.git-blame-ignore-revs

@@ -1,2 +0,0 @@
-# Switch to nixfmt formatting
-82c1d22d3dd74fb5da489162a9d4caba9ab3baba

flake.lock

@@ -2,18 +2,16 @@
   "nodes": {
     "dream2nix": {
       "inputs": {
-        "nixpkgs": [
+        "nixpkgs": "nixpkgs",
-          "nixpkgs"
-        ],
         "purescript-overlay": "purescript-overlay",
         "pyproject-nix": "pyproject-nix"
       },
       "locked": {
-        "lastModified": 1763413832,
+        "lastModified": 1735160684,
-        "narHash": "sha256-dkqBwDXiv8MPoFyIvOuC4bVubAP+TlVZUkVMB78TTSg=",
+        "narHash": "sha256-n5CwhmqKxifuD4Sq4WuRP/h5LO6f23cGnSAuJemnd/4=",
         "owner": "nix-community",
         "repo": "dream2nix",
-        "rev": "5658fba3a0b6b7d5cb0460b949651f64f644a743",
+        "rev": "8ce6284ff58208ed8961681276f82c2f8f978ef4",
         "type": "github"
       },
       "original": {
@@ -30,11 +28,11 @@
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1763621140,
+        "lastModified": 1737181903,
-        "narHash": "sha256-nx0zy/+yR57FwloXmatf3CaXgzA4zJqIFbplnpaKn/Y=",
+        "narHash": "sha256-lvp77MhGzSN+ICd0MugppCjQR6cmlM2iAC5cjy2ZsaA=",
         "owner": "nix-community",
         "repo": "fenix",
-        "rev": "d4e14d370b4763c67ea02a39f01f5366297d61cb",
+        "rev": "ac79bb490b8c1af4bbc587b84c76f9527d6b14f7",
         "type": "github"
       },
       "original": {
@@ -61,15 +59,34 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1763334038,
+        "lastModified": 1729850857,
-        "narHash": "sha256-3FzFzhmeuKK2dLv6pm6rC1QTcukVe+xcLpKOrE5Fx5g=",
+        "narHash": "sha256-WvLXzNNnnw+qpFOmgaM3JUlNEH+T4s22b5i2oyyCpXE=",
-        "rev": "4c8cdd5b1a630e8f72c9dd9bf582b1afb3127d2c",
+        "owner": "NixOS",
-        "type": "tarball",
+        "repo": "nixpkgs",
-        "url": "https://releases.nixos.org/nixos/25.05/nixos-25.05.812880.4c8cdd5b1a63/nixexprs.tar.xz?lastModified=1763334038&rev=4c8cdd5b1a630e8f72c9dd9bf582b1afb3127d2c"
+        "rev": "41dea55321e5a999b17033296ac05fe8a8b5a257",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
+        "owner": "NixOS",
-        "url": "https://channels.nixos.org/nixos-25.05/nixexprs.tar.xz"
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1737165118,
+        "narHash": "sha256-s40Kk/OulP3J/1JvC3VT16U4r/Xw6Qdi7SRw3LYkPWs=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "6a3ae7a5a12fb8cac2d59d7df7cbd95f9b2f0566",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "purescript-overlay": {
@@ -96,22 +113,18 @@
       }
     },
     "pyproject-nix": {
-      "inputs": {
+      "flake": false,
-        "nixpkgs": [
-          "dream2nix",
-          "nixpkgs"
-        ]
-      },
       "locked": {
-        "lastModified": 1752481895,
+        "lastModified": 1702448246,
-        "narHash": "sha256-luVj97hIMpCbwhx3hWiRwjP2YvljWy8FM+4W9njDhLA=",
+        "narHash": "sha256-hFg5s/hoJFv7tDpiGvEvXP0UfFvFEDgTdyHIjDVHu1I=",
-        "owner": "pyproject-nix",
+        "owner": "davhau",
         "repo": "pyproject.nix",
-        "rev": "16ee295c25107a94e59a7fc7f2e5322851781162",
+        "rev": "5a06a2697b228c04dd2f35659b4b659ca74f7aeb",
         "type": "github"
       },
       "original": {
-        "owner": "pyproject-nix",
+        "owner": "davhau",
+        "ref": "dream2nix",
         "repo": "pyproject.nix",
         "type": "github"
       }
@@ -120,17 +133,17 @@
       "inputs": {
         "dream2nix": "dream2nix",
         "fenix": "fenix",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs_2"
       }
     },
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1763555010,
+        "lastModified": 1737140097,
-        "narHash": "sha256-SG8PRrLir8RkXdyBm/NnuUo3WqS7HW6ltJLZnAWjBjA=",
+        "narHash": "sha256-m4SN8DeKzsP10EQFS7+2zgGfCrMhTfTt1H0QRNesD08=",
         "owner": "rust-lang",
         "repo": "rust-analyzer",
-        "rev": "636c3aa24ec6762347c334c030b5034c351d6e05",
+        "rev": "f61bfa4d7feb84d07538d361fe77d34a29e3b375",
         "type": "github"
       },
       "original": {

flake.nix

@@ -2,11 +2,8 @@
   description = "tlater.net web server";
 
   inputs = {
-    nixpkgs.url = "https://channels.nixos.org/nixos-25.05/nixexprs.tar.xz";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
-    dream2nix = {
+    dream2nix.url = "github:nix-community/dream2nix";
-      url = "github:nix-community/dream2nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
 
     fenix = {
       url = "github:nix-community/fenix";
@@ -14,77 +11,70 @@
     };
   };
 
-  outputs =
+  outputs = {
-    {
+    self,
-      self,
+    nixpkgs,
-      nixpkgs,
+    dream2nix,
-      dream2nix,
+    fenix,
-      fenix,
+  }: let
-    }:
+    # At the moment, we only deploy to x86_64-linux. Update when we
-    let
+    # care about another platform.
-      # At the moment, we only deploy to x86_64-linux. Update when we
+    system = "x86_64-linux";
-      # care about another platform.
+    pkgs = nixpkgs.legacyPackages.${system};
-      system = "x86_64-linux";
+    fenixPkgs = fenix.packages.${system};
-      pkgs = nixpkgs.legacyPackages.${system};
+    ownPkgs = self.packages.${system};
-      fenixPkgs = fenix.packages.${system};
+  in {
-      ownPkgs = self.packages.${system};
+    packages.${system} = dream2nix.lib.importPackages {
-    in
+      projectRoot = ./.;
-    {
+      projectRootFile = "flake.nix";
-      packages.${system} = dream2nix.lib.importPackages {
+      packagesDir = ./packages;
-        projectRoot = ./.;
+      packageSets = {
-        projectRootFile = "flake.nix";
+        nixpkgs = pkgs;
-        packagesDir = ./packages;
+        fenix = fenixPkgs;
-        packageSets = {
-          nixpkgs = pkgs;
-          fenix = fenixPkgs;
-        };
       };
-
-      apps.${system} = {
-        default =
-          let
-            inherit (ownPkgs) server templates;
-            inherit (pkgs) writeShellScript;
-          in
-          {
-            type = "app";
-            program = builtins.toString (
-              writeShellScript "tlaternet-webserver" ''
-                ${server}/bin/tlaternet-webserver --template-directory ${templates}
-              ''
-            );
-          };
-
-        update =
-          let
-            update-script = pkgs.callPackage ./nix/update.nix { inherit self; };
-          in
-          {
-            type = "app";
-            program = "${update-script}/bin/update";
-          };
-      };
-
-      nixosModules.default = import ./nix/module.nix { inherit self system; };
-
-      devShells.${system} = {
-        server = pkgs.mkShell {
-          packages = [
-            (fenixPkgs.stable.withComponents [
-              "rustc"
-              "cargo"
-              "rustfmt"
-              "rust-std"
-              "rust-docs"
-              "clippy"
-              "rust-src"
-              "rust-analysis"
-            ])
-            fenixPkgs.rust-analyzer
-          ];
-        };
-      };
-
-      checks.${system} = import ./nix/checks { inherit self pkgs; };
     };
+
+    apps.${system} = {
+      default = let
+        inherit (ownPkgs) server templates;
+        inherit (pkgs) writeShellScript;
+      in {
+        type = "app";
+        program = builtins.toString (writeShellScript "tlaternet-webserver" ''
+          ${server}/bin/tlaternet-webserver --template-directory ${templates}
+        '');
+      };
+
+      update = let
+        update-script = pkgs.callPackage ./nix/update.nix {inherit self;};
+      in {
+        type = "app";
+        program = "${update-script}/bin/update";
+      };
+    };
+
+    nixosModules.default = import ./nix/module.nix {inherit self system;};
+
+    devShells.${system} = {
+      server = pkgs.mkShell {
+        packages = [
+          (fenixPkgs.stable.withComponents [
+            "rustc"
+            "cargo"
+            "rustfmt"
+            "rust-std"
+            "rust-docs"
+            "clippy"
+            "rust-src"
+            "rust-analysis"
+          ])
+          fenixPkgs.rust-analyzer
+        ];
+      };
+    };
+
+    checks.${system} = import ./nix/checks {
+      inherit self pkgs;
+    };
+  };
 }

nix/checks/default.nix

@@ -1,8 +1,9 @@
-{ pkgs, self }:
-let
-  callPackage = pkgs.lib.callPackageWith (pkgs // { inherit self; });
-in
 {
-  lintNix = callPackage ./lint-nix.nix { };
+  pkgs,
-  openHomepage = callPackage ./open-homepage.nix { };
+  self,
+}: let
+  callPackage = pkgs.lib.callPackageWith (pkgs // {inherit self;});
+in {
+  lintNix = callPackage ./lint-nix.nix {};
+  openHomepage = callPackage ./open-homepage.nix {};
 }

nix/checks/lint-nix.nix

@@ -2,31 +2,26 @@
   self,
   lib,
   stdenv,
-  nixfmt-rfc-style,
+  alejandra,
   deadnix,
   statix,
-}:
+}: let
-let
   inherit (lib) sourceFilesBySuffices;
 in
-stdenv.mkDerivation {
+  stdenv.mkDerivation {
-  dontPatch = true;
+    dontPatch = true;
-  dontConfigure = true;
+    dontConfigure = true;
-  dontBuild = true;
+    dontBuild = true;
-  dontInstall = true;
+    dontInstall = true;
-  doCheck = true;
+    doCheck = true;
 
-  name = "lint-nix";
+    name = "lint-nix";
-  src = sourceFilesBySuffices self [ ".nix" ];
+    src = sourceFilesBySuffices self [".nix"];
-  checkInputs = [
+    checkInputs = [alejandra deadnix statix];
-    nixfmt-rfc-style
+    checkPhase = ''
-    deadnix
+      mkdir -p $out
-    statix
+      alejandra --check . | tee $out/alejandra.log
-  ];
+      deadnix --fail | tee $out/deadnix.log
-  checkPhase = ''
+      statix check | tee $out/statix.log
-    mkdir -p $out
+    '';
-    nixfmt --strict --check . | tee $out/nixfmt.log
+  }
-    deadnix --fail | tee $out/deadnix.log
-    statix check | tee $out/statix.log
-  '';
-}

nix/checks/open-homepage.nix

@@ -1,16 +1,19 @@
-{ self, nixosTest }:
+{
+  self,
+  nixosTest,
+}:
 nixosTest {
   name = "open-homepage";
 
   nodes = {
     # Host with just the default configuration
     defaults = {
-      imports = [ self.nixosModules.default ];
+      imports = [self.nixosModules.default];
       services.tlaternet-webserver.enable = true;
     };
 
     host = {
-      imports = [ self.nixosModules.default ];
+      imports = [self.nixosModules.default];
 
       services.tlaternet-webserver = {
         enable = true;
@@ -20,10 +23,10 @@ nixosTest {
         };
       };
 
-      networking.firewall.allowedTCPPorts = [ 8080 ];
+      networking.firewall.allowedTCPPorts = [8080];
     };
 
-    client = { };
+    client = {};
   };
 
   testScript = ''

nix/module.nix

@@ -1,14 +1,18 @@
-{ self, system }:
+{
-{ config, lib, ... }:
+  self,
-let
+  system,
+}: {
+  config,
+  lib,
+  ...
+}: let
   inherit (lib) mkEnableOption mkIf mkOption;
   inherit (lib.types) str int;
   inherit (lib.strings) escapeShellArgs;
   inherit (self.packages.${system}) server templates;
 
   cfg = config.services.tlaternet-webserver;
-in
+in {
-{
   options = {
     services.tlaternet-webserver = {
       enable = mkEnableOption "tlaternet web server";
@@ -31,8 +35,8 @@ in
   config = mkIf cfg.enable {
     systemd.services.tlaternet-webserver = {
       description = "tlaternet webserver";
-      wantedBy = [ "multi-user.target" ];
+      wantedBy = ["multi-user.target"];
-      after = [ "network.target" ];
+      after = ["network.target"];
 
       script = escapeShellArgs [
         "${server}/bin/tlaternet-webserver"
@@ -56,21 +60,14 @@ in
         ProtectKernelModules = true;
         ProtectKernelLogs = true;
         ProtectControlGroups = true;
-        RestrictAddressFamilies = [
+        RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
-          "AF_UNIX"
-          "AF_INET"
-          "AF_INET6"
-        ];
         RestrictNamespaces = true;
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
-        SystemCallFilter = [
+        SystemCallFilter = ["@system-service" "~@privileged @resources @setuid @keyring"];
-          "@system-service"
-          "~@privileged @resources @setuid @keyring"
-        ];
       };
     };
   };

nix/update.nix

@@ -6,25 +6,20 @@
   git,
   nix,
   yq-go,
-}:
+}: let
-let
   selfPackages = self.packages.${system};
   inherit (selfPackages.server.config.deps) cargo;
   inherit (selfPackages.templates.config.deps) npm;
 
   npm-check-updates =
-    (builtins.elemAt (lib.attrValues selfPackages.templates.config.nodejs-granular-v3.deps.npm-check-updates) 0)
+    (builtins.elemAt (lib.attrValues
-    .package-func.result;
+      selfPackages.templates.config.nodejs-granular-v3.deps.npm-check-updates)
+    0)
+    .package-func
+    .result;
 in
-writeShellApplication {
+  writeShellApplication {
-  name = "update";
+    name = "update";
-  runtimeInputs = [
+    runtimeInputs = [cargo git nix npm npm-check-updates yq-go];
-    cargo
+    text = builtins.readFile ./scripts/update.sh;
-    git
+  }
-    nix
-    npm
-    npm-check-updates
-    yq-go
-  ];
-  text = builtins.readFile ./scripts/update.sh;
-}

packages/server/default.nix

@@ -1,26 +1,16 @@
-{ dream2nix, lib, ... }:
+{dream2nix, ...}: {
-{
   imports = [
     dream2nix.modules.dream2nix.rust-cargo-lock
     dream2nix.modules.dream2nix.rust-cargo-vendor
     dream2nix.modules.dream2nix.rust-crane
   ];
 
-  deps =
+  deps = {fenix, ...}: {
-    { fenix, ... }:
+    deps.cargo = fenix.stable.minimalToolchain;
-    {
+  };
-      deps.cargo = fenix.stable.minimalToolchain;
-    };
 
-  inherit
+  name = "tlaternet-webserver";
-    ((lib.pipe ./Cargo.toml [
+  version = "0.1.0";
-      builtins.readFile
-      builtins.fromTOML
-    ]).package
-    )
-    name
-    version
-    ;
 
   mkDerivation = {
     src = ./.;

packages/templates/default.nix

@@ -3,37 +3,28 @@
   config,
   lib,
   ...
-}:
+}: {
-{
   imports = [
     dream2nix.modules.dream2nix.nodejs-package-json-v3
     dream2nix.modules.dream2nix.nodejs-granular-v3
     dream2nix.modules.dream2nix.nodejs-devshell-v3
   ];
 
-  deps =
+  deps = {nixpkgs, ...}: {
-    { nixpkgs, ... }:
+    inherit (nixpkgs) pkg-config runCommandLocal rsync vips yj;
-    {
+  };
-      inherit (nixpkgs)
-        pkg-config
-        runCommandLocal
-        rsync
-        vips
-        yj
-        ;
-    };
 
   name = "tlaternet-templates";
   version = "0.1.0";
 
   mkDerivation = {
-    src = config.deps.runCommandLocal "source" { nativeBuildInputs = [ config.deps.yj ]; } ''
+    src = config.deps.runCommandLocal "source" {nativeBuildInputs = [config.deps.yj];} ''
       cp -r ${./.} $out/
       chmod -R u+w $out
       yj < $out/package.yaml > $out/package.json
     '';
 
-    nativeBuildInputs = [ config.deps.yj ];
+    nativeBuildInputs = [config.deps.yj];
 
     # The default phase (which is hidden in `preInstallPhases`) will
     # copy the full node_modules directory to the output, and symlink
@@ -41,7 +32,7 @@
     #
     # Since this package's output is static HTML/JS, we do not want
     # that.
-    preInstallPhases = lib.mkForce [ ];
+    preInstallPhases = lib.mkForce [];
     installPhase = ''
       cp -r dist $out
     '';