From a0624c17464f3b737318a42e714e2a89e0552e8e Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Sat, 3 Oct 2026 17:24:24 +0200
Subject: [PATCH 1/3] nixos/radicle: fmt

(cherry picked from commit 2325377fa122d4d71afe109dbed704a736a306be)
---
 nixos/modules/services/misc/radicle.nix | 57 +++++++------------------
 1 file changed, 16 insertions(+), 41 deletions(-)

diff --git a/nixos/modules/services/misc/radicle.nix b/nixos/modules/services/misc/radicle.nix
index 3456faeabd0e..98bb371bc292 100644
--- a/nixos/modules/services/misc/radicle.nix
+++ b/nixos/modules/services/misc/radicle.nix
@@ -5,6 +5,7 @@
   utils,
   ...
 }:
+
 let
   cfg = config.services.radicle;
 
@@ -37,19 +38,13 @@ let
     environment = env // {
       RUST_LOG = lib.mkDefault "info";
     };
-    path = [
-      pkgs.gitMinimal
-    ];
-    documentation = [
-      "https://radicle.dev/guides/seeder"
-    ];
+    path = [ pkgs.gitMinimal ];
+    documentation = [ "https://radicle.dev/guides/seeder" ];
     after = [
       "network.target"
       "network-online.target"
     ];
-    requires = [
-      "network-online.target"
-    ];
+    requires = [ "network-online.target" ];
     wantedBy = [ "multi-user.target" ];
     serviceConfig = lib.mkMerge [
       {
@@ -132,6 +127,7 @@ let
     };
   };
 in
+
 {
   options = {
     services.radicle = {
@@ -236,9 +232,7 @@ in
             ];
           }
         '';
-        type = lib.types.submodule {
-          freeformType = json.type;
-        };
+        type = lib.types.submodule { freeformType = json.type; };
       };
       httpd = {
         enable = lib.mkEnableOption "Radicle HTTP gateway to radicle-node";
@@ -321,46 +315,30 @@ in
                 "@timer"
               ];
             };
-            confinement.packages = [
-              cfg.package
-            ];
+            confinement.packages = [ cfg.package ];
           }
           # Give only access to the private key to radicle-node.
           {
             serviceConfig =
               if cfg.privateKey == null then
-                {
-                  ImportCredential = [ credentials.privateKey ];
-                }
+                { ImportCredential = [ credentials.privateKey ]; }
               else if lib.types.path.check cfg.privateKey then
-                {
-                  LoadCredential = [ "${credentials.privateKey}:${cfg.privateKey}" ];
-                }
+                { LoadCredential = [ "${credentials.privateKey}:${cfg.privateKey}" ]; }
               else
-                {
-                  ImportCredential = [ "${cfg.privateKey}:${credentials.privateKey}" ];
-                };
+                { ImportCredential = [ "${cfg.privateKey}:${credentials.privateKey}" ]; };
           }
           {
             serviceConfig =
               if cfg.privateKeyPassphrase == null then
-                {
-                  ImportCredential = [ credentials.privateKeyPassphrase ];
-                }
+                { ImportCredential = [ credentials.privateKeyPassphrase ]; }
               else
-                {
-                  ImportCredential = [ "${cfg.privateKeyPassphrase}:${credentials.privateKeyPassphrase}" ];
-                };
+                { ImportCredential = [ "${cfg.privateKeyPassphrase}:${credentials.privateKeyPassphrase}" ]; };
           }
         ];
 
-        environment.systemPackages = [
-          rad-system
-        ];
+        environment.systemPackages = [ rad-system ];
 
-        networking.firewall = lib.mkIf cfg.node.openFirewall {
-          allowedTCPPorts = [ cfg.node.listenPort ];
-        };
+        networking.firewall = lib.mkIf cfg.node.openFirewall { allowedTCPPorts = [ cfg.node.listenPort ]; };
 
         users = {
           users.radicle = {
@@ -369,8 +347,7 @@ in
             home = env.HOME;
             isSystemUser = true;
           };
-          groups.radicle = {
-          };
+          groups.radicle = { };
         };
       }
 
@@ -405,9 +382,7 @@ in
                     "@timer"
                   ];
                 };
-                confinement.packages = [
-                  cfg.httpd.package
-                ];
+                confinement.packages = [ cfg.httpd.package ];
               }
             ];
           }

From 648df899932358bd4553784fa4ab3f789181bba8 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Sat, 3 Oct 2026 17:24:24 +0200
Subject: [PATCH 2/3] nixos/radicle: remove unused arg

(cherry picked from commit 17714c949b110f371b348f809312c2bdf9b154c9)
---
 nixos/modules/services/misc/radicle.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/modules/services/misc/radicle.nix b/nixos/modules/services/misc/radicle.nix
index 98bb371bc292..acd397d92e5c 100644
--- a/nixos/modules/services/misc/radicle.nix
+++ b/nixos/modules/services/misc/radicle.nix
@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  utils,
   ...
 }:
 

From d90dd7bace65fa6719b9ea1290b39ddd236ac2c3 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Sat, 3 Oct 2026 17:25:48 +0200
Subject: [PATCH 3/3] nixos/radicle: use `cfg.package` to check config

(cherry picked from commit 98880fa6661d85f51d6b0e1ebf9026866359a534)
---
 nixos/modules/services/misc/radicle.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/misc/radicle.nix b/nixos/modules/services/misc/radicle.nix
index acd397d92e5c..c8728e75c056 100644
--- a/nixos/modules/services/misc/radicle.nix
+++ b/nixos/modules/services/misc/radicle.nix
@@ -21,6 +21,12 @@ let
     privateKeyPassphrase = "dev.radicle.node.passphrase";
   };
 
+  buildPackage =
+    if pkgs.stdenv.buildPlatform.canExecute pkgs.stdenv.hostPlatform then
+      cfg.package
+    else
+      pkgs.buildPackages.radicle-node;
+
   # Convenient wrapper to run `rad` in the namespaces of `radicle-node.service`
   rad-system = pkgs.writeShellScriptBin "rad-system" ''
     set -o allexport
@@ -203,7 +209,7 @@ in
               ln -s $out config.json
               install -D -m 644 /dev/stdin keys/radicle.pub <<<"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBgFMhajUng+Rjj/sCFXI9PzG8BQjru2n7JgUVF1Kbv5 snakeoil"
               export RAD_HOME=$PWD
-              ${lib.getExe' pkgs.buildPackages.radicle-node "rad"} config >/dev/null || {
+              ${lib.getExe' buildPackage "rad"} config >/dev/null || {
                 cat -n config.json
                 echo "Invalid config.json according to rad."
                 echo "Please double-check your services.radicle.settings (producing the config.json above),"