increase numInstances to 5

This reverts commit 60e7b841a9.

.forgejo/workflows/cd.yaml

@@ -1,24 +0,0 @@
-name: deploy-infra
-
-on:
-  workflow_dispatch: # allows manual triggering
-  push:
-    branches:
-      # - main
-
-jobs:
-  deploy:
-    runs-on: native
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set up SSH key to access age secrets
-        run: |
-          env
-          mkdir -p ~/.ssh
-          echo "${{ secrets.CD_SSH_KEY }}" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-
-      - name: Deploy
-        run: nix-shell --run 'nixops4 apply default'

.forgejo/workflows/update.yaml

@@ -15,7 +15,7 @@ jobs:
       - name: Update pins
         run: nix-shell --run "npins update"
       - name: Create PR
-        uses: https://github.com/KiaraGrouwstra/gitea-create-pull-request@f9f80aa5134bc5c03c38f5aaa95053492885b397
+        uses: github.com/quentinlegot/gitea-create-pull-request@d1fd3e1f0c98ee7a009c035f9b7ad3f3bdc0f281
         with:
           remote-instance-api-version: v1
           token: "${{ secrets.DEPLOY_KEY }}"

deployment/check/basic/constants.nix

@@ -1,8 +0,0 @@
-{
-  targetMachines = [
-    "hello"
-    "cowsay"
-  ];
-  pathToRoot = ../../..;
-  pathFromRoot = ./.;
-}

deployment/check/basic/default.nix

@@ -1,14 +0,0 @@
-{
-  runNixOSTest,
-  inputs,
-  sources,
-}:
-
-runNixOSTest {
-  imports = [
-    ../common/nixosTest.nix
-    ./nixosTest.nix
-  ];
-  _module.args = { inherit inputs sources; };
-  inherit (import ./constants.nix) targetMachines pathToRoot pathFromRoot;
-}

deployment/check/basic/deployment.nix

@@ -1,36 +0,0 @@
-{
-  inputs,
-  sources,
-  lib,
-  providers,
-  ...
-}:
-
-let
-  inherit (import ./constants.nix) targetMachines pathToRoot pathFromRoot;
-in
-
-{
-  providers = {
-    inherit (inputs.nixops4.modules.nixops4Provider) local;
-  };
-
-  resources = lib.genAttrs targetMachines (nodeName: {
-    type = providers.local.exec;
-
-    imports = [
-      inputs.nixops4-nixos.modules.nixops4Resource.nixos
-      ../common/targetResource.nix
-    ];
-
-    _module.args = { inherit inputs sources; };
-
-    inherit nodeName pathToRoot pathFromRoot;
-
-    nixos.module =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.${nodeName} ];
-      };
-  });
-}

deployment/check/basic/flake-part.nix

@@ -0,0 +1,57 @@
+{
+  self,
+  inputs,
+  lib,
+  sources,
+  ...
+}:
+
+let
+  inherit (lib) genAttrs;
+
+  targetMachines = [
+    "hello"
+    "cowsay"
+  ];
+  pathToRoot = /. + (builtins.unsafeDiscardStringContext self);
+  pathFromRoot = ./.;
+
+in
+{
+  _class = "flake";
+
+  perSystem =
+    { pkgs, ... }:
+    {
+      checks.deployment-basic = pkgs.testers.runNixOSTest {
+        imports = [
+          ../common/nixosTest.nix
+          ./nixosTest.nix
+        ];
+        _module.args = { inherit inputs sources; };
+        inherit targetMachines pathToRoot pathFromRoot;
+      };
+    };
+
+  nixops4Deployments.check-deployment-basic =
+    { providers, ... }:
+    {
+      providers = {
+        inherit (inputs.nixops4.modules.nixops4Provider) local;
+      };
+      resources = genAttrs targetMachines (nodeName: {
+        type = providers.local.exec;
+        imports = [
+          inputs.nixops4-nixos.modules.nixops4Resource.nixos
+          ../common/targetResource.nix
+        ];
+        _module.args = { inherit inputs sources; };
+        inherit nodeName pathToRoot pathFromRoot;
+        nixos.module =
+          { pkgs, ... }:
+          {
+            environment.systemPackages = [ pkgs.${nodeName} ];
+          };
+      });
+    };
+}

deployment/check/basic/flake-under-test.nix

@@ -1,22 +0,0 @@
-{
-  inputs = {
-    nixops4.follows = "nixops4-nixos/nixops4";
-    nixops4-nixos.url = "github:nixops4/nixops4-nixos";
-  };
-
-  outputs =
-    inputs:
-    import ./mkFlake.nix inputs (
-      { inputs, sources, ... }:
-      {
-        imports = [
-          inputs.nixops4.modules.flake.default
-        ];
-
-        nixops4Deployments.check-deployment-basic = {
-          imports = [ ./deployment/check/basic/deployment.nix ];
-          _module.args = { inherit inputs sources; };
-        };
-      }
-    );
-}

deployment/check/basic/nixosTest.nix

@@ -1,15 +1,10 @@
-{ inputs, lib, ... }:
+{ inputs, ... }:
 
 {
   _class = "nixosTest";
 
   name = "deployment-basic";
 
-  sourceFileset = lib.fileset.unions [
-    ./constants.nix
-    ./deployment.nix
-  ];
-
   nodes.deployer =
     { pkgs, ... }:
     {

deployment/check/cli/constants.nix

@@ -1,11 +0,0 @@
-{
-  targetMachines = [
-    "garage"
-    "mastodon"
-    "peertube"
-    "pixelfed"
-  ];
-  pathToRoot = ../../..;
-  pathFromRoot = ./.;
-  enableAcme = true;
-}

deployment/check/cli/default.nix

@@ -1,19 +0,0 @@
-{
-  runNixOSTest,
-  inputs,
-  sources,
-}:
-
-runNixOSTest {
-  imports = [
-    ../common/nixosTest.nix
-    ./nixosTest.nix
-  ];
-  _module.args = { inherit inputs sources; };
-  inherit (import ./constants.nix)
-    targetMachines
-    pathToRoot
-    pathFromRoot
-    enableAcme
-    ;
-}

deployment/check/cli/deployments.nix

@@ -1,59 +0,0 @@
-{
-  inputs,
-  sources,
-  lib,
-}:
-
-let
-  inherit (builtins) fromJSON readFile listToAttrs;
-  inherit (import ./constants.nix)
-    targetMachines
-    pathToRoot
-    pathFromRoot
-    enableAcme
-    ;
-
-  makeTargetResource = nodeName: {
-    imports = [ ../common/targetResource.nix ];
-    _module.args = { inherit inputs sources; };
-    inherit
-      nodeName
-      pathToRoot
-      pathFromRoot
-      enableAcme
-      ;
-  };
-
-  ## The deployment function - what we are here to test!
-  ##
-  ## TODO: Modularise `deployment/default.nix` to get rid of the nested
-  ## function calls.
-  makeTestDeployment =
-    args:
-    (import ../..)
-      {
-        inherit lib;
-        inherit (inputs) nixops4 nixops4-nixos;
-        fediversity = import ../../../services/fediversity;
-      }
-      (listToAttrs (
-        map (nodeName: {
-          name = "${nodeName}ConfigurationResource";
-          value = makeTargetResource nodeName;
-        }) targetMachines
-      ))
-      (fromJSON (readFile ../../configuration.sample.json) // args);
-
-in
-{
-  check-deployment-cli-nothing = makeTestDeployment { };
-
-  check-deployment-cli-mastodon-pixelfed = makeTestDeployment {
-    mastodon.enable = true;
-    pixelfed.enable = true;
-  };
-
-  check-deployment-cli-peertube = makeTestDeployment {
-    peertube.enable = true;
-  };
-}

deployment/check/cli/flake-part.nix

@@ -0,0 +1,90 @@
+{
+  self,
+  inputs,
+  lib,
+  sources,
+  ...
+}:
+
+let
+  inherit (builtins) fromJSON readFile listToAttrs;
+
+  targetMachines = [
+    "garage"
+    "mastodon"
+    "peertube"
+    "pixelfed"
+  ];
+  pathToRoot = /. + (builtins.unsafeDiscardStringContext self);
+  pathFromRoot = ./.;
+  enableAcme = true;
+
+in
+{
+  _class = "flake";
+
+  perSystem =
+    { pkgs, ... }:
+    {
+      checks.deployment-cli = pkgs.testers.runNixOSTest {
+        imports = [
+          ../common/nixosTest.nix
+          ./nixosTest.nix
+        ];
+        _module.args = { inherit inputs sources; };
+        inherit
+          targetMachines
+          pathToRoot
+          pathFromRoot
+          enableAcme
+          ;
+      };
+    };
+
+  nixops4Deployments =
+    let
+      makeTargetResource = nodeName: {
+        imports = [ ../common/targetResource.nix ];
+        _module.args = { inherit inputs sources; };
+        inherit
+          nodeName
+          pathToRoot
+          pathFromRoot
+          enableAcme
+          ;
+      };
+
+      ## The deployment function - what we are here to test!
+      ##
+      ## TODO: Modularise `deployment/default.nix` to get rid of the nested
+      ## function calls.
+      makeTestDeployment =
+        args:
+        (import ../..)
+          {
+            inherit lib;
+            inherit (inputs) nixops4 nixops4-nixos;
+            fediversity = import ../../../services/fediversity;
+          }
+          (listToAttrs (
+            map (nodeName: {
+              name = "${nodeName}ConfigurationResource";
+              value = makeTargetResource nodeName;
+            }) targetMachines
+          ))
+          (fromJSON (readFile ../../configuration.sample.json) // args);
+
+    in
+    {
+      check-deployment-cli-nothing = makeTestDeployment { };
+
+      check-deployment-cli-mastodon-pixelfed = makeTestDeployment {
+        mastodon.enable = true;
+        pixelfed.enable = true;
+      };
+
+      check-deployment-cli-peertube = makeTestDeployment {
+        peertube.enable = true;
+      };
+    };
+}

deployment/check/cli/flake-under-test.nix

@@ -1,26 +0,0 @@
-{
-  inputs = {
-    nixops4.follows = "nixops4-nixos/nixops4";
-    nixops4-nixos.url = "github:nixops4/nixops4-nixos";
-  };
-
-  outputs =
-    inputs:
-    import ./mkFlake.nix inputs (
-      {
-        inputs,
-        sources,
-        lib,
-        ...
-      }:
-      {
-        imports = [
-          inputs.nixops4.modules.flake.default
-        ];
-
-        nixops4Deployments = import ./deployment/check/cli/deployments.nix {
-          inherit inputs sources lib;
-        };
-      }
-    );
-}

deployment/check/cli/nixosTest.nix

@@ -1,9 +1,4 @@
-{
-  inputs,
-  hostPkgs,
-  lib,
-  ...
-}:
+{ inputs, hostPkgs, ... }:
 
 let
   ## Some places need a dummy file that will in fact never be used. We create
@@ -16,21 +11,6 @@ in
 
   name = "deployment-cli";
 
-  sourceFileset = lib.fileset.unions [
-    ./constants.nix
-    ./deployments.nix
-
-    # REVIEW: I would like to be able to grab all of `/deployment` minus
-    # `/deployment/check`, but I can't because there is a bunch of other files
-    # in `/deployment`. Maybe we can think of a reorg making things more robust
-    # here? (comment also in panel test)
-    ../../default.nix
-    ../../options.nix
-    ../../configuration.sample.json
-
-    ../../../services/fediversity
-  ];
-
   nodes.deployer =
     { pkgs, ... }:
     {

deployment/check/common/deployerNode.nix

@@ -54,13 +54,12 @@ in
 
     system.extraDependencies =
       [
+        inputs.flake-parts
+        inputs.flake-parts.inputs.nixpkgs-lib
         inputs.nixops4
         inputs.nixops4-nixos
         inputs.nixpkgs
-
-        sources.flake-parts
         sources.flake-inputs
-        sources.git-hooks
 
         pkgs.stdenv
         pkgs.stdenvNoCC

deployment/check/common/nixosTest.nix

@@ -13,7 +13,6 @@ let
     toJSON
     ;
   inherit (lib)
-    types
     fileset
     mkOption
     genAttrs
@@ -28,6 +27,14 @@ let
 
   forConcat = xs: f: concatStringsSep "\n" (map f xs);
 
+  ## The whole repository, with the flake at its root.
+  ## FIXME: We could probably have fileset be the union of ./. with flake.nix
+  ## and flake.lock - I doubt we need anything else.
+  src = fileset.toSource {
+    fileset = config.pathToRoot;
+    root = config.pathToRoot;
+  };
+
   ## We will need to override some inputs by the empty flake, so we make one.
   emptyFlake = runCommandNoCC "empty-flake" { } ''
     mkdir $out
@@ -46,39 +53,9 @@ in
     ## FIXME: I wish I could just use `testScript` but with something like
     ## `mkOrder` to put this module's string before something else.
     extraTestScript = mkOption { };
-
-    sourceFileset = mkOption {
-      ## REVIEW: Upstream to nixpkgs?
-      type = types.mkOptionType {
-        name = "fileset";
-        description = "fileset";
-        descriptionClass = "noun";
-        check = (x: (builtins.tryEval (fileset.unions [ x ])).success);
-        merge = (_: defs: fileset.unions (map (x: x.value) defs));
-      };
-      description = ''
-        A fileset that will be copied to the deployer node in the current
-        working directory. This should contain all the files that are
-        necessary to run that particular test, such as the NixOS
-        modules necessary to evaluate a deployment.
-      '';
-    };
   };
 
   config = {
-    sourceFileset = fileset.unions [
-      # NOTE: not the flake itself; it will be overridden.
-      ../../../mkFlake.nix
-      ../../../flake.lock
-      ../../../npins
-
-      ./sharedOptions.nix
-      ./targetNode.nix
-      ./targetResource.nix
-
-      (config.pathToCwd + "/flake-under-test.nix")
-    ];
-
     acmeNodeIP = config.nodes.acme.networking.primaryIPAddress;
 
     nodes =
@@ -126,16 +103,8 @@ in
         ${n}.wait_for_unit("multi-user.target")
       '')}
 
-      ## A subset of the repository that is necessary for this test. It will be
-      ## copied inside the test. The smaller this set, the faster our CI, because we
-      ## won't need to re-run when things change outside of it.
       with subtest("Unpacking"):
-        deployer.succeed("cp -r --no-preserve=mode ${
-          fileset.toSource {
-            root = ../../..;
-            fileset = config.sourceFileset;
-          }
-        }/* .")
+        deployer.succeed("cp -r --no-preserve=mode ${src}/* .")
 
       with subtest("Configure the network"):
         ${forConcat config.targetMachines (
@@ -165,16 +134,11 @@ in
 
       ## NOTE: This is super slow. It could probably be optimised in Nix, for
       ## instance by allowing to grab things directly from the host's store.
-      ##
-      ## NOTE: We use the repository as-is (cf `src` above), overriding only
-      ## `flake.nix` by our `flake-under-test.nix`. We also override the flake
-      ## lock file to use locally available inputs, as we cannot download them.
-      ##
-      with subtest("Override the flake and its lock"):
-        deployer.succeed("cp ${config.pathFromRoot}/flake-under-test.nix flake.nix")
+      with subtest("Override the lock"):
         deployer.succeed("""
           nix flake lock --extra-experimental-features 'flakes nix-command' \
             --offline -v \
+            --override-input flake-parts ${inputs.flake-parts} \
             --override-input nixops4 ${inputs.nixops4.packages.${system}.flake-in-a-bottle} \
             \
             --override-input nixops4-nixos ${inputs.nixops4-nixos} \
@@ -186,6 +150,9 @@ in
               inputs.nixops4-nixos.inputs.nixops4.packages.${system}.flake-in-a-bottle
             } \
             --override-input nixops4-nixos/git-hooks-nix ${emptyFlake} \
+            \
+            --override-input nixpkgs ${inputs.nixpkgs} \
+            --override-input git-hooks ${inputs.git-hooks} \
             ;
         """)
 

deployment/check/panel/constants.nix

@@ -1,11 +0,0 @@
-{
-  targetMachines = [
-    "garage"
-    "mastodon"
-    "peertube"
-    "pixelfed"
-  ];
-  pathToRoot = ../../..;
-  pathFromRoot = ./.;
-  enableAcme = true;
-}

deployment/check/panel/default.nix

@@ -1,19 +0,0 @@
-{
-  runNixOSTest,
-  inputs,
-  sources,
-}:
-
-runNixOSTest {
-  imports = [
-    ../common/nixosTest.nix
-    ./nixosTest.nix
-  ];
-  _module.args = { inherit inputs sources; };
-  inherit (import ./constants.nix)
-    targetMachines
-    pathToRoot
-    pathFromRoot
-    enableAcme
-    ;
-}

deployment/check/panel/deployment.nix

@@ -1,58 +0,0 @@
-{
-  inputs,
-  sources,
-  lib,
-}:
-
-let
-  inherit (builtins) fromJSON listToAttrs;
-  inherit (import ./constants.nix)
-    targetMachines
-    pathToRoot
-    pathFromRoot
-    enableAcme
-    ;
-
-  makeTargetResource = nodeName: {
-    imports = [ ../common/targetResource.nix ];
-    _module.args = { inherit inputs sources; };
-    inherit
-      nodeName
-      pathToRoot
-      pathFromRoot
-      enableAcme
-      ;
-  };
-
-  ## The deployment function - what we are here to test!
-  ##
-  ## TODO: Modularise `deployment/default.nix` to get rid of the nested
-  ## function calls.
-  makeTestDeployment =
-    args:
-    (import ../..)
-      {
-        inherit lib;
-        inherit (inputs) nixops4 nixops4-nixos;
-        fediversity = import ../../../services/fediversity;
-      }
-      (listToAttrs (
-        map (nodeName: {
-          name = "${nodeName}ConfigurationResource";
-          value = makeTargetResource nodeName;
-        }) targetMachines
-      ))
-      args;
-
-in
-makeTestDeployment (
-  fromJSON (
-    let
-      env = builtins.getEnv "DEPLOYMENT";
-    in
-    if env == "" then
-      throw "The DEPLOYMENT environment needs to be set. You do not want to use this deployment unless in the `deployment-panel` NixOS test."
-    else
-      env
-  )
-)

deployment/check/panel/flake-part.nix

@@ -0,0 +1,94 @@
+{
+  self,
+  inputs,
+  lib,
+  sources,
+  ...
+}:
+
+let
+  inherit (builtins)
+    fromJSON
+    listToAttrs
+    ;
+
+  targetMachines = [
+    "garage"
+    "mastodon"
+    "peertube"
+    "pixelfed"
+  ];
+  pathToRoot = /. + (builtins.unsafeDiscardStringContext self);
+  pathFromRoot = ./.;
+  enableAcme = true;
+
+in
+{
+  _class = "flake";
+
+  perSystem =
+    { pkgs, ... }:
+    {
+      checks.deployment-panel = pkgs.testers.runNixOSTest {
+        imports = [
+          ../common/nixosTest.nix
+          ./nixosTest.nix
+        ];
+        _module.args = { inherit inputs sources; };
+        inherit
+          targetMachines
+          pathToRoot
+          pathFromRoot
+          enableAcme
+          ;
+      };
+    };
+
+  nixops4Deployments =
+    let
+      makeTargetResource = nodeName: {
+        imports = [ ../common/targetResource.nix ];
+        _module.args = { inherit inputs sources; };
+        inherit
+          nodeName
+          pathToRoot
+          pathFromRoot
+          enableAcme
+          ;
+      };
+
+      ## The deployment function - what we are here to test!
+      ##
+      ## TODO: Modularise `deployment/default.nix` to get rid of the nested
+      ## function calls.
+      makeTestDeployment =
+        args:
+        (import ../..)
+          {
+            inherit lib;
+            inherit (inputs) nixops4 nixops4-nixos;
+            fediversity = import ../../../services/fediversity;
+          }
+          (listToAttrs (
+            map (nodeName: {
+              name = "${nodeName}ConfigurationResource";
+              value = makeTargetResource nodeName;
+            }) targetMachines
+          ))
+          args;
+
+    in
+    {
+      check-deployment-panel = makeTestDeployment (
+        fromJSON (
+          let
+            env = builtins.getEnv "DEPLOYMENT";
+          in
+          if env == "" then
+            throw "The DEPLOYMENT environment needs to be set. You do not want to use this deployment unless in the `deployment-panel` NixOS test."
+          else
+            env
+        )
+      );
+    };
+}

deployment/check/panel/flake-under-test.nix

@@ -1,26 +0,0 @@
-{
-  inputs = {
-    nixops4.follows = "nixops4-nixos/nixops4";
-    nixops4-nixos.url = "github:nixops4/nixops4-nixos";
-  };
-
-  outputs =
-    inputs:
-    import ./mkFlake.nix inputs (
-      {
-        inputs,
-        sources,
-        lib,
-        ...
-      }:
-      {
-        imports = [
-          inputs.nixops4.modules.flake.default
-        ];
-
-        nixops4Deployments.check-deployment-panel = import ./deployment/check/panel/deployment.nix {
-          inherit inputs sources lib;
-        };
-      }
-    );
-}

deployment/check/panel/nixosTest.nix

@@ -125,20 +125,6 @@ in
 
   name = "deployment-panel";
 
-  sourceFileset = lib.fileset.unions [
-    ./constants.nix
-    ./deployment.nix
-
-    # REVIEW: I would like to be able to grab all of `/deployment` minus
-    # `/deployment/check`, but I can't because there is a bunch of other files
-    # in `/deployment`. Maybe we can think of a reorg making things more robust
-    # here? (comment also in CLI test)
-    ../../default.nix
-    ../../options.nix
-
-    ../../../services/fediversity
-  ];
-
   ## The panel's module sets `nixpkgs.overlays` which clashes with
   ## `pkgsReadOnly`. We disable it here.
   node.pkgsReadOnly = false;

deployment/flake-part.nix

@@ -1,26 +1,9 @@
-{ inputs, sources, ... }:
-
 {
   _class = "flake";
 
-  perSystem =
-    { pkgs, ... }:
-    {
-      checks = {
-        deployment-basic = import ./check/basic {
-          inherit (pkgs.testers) runNixOSTest;
-          inherit inputs sources;
-        };
-
-        deployment-cli = import ./check/cli {
-          inherit (pkgs.testers) runNixOSTest;
-          inherit inputs sources;
-        };
-
-        deployment-panel = import ./check/panel {
-          inherit (pkgs.testers) runNixOSTest;
-          inherit inputs sources;
-        };
-      };
-    };
+  imports = [
+    ./check/basic/flake-part.nix
+    ./check/cli/flake-part.nix
+    ./check/panel/flake-part.nix
+  ];
 }

flake.lock

@@ -59,6 +59,22 @@
       }
     },
     "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
       "flake": false,
       "locked": {
         "lastModified": 1733328505,
@@ -74,7 +90,7 @@
         "type": "github"
       }
     },
-    "flake-compat_3": {
+    "flake-compat_4": {
       "flake": false,
       "locked": {
         "lastModified": 1696426674,
@@ -127,6 +143,24 @@
       }
     },
     "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_3"
+      },
+      "locked": {
+        "lastModified": 1738453229,
+        "narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "nixops4-nixos",
@@ -167,12 +201,32 @@
         "type": "github"
       }
     },
-    "git-hooks-nix": {
+    "git-hooks": {
       "inputs": {
         "flake-compat": "flake-compat",
         "gitignore": "gitignore",
         "nixpkgs": "nixpkgs"
       },
+      "locked": {
+        "lastModified": 1742649964,
+        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "git-hooks-nix": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "gitignore": "gitignore_2",
+        "nixpkgs": "nixpkgs_2"
+      },
       "locked": {
         "lastModified": 1737465171,
         "narHash": "sha256-R10v2hoJRLq8jcL4syVFag7nIGE7m13qO48wRIukWNg=",
@@ -227,6 +281,27 @@
       }
     },
     "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gitignore_2": {
       "inputs": {
         "nixpkgs": [
           "nixops4-nixos",
@@ -266,8 +341,8 @@
     },
     "nix": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
-        "flake-parts": "flake-parts_3",
+        "flake-compat": "flake-compat_3",
+        "flake-parts": "flake-parts_4",
         "git-hooks-nix": "git-hooks-nix_2",
         "nixfmt": "nixfmt",
         "nixpkgs": [
@@ -341,10 +416,10 @@
     },
     "nixops4": {
       "inputs": {
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "nix": "nix",
         "nix-cargo-integration": "nix-cargo-integration",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "nixpkgs-old": "nixpkgs-old"
       },
       "locked": {
@@ -363,7 +438,7 @@
     },
     "nixops4-nixos": {
       "inputs": {
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_2",
         "git-hooks-nix": "git-hooks-nix",
         "nixops4": "nixops4",
         "nixops4-nixos": [
@@ -445,6 +520,18 @@
         "url": "https://github.com/NixOS/nixpkgs/archive/072a6db25e947df2f31aab9eccd0ab75d5b2da11.tar.gz"
       }
     },
+    "nixpkgs-lib_3": {
+      "locked": {
+        "lastModified": 1738452942,
+        "narHash": "sha256-vJzFZGaCpnmo7I6i416HaBLpC+hvcURh/BQwROcGIp8=",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/072a6db25e947df2f31aab9eccd0ab75d5b2da11.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/072a6db25e947df2f31aab9eccd0ab75d5b2da11.tar.gz"
+      }
+    },
     "nixpkgs-old": {
       "locked": {
         "lastModified": 1735563628,
@@ -478,6 +565,22 @@
       }
     },
     "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1730768919,
+        "narHash": "sha256-8AKquNnnSaJRXZxc5YmF/WfmxiHX6MMZZasRP6RRQkE=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a04d33c0c3f1a59a2c1cb0c6e34cd24500e5a1dc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1738410390,
         "narHash": "sha256-xvTo0Aw0+veek7hvEVLzErmJyQkEcRk6PSR4zsRQFEc=",
@@ -518,7 +621,7 @@
     },
     "purescript-overlay": {
       "inputs": {
-        "flake-compat": "flake-compat_3",
+        "flake-compat": "flake-compat_4",
         "nixpkgs": [
           "nixops4-nixos",
           "nixops4",
@@ -561,6 +664,8 @@
     },
     "root": {
       "inputs": {
+        "flake-parts": "flake-parts",
+        "git-hooks": "git-hooks",
         "nixops4": [
           "nixops4-nixos",
           "nixops4"

flake.nix

@@ -1,47 +1,83 @@
 {
   inputs = {
+    flake-parts.url = "github:hercules-ci/flake-parts";
+    git-hooks.url = "github:cachix/git-hooks.nix";
     nixops4.follows = "nixops4-nixos/nixops4";
     nixops4-nixos.url = "github:nixops4/nixops4-nixos";
   };
 
   outputs =
-    inputs:
-    import ./mkFlake.nix inputs (
-      { inputs, sources, ... }:
+    inputs@{ self, flake-parts, ... }:
+    let
+      sources = import ./npins;
+      inherit (import sources.flake-inputs) import-flake;
+      inherit (sources) git-hooks;
+      # XXX(@fricklerhandwerk): this atrocity is required to splice in a foreign Nixpkgs via flake-parts
+      # XXX - this is just importing a flake
+      nixpkgs = import-flake { src = sources.nixpkgs; };
+      # XXX - this overrides the inputs attached to `self`
+      inputs' = self.inputs // {
+        nixpkgs = nixpkgs;
+      };
+      self' = self // {
+        inputs = inputs';
+      };
+    in
+    # XXX - finally we override the overall set of `inputs` -- we need both:
+    #       `flake-parts obtains `nixpkgs` from `self.inputs` and not from `inputs`.
+    flake-parts.lib.mkFlake
       {
-        imports = [
-          "${sources.git-hooks}/flake-module.nix"
-          inputs.nixops4.modules.flake.default
-
-          ./deployment/flake-part.nix
-          ./infra/flake-part.nix
-          ./keys/flake-part.nix
-          ./secrets/flake-part.nix
-        ];
-
-        perSystem =
-          {
-            pkgs,
-            lib,
-            ...
-          }:
-          {
-            formatter = pkgs.nixfmt-rfc-style;
-
-            pre-commit.settings.hooks =
-              let
-                ## Add a directory here if pre-commit hooks shouldn't apply to it.
-                optout = [ "npins" ];
-                excludes = map (dir: "^${dir}/") optout;
-                addExcludes = lib.mapAttrs (_: c: c // { inherit excludes; });
-              in
-              addExcludes {
-                nixfmt-rfc-style.enable = true;
-                deadnix.enable = true;
-                trim-trailing-whitespace.enable = true;
-                shellcheck.enable = true;
-              };
-          };
+        inputs = inputs // {
+          inherit nixpkgs;
+        };
+        self = self';
+        specialArgs = {
+          inherit sources;
+        };
       }
-    );
+      (
+        { inputs, ... }:
+        {
+          systems = [
+            "x86_64-linux"
+            "aarch64-linux"
+            "x86_64-darwin"
+            "aarch64-darwin"
+          ];
+
+          imports = [
+            "${git-hooks}/flake-module.nix"
+            inputs.nixops4.modules.flake.default
+
+            ./deployment/flake-part.nix
+            ./infra/flake-part.nix
+            ./keys/flake-part.nix
+            ./secrets/flake-part.nix
+          ];
+
+          perSystem =
+            {
+              pkgs,
+              lib,
+              ...
+            }:
+            {
+              formatter = pkgs.nixfmt-rfc-style;
+
+              pre-commit.settings.hooks =
+                let
+                  ## Add a directory here if pre-commit hooks shouldn't apply to it.
+                  optout = [ "npins" ];
+                  excludes = map (dir: "^${dir}/") optout;
+                  addExcludes = lib.mapAttrs (_: c: c // { inherit excludes; });
+                in
+                addExcludes {
+                  nixfmt-rfc-style.enable = true;
+                  deadnix.enable = true;
+                  trim-trailing-whitespace.enable = true;
+                  shellcheck.enable = true;
+                };
+            };
+        }
+      );
 }

infra/common/proxmox-qemu-vm.nix

@@ -1,21 +1,9 @@
-let
-  # pulling this in manually over from module args resolves an infinite recursion.
-  # FIXME: instead untangle `//infra/flake-part.nix` and make it stop passing wild functions.
-  # move moving towards a portable-services-like pattern where some things are submodules.
-  # Right now those wild functions are for parameterising a bunch of things,
-  # and the modular way to do that would be options --
-  # obviously you can't use those for `imports`,
-  # so one way to decouple fixpoints is to isolate them into submodules.
-  # Therefore one approach would be to try to go down the call graph,
-  # and see where what's currently a function could be a `submodule` field of something else.
-  sources = import ../../npins;
-in
+{ modulesPath, ... }:
+
 {
   _class = "nixos";
 
-  imports = [
-    "${sources.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
-  ];
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
 
   boot = {
     initrd = {

infra/flake-part.nix

@@ -33,10 +33,6 @@ let
           ;
       };
 
-      nixos.module.imports = [
-        ./common/proxmox-qemu-vm.nix
-      ];
-
       imports =
         [
           ./common/resource.nix
@@ -44,6 +40,7 @@ let
         ++ (
           if isTestVm then
             [
+              ./common/proxmox-qemu-vm.nix
               ../machines/operator/${vmName}
               {
                 nixos.module.users.users.root.openssh.authorizedKeys.keys = [

keys/cd-ssh-key.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlsYTtMx3hFO8B5B8iHaXL2JKj9izHeC+/AMhIWXBPs cd-age

keys/default.nix

@@ -35,5 +35,4 @@ in
   contributors = collectKeys ./contributors;
   systems = collectKeys ./systems;
   panel = removeTrailingWhitespace (readFile ./panel-ssh-key.pub);
-  cd = removeTrailingWhitespace (readFile ./cd-ssh-key.pub);
 }

machines/dev/fedi201/fedipanel.nix

@@ -1,10 +1,10 @@
 {
   config,
+  sources,
   ...
 }:
 let
   name = "panel";
-  sources = import ../../../npins;
 in
 {
   _class = "nixos";

machines/dev/forgejo-ci/default.nix

@@ -48,7 +48,7 @@ in
       };
 
       ## NOTE: This is a physical machine, so is not covered by disko
-      fileSystems."/" = lib.mkForce {
+      fileSystems."/" = {
         device = "rpool/root";
         fsType = "zfs";
       };
@@ -58,7 +58,7 @@ in
         fsType = "zfs";
       };
 
-      fileSystems."/boot" = lib.mkForce {
+      fileSystems."/boot" = {
         device = "/dev/disk/by-uuid/50B2-DD3F";
         fsType = "vfat";
         options = [

mkFlake.nix

@@ -1,54 +0,0 @@
-## This file contains a tweak of flake-parts's `mkFlake` function to splice in
-## sources taken from npins.
-
-## NOTE: Much of the logic in this file feels like it should be not super
-## specific to fediversity. Could it make sense to extract the core of this to
-## another place it feels closer to in spirit, such as @fricklerhandwerk's
-## flake-inputs (which this code already depends on anyway, and which already
-## contained two distinct helpers for migrating away from flakes)? cf
-## https://git.fediversity.eu/Fediversity/Fediversity/pulls/447#issuecomment-8671
-
-inputs@{ self, ... }:
-
-let
-  sources = import ./npins;
-  inherit (import sources.flake-inputs) import-flake;
-
-  # XXX(@fricklerhandwerk): this atrocity is required to splice in a foreign Nixpkgs via flake-parts
-  # XXX - this is just importing a flake
-  nixpkgs = import-flake { src = sources.nixpkgs; };
-
-  # XXX - this overrides the inputs attached to `self`
-  inputs' = self.inputs // {
-    nixpkgs = nixpkgs;
-  };
-  self' = self // {
-    inputs = inputs';
-  };
-
-  flake-parts-lib = import "${sources.flake-parts}/lib.nix" { inherit (nixpkgs) lib; };
-in
-
-flakeModule:
-
-flake-parts-lib.mkFlake
-  {
-    # XXX - finally we override the overall set of `inputs` -- we need both:
-    #       `flake-parts obtains `nixpkgs` from `self.inputs` and not from `inputs`.
-    inputs = inputs // {
-      inherit nixpkgs;
-    };
-    self = self';
-    specialArgs = {
-      inherit sources;
-    };
-  }
-  {
-    systems = [
-      "x86_64-linux"
-      "aarch64-linux"
-      "x86_64-darwin"
-      "aarch64-darwin"
-    ];
-    imports = [ flakeModule ];
-  }

secrets/forgejo-database-password.age

@@ -1,19 +1,17 @@
 age-encryption.org/v1
--> ssh-ed25519 Jpc21A bBCQmvfRUwJuIXbpVJ092XUBVszGrb6gILGbgV9j9BY
-7DEGwhqdfqMs5cxXtlMkSTPjw4qhczBgW0dmoJ6dh6g
--> ssh-ed25519 BAs8QA oiVedFC6UklEFCJUybGr93+XrddyCtV4r4TnE4nhpWI
-xasnkP4NCl9TuYSE1u0Xi0b/PiwcrfHCz2QMnpTjLcU
--> ssh-ed25519 ofQnlg LrMcWdaEUVyIgd/KznwJW/2sucIu5MuxDEcEJAmf8mA
-p6pQoisuXre2J4r6ArV6C6lKO2J/aNdBFhqLPBoZ2wA
--> ssh-ed25519 COspvA q2OGeVofPKyGCpr4Mf9VoaRvZCWTRl8n2mvkQOdTnyQ
-M+ffAGecJG/94k/Z5DdokltrZppS2IcxkZa8JKHwIMs
--> ssh-ed25519 2XrTgw Bsz/G4QderToPSfMKOR6s5yWb0xCGUlsjGJxJYQNBRc
-JYrXZb8qj1Yi9u5bnI/WzuNxy7gyFLCTIUaGNmcOYnk
--> ssh-ed25519 awJeHA KKJMQSt0PvC6P+T/kxQv96tSBdLQLiY2f8q35IwGm28
-p7Cf2HLlPl0qmsO6Hh5zwVgKkEs3A6fdSBndMKsacbk
--> ssh-ed25519 Fa25Dw 3m/qyannP4gjXxkUuO0LQRU8Z8HXOg4WReMDd7786y8
-dNMyiBGeJDrBScE9TEyZZ7+MGMG6FLuoRTK82EVeX1w
--> ssh-ed25519 i+ecmQ oCs4Ep2K75yjmUOh1ox4F25tGq+O/mZ2/c2E8+IRlEc
-0Wc9gDxhvHK5tEVM5kJ0mQXc3kp7tJ2JNHg54N0+tJ8
---- mXrqbcHxjjkS5MrQaCVm4hTsAUEENAWlIYtiYx6rtas
-ž`€úì}öÙ7Ù>­iŒbàéëÕè/&ɪŠwŽ„ì7àí[ã±Hˆc“
+-> ssh-ed25519 Jpc21A 9edPaA2tT4SeYNTPzF0E157daC2o+JH/WQQCT+vLbFg
+C48EtLdhB75TTzfEZTw1DypicHiVlSmFzjfbqfO9N/8
+-> ssh-ed25519 BAs8QA T+kXpZg1v0XRkub5DWir7vYwO7KaOJLZBNYxxXiBUCw
+zBRwMTDpyI7twEwUGsmJYyYPw9btBx5Kakj1yT+XY8U
+-> ssh-ed25519 ofQnlg 4UoEDY/tdKz8LrX1BkBU1/cn+vSaYLUl7xX9YmzANBY
+8CACq1n3AJgD9IyPN23iRvThqsfQFF5+jmkKnhun24U
+-> ssh-ed25519 COspvA HxcbkqHL+LpVmwb+Fo5JuUU+C+Pxzdxtb0yZHixwuzM
+7FIhxdbjHJlgQQgjrHHUK5cecqs5aT7X3I8TWf8c2gc
+-> ssh-ed25519 2XrTgw R6Ia8MVIZKPnNZ0rspZ34EqoY8fOLeB9H7vnvNBLg1g
+55NUqz5Yygt6FKJ3bR5iHxQp8G7S2gyFwrJNX1Pb/2Y
+-> ssh-ed25519 awJeHA hJdTuAScoewVMt7HWiisSkL0zSeClFzYzzKL84G893o
+ou780VLrW1s4d6L+lEVu3kXaGn4dvtFPA31supwEL50
+-> ssh-ed25519 Fa25Dw mJcqnXA3fQeoKrG7RJ7nVeLxPvrxqbj+lJdx6jQ9IR8
+f5Q7mrQSSDsm1Z/uSAnvx66mgnRC3XaBLQrVL9f/Ijs
+--- W/KmboXTLV12X6WtVQKHNe+ZHvS2q9EHUZwofSgJSE8
+^kûÚ	h©0ÔkÇ ¢¸_Ç·ûQÞm‘’7\òÖ}÷Áë?½qø‚<ÿm

secrets/secrets.nix

@@ -7,12 +7,11 @@ let
 
   keys = import ../keys;
   contributors = attrValues keys.contributors;
-  cd = [ keys.cd ];
 in
 
 concatMapAttrs
   (name: systems: {
-    "${name}.age".publicKeys = contributors ++ systems ++ cd;
+    "${name}.age".publicKeys = contributors ++ systems;
   })
 
   (

secrets/wiki-basicauth-htpasswd.age

@@ -1,19 +1,18 @@
 age-encryption.org/v1
--> ssh-ed25519 Jpc21A NStZFZPTHMhVCnQ5Zkbl39vWztrxfsSXok24/e8H7QQ
-JjHP6Cus76PGYYxpbnc2cSZ79zvdD8LISYDPbvXsnqU
--> ssh-ed25519 BAs8QA iocHfHjWlEUsbtibqEbYDceAqURr2vjxuYapqon9hyU
-ljL+olZdhWtHeV3uh3pOu22+sY13wPn2vKQDduPSqVs
--> ssh-ed25519 ofQnlg 9YVfMKyoP3+xtzg/ok2I9yf3YdIYoBpUJa/3d2N/8lI
-2yUalyj7O3c1YDA2xTb9QNYrFBDHwcyGBX3mydv0ifI
--> ssh-ed25519 COspvA cOSNsZXBbhQ/B49fq3KwcY6siVrTz48doTrta/0d/Hw
-jcRtVxA/tVFM9btPAPI6zKk8BwAVlaQlvHC203MpmIQ
--> ssh-ed25519 2XrTgw d3EKtYkxjeJZ8kt3ofIklGmRwUCgTIB/WVVlvxggGRk
-IhcrpWN9xFsKRw9iCfYMONPOU7TpTt4kTBNwMDtk7zo
--> ssh-ed25519 awJeHA Ei64e3+FJDM6S8NP+YfEWEg9t72qTXZ0IdZE8dYQPm4
-ggRc86sXin06eXJkLbK8CdJFDa1237WMfSgwNd5ngmM
--> ssh-ed25519 dgBsjw 9etK6tNrFlWVAKTz5U0TitkiGYLKTad3QiRWVpLPrwM
-xHLzFnRtcvpVZYZrxWz5q4uadhHrHVlfqjteOWfIccE
--> ssh-ed25519 i+ecmQ SDTnYBLMOaH173B/wqaOifE6a90gSesRqMHmX7/iZFk
-kS9tuKnMXCXNUnoZ06DisOOyZHe/mZl4a0JRA+eynE8
---- C0R5WxDDCqQGxyvFoeNX838az0bjp55PGh//1NFG4LE
-ŠÉY—±³<EFBFBD>„ÏKRÇËej±éŒ7xÑíE¹ Óì¾7jÏ
-œJý«[ÀF?Ÿ=-w‘XMC~)èÅ›ƒ<E280BA>Éõb«ëƒCÜ4ÌÖÞOwý~–¿š8ñv—ÙÜžèX»ØÆ’ƒí!5¦
+-> ssh-ed25519 Jpc21A EuMYAiZX+4A12eu19mIY7u+WYF7NJ9qJosQSVlxR6n8
+bK5CMXAmP23t1p9bgmqoVg4Qcu2qYKGc4t36v8e9eow
+-> ssh-ed25519 BAs8QA IwRyitDNTzUPzQAUbDNEKjFiF8WPD/OyztOZQeoTEzw
+OwiTWvk4NmUgExav0uH6HlThDNU5hsKXfR6KHsFOV3I
+-> ssh-ed25519 ofQnlg 3TcMbLX1JsQL8+Gqy7IFZwykZr2BspvPCuZT1SHtnQQ
+Ci5OeBj2aiC8ut9jIEUMt3qfYH+cJrnVud6AH54Ndn8
+-> ssh-ed25519 COspvA 0t9f3Wu3ILv4QTJhwT619y+7XFrryCLbpIZC6aE+qQI
+oPQP48F6oO/tkqLZDdjkGtIap7KHiAknbpTNL6/yLaU
+-> ssh-ed25519 2XrTgw YOZsaYQH9vMH0QqSXGh8GyhRV4MbcBGPFfFaKpo3Ckk
+kUShJbADA+6bpx2adxvzlI/0jSM5bIBfZfdSE/7Vm5Y
+-> ssh-ed25519 awJeHA dF3m0hQWX9c0EezDr56Kt/F4d1Uim7NwvIX6zRws0Eo
+pst243yrARODwrnyz8cJAzgDxdPOUsRbs7yPZePABFs
+-> ssh-ed25519 dgBsjw PUYHcP/tgNnKyvlIoJRcNcW3zabVV1iHXIWfKqgW9xc
+tXNjSuVH/g/oN5o75FPkFFpviF7SeFSN9kbqURvgMDE
+--- wHgBAN9c6F6T5hFJGo8uH8zqDkQDwx3/jVNKUtQ3arE
+«Ñ¢Á
+ò@µú¡fÃ`m;ÕcæäU²€ùò£Íd…eS’èyfv¿»¡€J?ø `œfj£Äa}lÃó ¿Úxç²BÇt2èfìôm08ÓoÝtRál9˜èx¤¢ŒÅž›æ÷

services/README.md

@@ -21,11 +21,11 @@ For those that know it, we could say that the current module is an analogous of
 
 ## Content of this directory
 
-- [fediversity](./fediversity) contains the definition of the services. Look in
+- [fediversity][./fediversity] contains the definition of the services. Look in
   particular at its `default.nix` that contains the definition of the options.
 
-- [vm](./vm) contains options specific to making the service run in local QEMU
+- [vm][./vm] contains options specific to making the service run in local QEMU
   VMs. These modules will for instance override the defaults to disable SSL, and
   they will add virtualisation options to forward ports, for instance.
 
-- [tests](./tests) contain full NixOS tests of the services.
+- [tests][./tests] contain full NixOS tests of the services.

services/fediversity/default.nix

@@ -65,16 +65,4 @@ in
       };
     };
   };
-
-  config = {
-    ## FIXME: This should clearly go somewhere else; and we should have a
-    ## `staging` vs. `production` setting somewhere.
-    security.acme = {
-      acceptTerms = true;
-      # use a priority more urgent than mkDefault for panel deployment to work,
-      # yet looser than default so this will not clash with the setting in tests.
-      defaults.email = lib.modules.mkOverride 200 "something@fediversity.net";
-      # defaults.server = "https://acme-staging-v02.api.letsencrypt.org/directory";
-    };
-  };
 }