From d5d9aeeab202ff5b0a6d98232b7a26ca355d89cd Mon Sep 17 00:00:00 2001
From: Aria <me@aria.rip>
Date: Fri, 12 Jun 2026 13:25:19 +0100
Subject: [PATCH] heather, lavender: use stable nixpkgs

---
 nix/hive.nix                          | 43 ++++++++++++++++++++-------
 nix/hosts/code/pds.nix                |  2 ++
 nix/modules/prefs/nix.nix             |  7 +++--
 nix/modules/services/tranquil-pds.nix |  9 +-----
 nix/npins/sources.json                | 15 +++++++---
 nix/packages.nix                      |  2 +-
 nix/secrets.nix                       |  2 +-
 7 files changed, 53 insertions(+), 27 deletions(-)

diff --git a/nix/hive.nix b/nix/hive.nix
index 0a672e2..d769681 100644
--- a/nix/hive.nix
+++ b/nix/hive.nix
@@ -1,16 +1,29 @@
 let
   inputs = import ./npins;
-  pkgsFor =
-    system:
-    import inputs.nixpkgs {
+  nixpkgsLib = import "${inputs.nixos}/lib";
+  lib = import ./lib.nix lib nixpkgsLib;
+
+  inherit (lib) mkDefault;
+
+  # unstable nixos is the default for me, but a couple machines use stable
+  # as i want to rebuild them less often.
+  specificPkgsFor =
+    nixos: system:
+    import nixos {
       inherit system;
       overlays = [ (import ./pkgs/default.nix inputs) ];
     };
+  pkgsFor = specificPkgsFor inputs.nixos;
+  stablePkgsFor = specificPkgsFor inputs.nixos-stable;
 
-  nixpkgsLib = import "${inputs.nixpkgs}/lib";
-  lib = import ./lib.nix lib nixpkgsLib;
+  # modules that set nixpkgs.flake.source. TODO: this needs to be kept in sync manually, which sucks
+  unstableNixos = {
+    nixpkgs.flake.source = mkDefault inputs.nixos;
+  };
+  stableNixos = {
+    nixpkgs.flake.source = inputs.nixos-stable;
+  };
 
-  inherit (lib) mkDefault;
 in
 {
   meta = {
@@ -18,7 +31,8 @@ in
     specialArgs = { inherit lib inputs; };
 
     nodeNixpkgs = {
-      lavender = pkgsFor "aarch64-linux";
+      heather = stablePkgsFor "x86_64-linux";
+      lavender = stablePkgsFor "aarch64-linux";
     };
   };
 
@@ -30,7 +44,10 @@ in
         allowLocalDeployment = true;
         buildOnTarget = true;
       };
-      imports = [ ./modules/default.nix ];
+      imports = [
+        ./modules/default.nix
+        unstableNixos
+      ];
     };
 
   avarna = {
@@ -42,8 +59,14 @@ in
     imports = [ ./hosts/clovis.nix ];
   };
 
-  heather.imports = [ ./hosts/heather ];
+  heather.imports = [
+    ./hosts/heather
+    stableNixos
+  ];
   misc.imports = [ ./hosts/misc ];
   code.imports = [ ./hosts/code ];
-  lavender.imports = [ ./hosts/lavender ];
+  lavender.imports = [
+    ./hosts/lavender
+    stableNixos
+  ];
 }
diff --git a/nix/hosts/code/pds.nix b/nix/hosts/code/pds.nix
index 3a567f8..47ea5c2 100644
--- a/nix/hosts/code/pds.nix
+++ b/nix/hosts/code/pds.nix
@@ -5,9 +5,11 @@
   ...
 }:
 {
+  age.secrets.pds-env.file = ../../secrets/pds-env.age;
   services.tranquil-pds = {
     enable = true;
     database.createLocally = true;
+    environmentFiles = [ config.age.secrets.pds-env.path ];
     settings = {
       server = {
         host = "0.0.0.0";
diff --git a/nix/modules/prefs/nix.nix b/nix/modules/prefs/nix.nix
index 9e31244..88b296c 100644
--- a/nix/modules/prefs/nix.nix
+++ b/nix/modules/prefs/nix.nix
@@ -57,7 +57,7 @@ in
 
       (mkIf cfg.pathSetup {
         channel.enable = false;
-        nixPath = [ "nixpkgs=${inputs.nixpkgs.outPath}" ];
+        nixPath = [ "nixpkgs=${config.nixpkgs.flake.source}" ];
 
         # Enable flakes, but with the only registry entries being our pinned inputs.
         settings = {
@@ -66,7 +66,7 @@ in
             "flakes"
           ];
           flake-registry = "";
-          nix-path = "nixpkgs=${inputs.nixpkgs.outPath}";
+          nix-path = "nixpkgs=${config.nixpkgs.flake.source}";
         };
         registry = mkIf cfg.pathSetup (
           mapAttrs
@@ -84,8 +84,9 @@ in
               }
             )
             {
+              nixpkgs = config.nixpkgs.flake.source;
+              nixos = config.nixpkgs.flake.source;
               inherit (inputs)
-                nixpkgs
                 disko
                 impermanence
                 lanzaboote
diff --git a/nix/modules/services/tranquil-pds.nix b/nix/modules/services/tranquil-pds.nix
index a5f5145..e637479 100644
--- a/nix/modules/services/tranquil-pds.nix
+++ b/nix/modules/services/tranquil-pds.nix
@@ -8,13 +8,6 @@ let
   inherit (lib) mkIf mkDefault;
   cfg = config.services.tranquil-pds;
 in
-mkIf cfg.enable {
-  age.secrets.pds-env.file = ../../secrets/pds-env.age;
-  services.tranquil-pds = {
-    package = mkDefault pkgs.tranquil-pds;
-    settings.frontend.dir = mkDefault pkgs.tranquil-pds-frontend;
-    environmentFiles = [ config.age.secrets.pds-env.path ];
-  };
-
+mkIf (config.services ? tranquil-pds && cfg.enable) {
   environment.persistence."/persist".directories = [ cfg.dataDir ];
 }
diff --git a/nix/npins/sources.json b/nix/npins/sources.json
index 820babb..2a5e73e 100644
--- a/nix/npins/sources.json
+++ b/nix/npins/sources.json
@@ -55,6 +55,13 @@
       "url": "https://github.com/nix-community/lanzaboote/archive/0403b4b7e8b2612657f0053a4c315e6c43eee9e6.tar.gz",
       "hash": "sha256-4JLkQvN7/f77TyxXXtoEuUfovMqMLOgWpBaLMNX1dns="
     },
+    "nixos": {
+      "type": "Channel",
+      "name": "nixos-unstable",
+      "artifact": "nixexprs.tar.xz",
+      "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1014179.9ae611a455b9/nixexprs.tar.xz",
+      "hash": "sha256-d34lhgOet4IqYMnCxbIvwFBMOyTV6PT4TyNEOP0/ZhU="
+    },
     "nixos-hardware": {
       "type": "Git",
       "repository": {
@@ -68,12 +75,12 @@
       "url": "https://github.com/NixOS/nixos-hardware/archive/6358ff76821101c178e3ab4919a62799bfe3652e.tar.gz",
       "hash": "sha256-LOnLQ2tpYF9gqIDDr3+j3DbpJJr/QCH6zPRT2GzEUOE="
     },
-    "nixpkgs": {
+    "nixos-stable": {
       "type": "Channel",
-      "name": "nixpkgs-unstable",
+      "name": "nixos-26.05",
       "artifact": "nixexprs.tar.xz",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1015022.8c91a71d1345/nixexprs.tar.xz",
-      "hash": "sha256-zqS1Hjp9o14nN/YhXu/uqm36ot058fF9wmd7/H/hRKc="
+      "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.1550.bd0ff2d3eac2/nixexprs.tar.xz",
+      "hash": "sha256-YMnBf9lk/LYgvqfmSSJuOGigtRs5Lsy26pJHVlR9yMY="
     },
     "tangled": {
       "type": "GitRelease",
diff --git a/nix/packages.nix b/nix/packages.nix
index 5f7b49e..d235df2 100644
--- a/nix/packages.nix
+++ b/nix/packages.nix
@@ -1,6 +1,6 @@
 {
   inputs ? import ./npins,
-  pkgs ? import inputs.nixpkgs { overlays = [ (import ./pkgs/default.nix inputs) ]; },
+  pkgs ? import inputs.nixos { overlays = [ (import ./pkgs/default.nix inputs) ]; },
 }:
 {
   inherit (pkgs)
diff --git a/nix/secrets.nix b/nix/secrets.nix
index 6c9255e..c67f849 100644
--- a/nix/secrets.nix
+++ b/nix/secrets.nix
@@ -1,6 +1,6 @@
 let
   inputs = import ./npins;
-  nixpkgsLib = import "${inputs.nixpkgs}/lib";
+  nixpkgsLib = import "${inputs.nixos}/lib";
   lib = import ./lib.nix lib nixpkgsLib;
 
   inherit (lib.our) hostKeys ageKeys;
-- 
2.51.2