Generate env.local at runtime so secrets such as APP_SECRET can be provided outside the Nix store.
Assisted-by: pi coding agent / Mika (OpenAI GPT-5.5)
Move mutable public media and uploads out of the Nix store and add nginx hardening for served media files.
Assisted-by: pi coding agent / Mika (OpenAI GPT-5.5)
Lix is going to warn, and in the future, error on broken string escape.
After a flaker run, the following escape were flagged as broken, so this
commit fix them to make sure Lix is still able to build nixpkgs once the
patch deprecating the broken escapes land.
This avoids restarting the postgresql server, when only ensureDatabases
or ensureUsers have been changed. It will also allow to properly wait
for recovery to finish later.
To wait for "postgresql is ready" in other services, we now provide a
postgresql.target.
Resolves#400018
Co-authored-by: Marcel <me@m4rc3l.de>
