update to 22.11

profiles/cachix/default.nix

@@ -7,5 +7,5 @@ let
 in
 {
   inherit imports;
-  nix.binaryCaches = [ "https://cache.nixos.org/" ];
+  nix.settings.substituters = [ "https://cache.nixos.org/" ];
 }

profiles/cachix/nix-community.nix

@@ -1,10 +1,12 @@
 {
   nix = {
-    binaryCaches = [
-      "https://nix-community.cachix.org"
-    ];
-    binaryCachePublicKeys = [
-      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-    ];
+    settings = {
+      substituters = [
+        "https://nix-community.cachix.org"
+      ];
+      trusted-public-keys = [
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      ];
+    };
   };
 }

profiles/cachix/nrdxp.nix

@@ -1,10 +1,12 @@
 {
   nix = {
-    binaryCaches = [
-      "https://nrdxp.cachix.org"
-    ];
-    binaryCachePublicKeys = [
-      "nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4="
-    ];
+    settings = {
+      substituters = [
+        "https://nrdxp.cachix.org"
+      ];
+      trusted-public-keys = [
+        "nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4="
+      ];
+    };
   };
 }

profiles/core/default.nix

@@ -4,7 +4,7 @@ in
 {
   imports = [ ../cachix ];
 
-  nix.systemFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+  nix.settings.system-features = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
 
   fonts = {
     fonts = with pkgs; [ powerline-fonts dejavu_fonts ];
@@ -15,12 +15,14 @@ in
   };
 
   nix = {
-    autoOptimiseStore = true;
+    settings = {
+      sandbox = true;
+      trusted-users = [ "root" "@wheel" ];
+      allowed-users = [ "@wheel" ];
+      auto-optimise-store = true;
+    };
     gc.automatic = true;
     optimise.automatic = true;
-    useSandbox = true;
-    allowedUsers = [ "@wheel" ];
-    trustedUsers = [ "root" "@wheel" ];
     extraOptions = ''
       min-free = 536870912
       keep-outputs = true

profiles/freshrss/default.nix

@@ -1,14 +1,15 @@
 { config, lib, pkgs, ... }:
 
 {
+  age.secrets.freshrss-dbpass.file = "${self}/secrets/freshrss-dbpass.age";
+  age.secrets.freshrss-dbpass.owner = "freshrss";
   services.freshrss = {
     enable = true;
     virtualHost = "rss.sealight.xyz";
     baseUrl = "https://rss.sealight.xyz/";
     database = {
       type = "pgsql";
-      # passwordFile = "/run/secrets/gitea-dbpass"; # TODO supplied by agenix
-      passFile = "/run/secrets/freshrss-dbpass";
+      passFile = "/run/agenix/freshrss-dbpass";
     };
   };