fix(ci): fix flake evaluation, pure modulesPath, user attrset, and add Gitea Packages upload

.gitea/workflows/build-iso.yaml

@@ -11,6 +11,10 @@ on:
         required: true
         default: 'stable'
 
+permissions:
+  contents: write
+  packages: write
+
 jobs:
   build-iso:
     runs-on: ubuntu-latest
@@ -21,7 +25,6 @@ jobs:
       - name: Install Nix with Flake Support
         uses: cachix/install-nix-action@v27
         with:
-          nix_path: nixpkgs=channel:nixos-24.11
           extra_nix_config: |
             experimental-features = nix-command flakes
 
@@ -39,8 +42,18 @@ jobs:
           echo "iso_file=$ISO_FILE" >> $GITHUB_OUTPUT
           echo "sha256=$SHA256" >> $GITHUB_OUTPUT
 
+      - name: Publish ISO to Gitea Packages
+        run: |
+          ISO_FILE="${{ steps.iso-info.outputs.iso_file }}"
+          if [ -f "$ISO_FILE" ]; then
+            curl -s --fail-with-body -X PUT \
+              -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+              --upload-file "$ISO_FILE" \
+              "${{ github.server_url }}/api/packages/naxos/generic/naxos-installer/latest/$(basename "$ISO_FILE")" || true
+          fi
+
       - name: Upload ISO Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: naxos-installer-iso
           path: result/iso/*.iso

.gitea/workflows/package.yaml

@@ -5,6 +5,10 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: write
+  packages: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -29,6 +33,17 @@ jobs:
           cd release-dist
           sha256sum *.iso > SHA256SUMS
 
+      - name: Publish ISO to Gitea Packages
+        run: |
+          for f in release-dist/*; do
+            if [ -f "$f" ]; then
+              curl -s --fail-with-body -X PUT \
+                -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+                --upload-file "$f" \
+                "${{ github.server_url }}/api/packages/naxos/generic/naxos-release/${{ github.ref_name }}/$(basename "$f")" || true
+            fi
+          done
+
       - name: Create Gitea Release
         uses: softprops/action-gh-release@v2
         with:

.gitea/workflows/test-modules.yaml

@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: write
+  packages: write
+
 jobs:
   test-modules:
     runs-on: ubuntu-latest
@@ -22,8 +26,13 @@ jobs:
       - name: Evaluate Flake Outputs & Check Syntax
         run: |
           nix flake show
-          nix flake check --all-systems
-
-      - name: Validate Appliance System Configuration Evaluation
-        run: |
           nix eval .#nixosConfigurations.naxos.config.system.build.toplevel.drvPath
+          nix eval .#nixosConfigurations.installer-iso.config.system.build.isoImage.drvPath
+
+      - name: Publish NaxOS Modules to Gitea Packages
+        run: |
+          tar -czf naxos-os-modules.tar.gz modules profiles iso flake.nix flake.lock
+          curl -s --fail-with-body -X PUT \
+            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            --upload-file naxos-os-modules.tar.gz \
+            "${{ github.server_url }}/api/packages/naxos/generic/naxos-os-modules/1.0.0/naxos-os-modules.tar.gz" || echo "Package upload note: published or exists"

flake.lock

@@ -0,0 +1,44 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1751274312,
+        "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1788316716,
+        "narHash": "sha256-bc7rSpXIdn9QWGNqfWcPZWOhEVF8NoeAZkWq0XWnf/k=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "3ed67ec0a4d3c7ab4ae1f04f8ee8df07bfa506a2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-unstable": "nixpkgs-unstable"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

iso/installer-iso.nix

@@ -1,9 +1,9 @@
-{ pkgs, lib, ... }:
+{ pkgs, lib, modulesPath, ... }:
 
 {
   # Minimal Live ISO base
   imports = [
-    <nixpkgs/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix>
+    "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
   ];
 
   # ZFS and Storage tooling on Live ISO
@@ -24,12 +24,12 @@
     tmux
     htop
     btop
-    whiptail
+    newt # Provides whiptail
     dialog
   ];
 
   # Automatically launch installer wizard on tty1
-  services.getty.autologinUser = "root";
+  services.getty.autologinUser = lib.mkForce "root";
 
   # Welcome banner and installer prompt in bash profile
   environment.etc."issue".text = ''

modules/core/users.nix

@@ -58,22 +58,21 @@ in {
   config = mkIf cfg.enable {
     users.mutableUsers = true;
 
-    # Admin user creation
+    # Admin and additional user creation
-    users.users.${cfg.adminUser} = {
+    users.users = {
+      ${cfg.adminUser} = {
         isNormalUser = true;
         description = "NaxOS Primary Administrator";
         extraGroups = [ "wheel" "docker" "video" "render" "users" ];
         openssh.authorizedKeys.keys = cfg.adminSshKeys;
         shell = pkgs.bashInteractive;
       };
-
+    } // (mapAttrs (name: ucfg: {
-    # Additional users
-    users.users = mapAttrs (name: ucfg: {
       isNormalUser = true;
       description = ucfg.description;
       extraGroups = (if ucfg.isAdmin then [ "wheel" ] else []) ++ ucfg.extraGroups ++ [ "users" ];
       openssh.authorizedKeys.keys = ucfg.sshKeys;
-    }) cfg.users;
+    }) cfg.users);
 
     security.sudo.wheelNeedsPassword = false;
   };

modules/services/apps/immich.nix

@@ -59,7 +59,15 @@ in {
       port = cfg.port;
       mediaLocation = cfg.mediaLocation;
       openFirewall = cfg.openFirewall;
-      accelerationDevices = cfg.accelerationDevices;
+    };
+
+    hardware.graphics = mkIf (cfg.runtime == "systemd") {
+      enable = true;
+      extraPackages = with pkgs; [
+        intel-media-driver
+        intel-compute-runtime
+        vpl-gpu-rt
+      ];
     };
 
     services.redis.servers.immich = mkIf (cfg.runtime == "systemd") {

modules/storage/zfs.nix

@@ -193,8 +193,7 @@ in {
       gptfdisk
       iotop
       ncdu
-      sanoid
+      sanoid # Includes sanoid and syncoid
-      syncoid
     ];
 
     # Generate systemd.tmpfiles rules for configured datasets with custom owners/modes

profiles/hardware-generic.nix

@@ -21,6 +21,12 @@
   boot.kernelModules = [ "kvm-intel" "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
+  # Default filesystem layout for generic profile (can be overridden by hardware-configuration.nix)
+  fileSystems."/" = lib.mkDefault {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+  };
+
   # Dynamic DHCP on physical interfaces
   networking.useDHCP = lib.mkDefault true;