move arguments from _module.args to specialArgs

resolves error on CI run https://git.fediversity.eu/Fediversity/Fediversity/actions/runs/1026:

```
123456       error: attempt to call something which is not a function but a path: /nix/store/93yyf22vw60l1j3l6h02c99p93lp55q5-source/panel
       at /nix/store/93yyf22vw60l1j3l6h02c99p93lp55q5-source/machines/dev/fedi201/fedipanel.nix:13:6:
           12|   imports = [
           13|     (../../../panel { }).module
             |      ^
           14|     "${sources.home-manager}/nixos"```
```

Reviewed-on: Fediversity/Fediversity#468

.forgejo/workflows/cd.yaml

@@ -13,7 +13,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Set up SSH key to access age secrets
+      - name: Set up SSH key for age secrets and SSH
         run: |
           env
           mkdir -p ~/.ssh
@@ -21,4 +21,4 @@ jobs:
           chmod 600 ~/.ssh/id_ed25519
 
       - name: Deploy
-        run: nix-shell --run 'nixops4 apply default'
+        run: nix-shell --run 'eval "$(ssh-agent -s)" && ssh-add ~/.ssh/id_ed25519 && SHELL=$(which bash) nixops4 apply -v default'

.forgejo/workflows/ci.yaml

@@ -27,6 +27,12 @@ jobs:
       - uses: actions/checkout@v4
       - run: nix build .#checks.x86_64-linux.test-mastodon-service -L
 
+  check-pixelfed:
+    runs-on: native
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix build .#checks.x86_64-linux.test-pixelfed-garage-service -L
+
   check-peertube:
     runs-on: native
     steps:

infra/README.md

@@ -1,14 +1,13 @@
 # Infra
 
-This directory contains the definition of [the VMs](machines.md) that host our
+This directory contains the definition of [the VMs](../machines/machines.md) that host our
 infrastructure.
 
 ## Provisioning VMs with an initial configuration
 
-NOTE[Niols]: This is very manual and clunky. Two things will happen. In the near
+> NOTE[Niols]: This is still very manual and clunky. Two things will happen:
-future, I will improve the provisioning script to make this a bit less clunky.
+> 1. In the near future, I will improve the provisioning script to make this a bit less clunky.
-In the far future, NixOps4 will be able to communicate with Proxmox directly and
+> 2. In the far future, NixOps4 will be able to communicate with Proxmox directly and everything will become much cleaner.
-everything will become much cleaner.
 
 1. Choose names for your VMs. It is recommended to choose `fediXXX`, with `XXX`
    above 100. For instance, `fedi117`.
@@ -25,8 +24,7 @@ everything will become much cleaner.
    Those files need to exist during provisioning, but their content matters only
    when updating the machines' configuration.
 
-   FIXME: Remove this step by making the provisioning script not fail with the
+   > FIXME: Remove this step by making the provisioning script not fail with the public key does not exist yet.
-   public key does not exist yet.
 
 3. Run the provisioning script:
    ```
@@ -44,7 +42,7 @@ everything will become much cleaner.
    ssh fedi117.abundos.eu 'sudo cat /etc/ssh/ssh_host_ed25519_key.pub' > keys/systems/fedi117.pub
    ```
 
-   FIXME: Make the provisioning script do that for us.
+   > FIXME: Make the provisioning script do that for us.
 
 7. Regenerate the list of machines:
    ```
@@ -56,7 +54,7 @@ everything will become much cleaner.
    just enough for it to boot and be reachable. Go on to the next section to
    update the machine and put an actual configuration.
 
-   FIXME: Figure out why the full configuration isn't on the machine at this
+   > FIXME: Figure out why the full configuration isn't on the machine at this
    point and fix it.
 
 ## Updating existing VM configurations

infra/common/proxmox-qemu-vm.nix

@@ -1,15 +1,4 @@
-let
+{ sources, ... }:
-  # pulling this in manually over from module args resolves an infinite recursion.
-  # FIXME: instead untangle `//infra/flake-part.nix` and make it stop passing wild functions.
-  # move moving towards a portable-services-like pattern where some things are submodules.
-  # Right now those wild functions are for parameterising a bunch of things,
-  # and the modular way to do that would be options --
-  # obviously you can't use those for `imports`,
-  # so one way to decouple fixpoints is to isolate them into submodules.
-  # Therefore one approach would be to try to go down the call graph,
-  # and see where what's currently a function could be a `submodule` field of something else.
-  sources = import ../../npins;
-in
 {
   _class = "nixos";
 

infra/common/resource.nix

@@ -58,6 +58,8 @@ in
     users.users.root.openssh.authorizedKeys.keys = attrValues keys.contributors ++ [
       # allow our panel vm access to the test machines
       keys.panel
+      # allow continuous deployment access
+      keys.cd
     ];
 
   };

infra/flake-part.nix

@@ -23,20 +23,19 @@ let
   makeResourceModule =
     { vmName, isTestVm }:
     {
-      # TODO(@fricklerhandwerk): this is terrible but IMO we should just ditch flake-parts and have our own data model for how the project is organised internally
+      nixos.module.imports = [
-      _module.args = {
+        ./common/proxmox-qemu-vm.nix
+      ];
+
+      nixos.specialArgs = {
         inherit
-          inputs
           sources
+          inputs
           keys
           secrets
           ;
       };
 
-      nixos.module.imports = [
-        ./common/proxmox-qemu-vm.nix
-      ];
-
       imports =
         [
           ./common/resource.nix
@@ -66,17 +65,39 @@ let
     vmNames:
     { providers, ... }:
     {
-      providers.local = inputs.nixops4.modules.nixops4Provider.local;
+      # XXX: this type merge is for adding `specialArgs` to resource modules
-      resources = genAttrs vmNames (vmName: {
+      options.resources = mkOption {
-        type = providers.local.exec;
+        type =
-        imports = [
+          with lib.types;
-          inputs.nixops4-nixos.modules.nixops4Resource.nixos
+          lazyAttrsOf (submoduleWith {
-          (makeResourceModule {
+            class = "nixops4Resource";
-            inherit vmName;
+            modules = [ ];
-            isTestVm = false;
+            # TODO(@fricklerhandwerk): we may want to pass through all of `specialArgs`
-          })
+            # once we're sure it's sane. leaving it here for better control during refactoring.
-        ];
+            specialArgs = {
-      });
+              inherit
+                sources
+                inputs
+                keys
+                secrets
+
+                ;
+            };
+          });
+      };
+      config = {
+        providers.local = inputs.nixops4.modules.nixops4Provider.local;
+        resources = genAttrs vmNames (vmName: {
+          type = providers.local.exec;
+          imports = [
+            inputs.nixops4-nixos.modules.nixops4Resource.nixos
+            (makeResourceModule {
+              inherit vmName;
+              isTestVm = false;
+            })
+          ];
+        });
+      };
     };
   makeDeployment' = vmName: makeDeployment [ vmName ];
 

machines/dev/fedi201/fedipanel.nix

@@ -1,17 +1,17 @@
 {
   config,
+  sources,
   ...
 }:
 let
   name = "panel";
-  sources = import ../../../npins;
 in
 {
   _class = "nixos";
 
   imports = [
     (import ../../../panel { }).module
-    (import "${sources.home-manager}/nixos")
+    "${sources.home-manager}/nixos"
   ];
 
   security.acme = {

panel/default.nix

@@ -45,7 +45,7 @@ in
     '';
   };
 
-  module = import ./nix/configuration.nix;
+  module = ./nix/configuration.nix;
   tests = pkgs.callPackage ./nix/tests.nix { };
 
   # re-export inputs so they can be overridden granularly

services/tests/pixelfed-garage.nix

@@ -113,6 +113,7 @@ let
 
         ${seleniumQuit}'';
 
+  dummyFile = pkgs.writeText "dummy" "dummy";
 in
 {
   name = "test-pixelfed-garage";
@@ -170,6 +171,12 @@ in
         users.users.selenium = {
           isNormalUser = true;
         };
+        fediversity.temp.initialUser = {
+          username = "dummy";
+          displayName = "dummy";
+          email = "dummy";
+          passwordFile = dummyFile;
+        };
       };
   };