Waybar here i come (#58)

server-modules/arr.nix

@@ -8,6 +8,7 @@ in {
   sops.secrets = {
     recyclarr = {
       owner = "recyclarr";
+      # TODO: too permissive (world-writable), should be 0600/0400
       mode = "0777";
     };
     wireguard-pia = {

server-modules/awesome-wallpapers.nix

@@ -11,11 +11,11 @@ in {
       name = "wallpapers";
       hostIp = "10.233.4.1";
       containerIp = "10.233.4.2";
-      nixosConfig = {pkgs, ...}: {
+      nixosConfig = {pkgs-unstable, ...}: {
         services.nginx = {
           enable = true;
           virtualHosts."wallpapers" = {
-            root = "${inputs.awesome-wallpapers.packages.${pkgs.stdenv.hostPlatform.system}.default}/share/awesome-wallpapers";
+            root = "${inputs.awesome-wallpapers.packages.${pkgs-unstable.stdenv.hostPlatform.system}.default}/share/awesome-wallpapers";
             listen = [
               {
                 addr = "0.0.0.0";

server-modules/blog.nix

@@ -12,12 +12,12 @@ in {
       name = "blog";
       hostIp = "10.233.3.1";
       containerIp = "10.233.3.2";
-      nixosConfig = {pkgs, ...}: {
+      nixosConfig = {pkgs-unstable, ...}: {
         services.nginx = {
           enable = true;
           virtualHosts = {
             "blog" = {
-              root = "${inputs.blog.packages.${pkgs.stdenv.hostPlatform.system}.default}/share/blog";
+              root = "${inputs.blog.packages.${pkgs-unstable.stdenv.hostPlatform.system}.default}/share/blog";
               listen = [
                 {
                   addr = "0.0.0.0";

server-modules/cloudflared.nix

@@ -2,7 +2,7 @@
 # It allows exposing services securely via Cloudflare Tunnel
 {
   config,
-  pkgs,
+  pkgs-unstable,
   ...
 }: {
   sops.secrets.cloudflared-token.mode = "0400";
@@ -20,7 +20,7 @@
     };
   };
 
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs-unstable; [
     cloudflared
   ];
 

server-modules/cyberchef.nix

@@ -10,11 +10,11 @@ in {
       name = "cyberchef";
       hostIp = "10.233.5.1";
       containerIp = "10.233.5.2";
-      nixosConfig = {pkgs, ...}: {
+      nixosConfig = {pkgs-unstable, ...}: {
         services.nginx = {
           enable = true;
           virtualHosts."cyberchef" = {
-            root = "${pkgs.cyberchef}/share/cyberchef";
+            root = "${pkgs-unstable.cyberchef}/share/cyberchef";
             listen = [
               {
                 addr = "0.0.0.0";

server-modules/gitea.nix

@@ -1,12 +1,12 @@
 {
   config,
-  pkgs,
+  pkgs-unstable,
   lib,
   ...
 }: let
   inherit (import ./mk-container.nix {inherit lib config;}) mkContainer;
   domain = config.var.domain;
-  catppuccin-gitea = pkgs.fetchzip {
+  catppuccin-gitea = pkgs-unstable.fetchzip {
     url = "https://github.com/catppuccin/gitea/releases/download/v1.0.2/catppuccin-gitea.tar.gz";
     sha256 = "sha256-rZHLORwLUfIFcB6K9yhrzr+UwdPNQVSadsw6rg8Q7gs=";
     stripRoot = false;

server-modules/glance/default.nix

@@ -83,6 +83,7 @@
   c = config.stylix.base16Scheme;
 in {
   # 0444 so the glance user inside the container can read the bind-mounted file
+  # TODO: too broad (world-readable), scope to the container's mapped uid/gid instead
   sops.secrets.adguard-pwd.mode = "0444";
 
   imports = [

server-modules/mazanoke.nix

@@ -10,12 +10,12 @@ in {
       name = "mazanoke";
       hostIp = "10.233.7.1";
       containerIp = "10.233.7.2";
-      nixosConfig = {pkgs, ...}: let
+      nixosConfig = {pkgs-unstable, ...}: let
         version = "1.1.5";
-        mazanoke-pkg = pkgs.stdenv.mkDerivation {
+        mazanoke-pkg = pkgs-unstable.stdenv.mkDerivation {
           inherit version;
           pname = "mazanoke";
-          src = pkgs.fetchFromGitHub {
+          src = pkgs-unstable.fetchFromGitHub {
             owner = "civilblur";
             repo = "mazanoke";
             rev = "v${version}";