feature: port the entire project to k3s

devenv.nix

@@ -0,0 +1,41 @@
+{ pkgs, ... }:
+
+let
+  # nixpkgs' rootless podman ships without /etc/containers config, so short
+  # names (nginx:1.29-alpine) and the signature policy can't resolve. These are
+  # the two files podman looks for under ~/.config/containers.
+  registriesConf = pkgs.writeText "registries.conf" ''
+    unqualified-search-registries = ["docker.io"]
+  '';
+  policyJson = pkgs.writeText "policy.json" ''
+    { "default": [ { "type": "insecureAcceptAnything" } ] }
+  '';
+in
+{
+  # Static site — no language toolchain needed, just the image build.
+  packages = [
+    # --- build & ship the image ---
+    pkgs.podman # `podman build -t git.0x29a.ch/aaron/website:1.0.0 .`
+    #           # reads the Dockerfile natively; push with `podman push`.
+  ];
+
+  enterShell = ''
+    # Seed rootless-podman config once, so `podman build` resolves short image
+    # names and finds a signature policy. Never clobbers existing user config.
+    conf="$HOME/.config/containers"
+    if [ ! -e "$conf/registries.conf" ] || [ ! -e "$conf/policy.json" ]; then
+      mkdir -p "$conf"
+      [ -e "$conf/registries.conf" ] || install -m644 ${registriesConf} "$conf/registries.conf"
+      [ -e "$conf/policy.json" ]     || install -m644 ${policyJson} "$conf/policy.json"
+      echo "seeded rootless-podman config in $conf"
+    fi
+
+    # Persist registry logins. Rootless podman defaults to the volatile
+    # $XDG_RUNTIME_DIR (wiped on reboot); point it at ~/.config so a single
+    # `podman login git.0x29a.ch` survives reboots. The token lives in
+    # auth.json (base64, outside the repo) — never committed.
+    export REGISTRY_AUTH_FILE="$HOME/.config/containers/auth.json"
+
+    echo "website devenv ready — build:  podman build -t git.0x29a.ch/aaron/website:1.0.0 ."
+  '';
+}