvRuDWqz9wjkJGydE8E
+-> ssh-ed25519 tqMvRA JJHGREWSqoATkr6vEkUk7dGvLvc2ElNa6KWBfJcIWQE
+0mJazOmYK8K2sMmpXf8u0PujNFNVOry3xXZu8rHnMJ8
+-> ssh-ed25519 5VK9ng w0rWKarqUMgE6PBNL9wKTuCRRxyR9b0oUFtGPsPzkmQ
+4wsCPHpcvTl3GfRaU2HNZxHWAdMl212GpVOsClPVyJo
+--- LIZN/jw180wunsNYZqxoUV+jSFQHV8Jh/MZMxSRE0uQ
+®œFmg¹­§jÿÙÌ÷
+‚<EFBFBD>g¡>¦JÕ̓[¹èÅ6ô+ÃfÚ®êŽyˆ¤´t

secrets/power-password-file.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 jxhkLg bicqQd7H4Q9AIQYnh+WOH2l/mPCxEMeYET6aEtDDREI
-skeR6/zF0dpsbl6nKIVWhPQ6hI8+MY78ize9d0dB13Y
--> ssh-ed25519 tqMvRA MKQb4Tn0dvZQFnGaKEFaqMFWFGZvuwgjufBhNsc40xg
-PhtI3AcrjCP0IvdJoWQSLBTeb9wpEBJdfNk24jBIWbY
--> ssh-ed25519 DVDL4g IzPTDKLmUpICvbhPLIss/4kh0QhkTMllkJlj0hj1U3s
-iWxFdt8BMuUjSy3ngYytg0+ayXDNt//7OWiyWPUuOB0
---- OBusaZYu8lY3b+x54m2MFFkgd83kKjL8hjLFIV09GHU
-Räqß=AEjÐÙ6°¡<óý‘‘v¤*ø'"¸#[R1Ü¡8cÌs)jBG<42>‚
+-> ssh-ed25519 jxhkLg qQcbA0bt9+M+B9Ve47SNPHr1uPX+m9HOE2vfI339eVQ
+5hx8LMyklnVrDJVqW42+UNvwQrwFuLvIfMvQYqbbB1U
+-> ssh-ed25519 tqMvRA s1/g5UQ4VOr2ZCVFjtFM6sk4xblYNJ+aJNRXfkeECS4
+cknku8Vrpfwrnfluaky2CXY8ICgCm8taS92nfUNoUkM
+-> ssh-ed25519 DVDL4g DYSwyQBH/o+vCDpm5AJ2IBQoCZjABtGSJxEH67uPXHw
+cT7jG7jy8z71GvxJFA7B2yRK/vofWvmdr6CIju7D+34
+--- 5lOmaEiAcyK1Mmwfy0c22ygTnaJVio9CRiavktGFj28
+GN?WÇA©bªaÚûî0 æ‹xŸ

secrets/secrets.nix

@@ -19,6 +19,9 @@ in
   "db-postgres-initscript.age".publicKeys = users ++ [
     keys.db
   ];
+  "gitea-action-token.age".publicKeys = users ++ [
+    keys.git
+  ];
   "finances-app-key.age" = {
     publicKeys = users ++ [
       keys.finances