update(treewide): Update to NixOS 25.11

configuration/hardware-specific/vm.nix

@@ -43,6 +43,14 @@
     source = ../../keys/hosts/staging.key;
   };
 
+  # Pretend the acme renew succeeds.
+  #
+  # TODO(tlater): Set up pebble to retrieve certs "properly"
+  # instead
+  systemd.services."acme-order-renew-tlater.net".script = ''
+    touch out/acme-success
+  '';
+
   virtualisation.vmVariant = {
     virtualisation = {
       memorySize = 3941;

configuration/nginx/ssl.nix

@@ -51,20 +51,9 @@
       paths = [ "/var/lib/acme/tlater.net" ];
     };
 
-    systemd.services = {
-      nginx.serviceConfig.SupplementaryGroups = [ config.security.acme.certs."tlater.net".group ];
-
-      # Don't attempt to retrieve a certificate if the domain name
-      # doesn't *actually* match the cert name
-      #
-      # TODO(tlater): Set up pebble to retrieve certs "properly"
-      # instead
-      "acme-tlater.net".serviceConfig.ExecCondition =
-        let
-          confirm = ''[[ "tlater.net" = "${config.services.nginx.domain}" ]]'';
-        in
-        ''${pkgs.runtimeShell} -c '${confirm}' '';
-    };
+    systemd.services.nginx.serviceConfig.SupplementaryGroups = [
+      config.security.acme.certs."tlater.net".group
+    ];
 
     sops.secrets = {
       "porkbun/api-key".owner = "acme";
@@ -85,10 +74,18 @@
 
             security.acme.certs."tlater.net".extraDomainNames = [ config.services.nginx.domain ];
 
-            services.nginx = {
-              domain = "testHost";
+            # Pretend the acme renew succeeds.
+            #
+            # TODO(tlater): Set up pebble to retrieve certs "properly"
+            # instead
+            systemd.services."acme-order-renew-tlater.net".script = ''
+              touch out/acme-success
+            '';
 
-              virtualHosts."${config.services.nginx.domain}" = {
+            services.nginx = {
+              domain = "testHost.test";
+
+              virtualHosts."${config.services.nginx.domain}.local" = {
                 useACMEHost = "tlater.net";
                 onlySSL = true;
                 enableHSTS = true;
@@ -109,6 +106,7 @@
               { pkgs, ... }:
               {
                 environment.systemPackages = [ pkgs.curl ];
+                networking.hosts."192.168.1.2" = [ "testHost.test" ];
               };
           };
 
@@ -125,7 +123,7 @@
                 "--silent",
                 "--dump-header -",
                 "--cacert /certs/tlater.net/fullchain.pem",
-                "https://testHost",
+                "https://testHost.test",
                 "-o /dev/null"
             ]))
 

configuration/services/foundryvtt.nix

@@ -23,7 +23,7 @@ in
       minifyStaticFiles = true;
       proxySSL = true;
       proxyPort = 443;
-      package = flake-inputs.foundryvtt.packages.${pkgs.system}.foundryvtt_13;
+      package = flake-inputs.foundryvtt.packages.${pkgs.stdenv.hostPlatform.system}.foundryvtt_13;
     };
 
     nginx.virtualHosts."${domain}" =

configuration/services/nextcloud.nix

@@ -5,7 +5,7 @@
   ...
 }:
 let
-  nextcloud = pkgs.nextcloud31;
+  nextcloud = pkgs.nextcloud32;
   hostName = "nextcloud.${config.services.nginx.domain}";
 in
 {
@@ -104,7 +104,7 @@ in
   };
 
   # Ensure that this service doesn't start before postgres is ready
-  systemd.services.nextcloud-setup.after = [ "postgresql.service" ];
+  systemd.services.nextcloud-setup.after = [ "postgresql.target" ];
 
   sops.secrets."nextcloud/tlater" = {
     owner = "nextcloud";

configuration/services/ntfy-sh/default.nix

@@ -17,7 +17,6 @@ in
 
   services.ntfy-sh = {
     enable = true;
-    package = flake-inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.ntfy-sh;
 
     environmentFile = config.sops.secrets."ntfy/users".path;
 

configuration/services/starbound.nix

@@ -19,7 +19,7 @@ in
 
     serviceConfig = {
       ExecStart = "${
-        flake-inputs.self.packages.${pkgs.system}.starbound
+        flake-inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.starbound
       }/bin/launch-starbound ${./configs/starbound.json}";
 
       Type = "simple";

configuration/services/webserver.nix

@@ -20,7 +20,7 @@ in
     after = [ "network.target" ];
 
     script = ''
-      ${lib.getExe flake-inputs.self.packages.${pkgs.system}.webserver}
+      ${lib.getExe flake-inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.webserver}
     '';
 
     environment = {