Fix repository pointers

.gitea/workflows/build-dev.yml

@@ -1,8 +1,4 @@
 on:
-  push:
-    branches:
-      - main
-
   workflow_dispatch:
 
 jobs:

AGENTS.md

@@ -29,28 +29,28 @@ nix eval .#nixosConfigurations --apply builtins.attrNames
 
 | Name | Target hardware | Disk device | Notes |
 |---|---|---|---|
-| `radiantwavekiosk` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Production, uses `radiantwave` main |
+| `radiantwavekiosk` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Production, uses `radiantwave-legacy` |
-| `radiantwavekiosk-dev` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Dev, uses `radiantwave-dev` ref |
+| `radiantwavekiosk-dev` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Dev, uses `radiantwave` `?ref=dev` |
-| `radiantwavekiosk-commercial` | Commercial HW (SATA) | `/dev/sda` | Production |
+| `radiantwavekiosk-commercial` | Commercial HW (SATA) | `/dev/sda` | Production, uses `radiantwave-legacy` |
-| `radiantwavekiosk-commercial-dev` | Commercial HW (SATA) | `/dev/sda` | Dev |
+| `radiantwavekiosk-commercial-dev` | Commercial HW (SATA) | `/dev/sda` | Dev, uses `radiantwave` `?ref=dev` |
-| `radiantwavekiosk-android` | Intel NUC 14 | `/dev/nvme0n1` | + rotated display (portrait) |
+| `radiantwavekiosk-android` | Intel NUC 14 | `/dev/nvme0n1` | + rotated display (portrait), uses `radiantwave-legacy` |
-| `radiantwavekiosk-rpi` | Raspberry Pi 5 | — | Uses `nixos-raspberrypi` |
+| `radiantwavekiosk-rpi` | Raspberry Pi 5 | — | Uses `nixos-raspberrypi`, uses `radiantwave-legacy` |
-| `radiantwavekiosk-rpi-dev` | Raspberry Pi 5 | — | Dev, uses `radiantwave-dev` |
+| `radiantwavekiosk-rpi-dev` | Raspberry Pi 5 | — | Dev, uses `radiantwave` `?ref=dev` |
 
 ISOs: `usb-iso`, `commercial-usb-iso`, `android-iso`, `dev-iso` — each bakes in the corresponding system closure for zero-touch install.
 
 ## Branching model
 
-Single branch (`main`). Production vs. dev split is at the **flake input** level (`radiantwave` vs `radiantwave-dev`), not at the branch level.
+Single branch (`main`). Production vs. dev split is at the **flake input** level (`radiantwave-legacy` vs `radiantwave` `?ref=dev`), not at the branch level.
 
-## CI (Forgejo)
+## CI (Gitea)
 
-`.forgejo/workflows/build-dev.yml` — triggered by `repository_dispatch` (`radiantwave-dev-built`) from the RadiantWave repo. Updates `radiantwave-dev` input, builds dev closure + ISO, commits updated `flake.lock`. Runs on `neils-server-runner`.
+`.gitea/workflows/build-dev.yml` — triggered by `workflow_dispatch`. Updates `radiantwave` input (dev branch), builds dev closure + ISO, commits updated `flake.lock`. Runs on `build-server`.
 
 ## Important gotchas
 
 - **Disk device differs by variant**: `disk-config.nix` uses `/dev/nvme0n1`, `commercial-disk-config.nix` uses `/dev/sda`. Don't mix them up.
-- **ISO configs reference specific system closures**: `iso-config.nix` hardcodes `radiantwavekiosk`, `dev-iso.nix` hardcodes `radiantwavekiosk-dev`, `commercial-iso-config.nix` hardcodes `radiantwavekiosk-commercial`. Changing a config name in `flake.nix` requires updating the corresponding ISO config.
+- **ISO configs reference specific system closures**: `iso-config.nix` hardcodes `radiantwavekiosk`, `dev-iso.nix` hardcodes `radiantwavekiosk-dev`, `commercial-iso-config.nix` hardcodes `radiantwavekiosk-commercial`, `android-iso.nix` hardcodes `radiantwavekiosk-android`. Changing a config name in `flake.nix` requires updating the corresponding ISO config.
 - **Attic cache token**: ISO configs embed a JWT token for Attic in `/etc/nix/netrc`. If builds fail with auth errors, the token may have expired (expiry in the JWT payload).
 - **`rotated_display.nix` uses `mkForce`** on `loginShellInit` — it replaces the entire kiosk startup script from `configuration.nix`, don't edit both.
 - **SOPS**: `.sops.yaml` configures age-based encryption for `secrets.yaml`. You'll need the private key matching `age1t2wpzv...` to decrypt.
@@ -65,6 +65,7 @@ Single branch (`main`). Production vs. dev split is at the **flake input** level
 - `iso-config.nix` — production ISO + zero-touch installer
 - `dev-iso.nix` — dev ISO + zero-touch installer
 - `commercial-iso-config.nix` — commercial ISO + zero-touch installer
+- `android-iso.nix` — android ISO + zero-touch installer
 - `rotated_display.nix` — portrait display override for Android variant
 - `facter.json` — hardware facter report (NUC 14)
 - `14rvk.json`, `pn54.json` — additional hardware facter reports

android-iso.nix

@@ -0,0 +1,133 @@
+{
+  pkgs,
+  inputs,
+  self,
+  ...
+}:
+let
+  targetSystem =
+    self.nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel;
+
+  diskoScript =
+    self.nixosConfigurations.radiantwavekiosk-android.config.system.build.diskoScript;
+in
+{
+  ############################################################
+  # System configuration
+  ############################################################
+
+  nix.settings = {
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+
+    substituters = [
+      "https://cache.nixos.org"
+    ];
+
+    flake-registry = "";
+
+    connect-timeout = 0;
+  };
+
+  nix.registry.nixpkgs = pkgs.lib.mkForce {
+    to = {
+      type = "path";
+      path = "${inputs.nixpkgs}";
+    };
+  };
+
+  nix.extraOptions = ''
+    netrc-file = /etc/nix/netrc
+  '';
+
+  environment.variables.KIOSK_FLAKE = "${self}";
+
+  environment.etc."nix/netrc" = {
+    text = ''
+      password eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjIwODgzODk2ODEsIm5iZiI6MTc3MjgxMzY4MSwic3ViIjoia2lvc2siLCJodHRwczovL2p3dC5hdHRpYy5ycy92MSI6eyJjYWNoZXMiOnsia2lvc2siOnsiciI6MX19fX0.N6Ktrmmu1LSy2PP8uNF25VHRP1dxPZJ4M0MR1kUpVi0
+    '';
+    mode = "0400";
+  };
+
+  networking.networkmanager.enable = true;
+
+  ############################################################
+  # User configuration
+  ############################################################
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook"
+  ];
+
+  ############################################################
+  # Service configuration
+  ############################################################
+
+  services.openssh.enable = true;
+
+  systemd.services.NetworkManager-wait-online.enable = false;
+
+  systemd.services.zero-touch-install = {
+    description = "Zero-Touch Kiosk Installation";
+
+    wantedBy = [ "multi-user.target" ];
+
+    # Make sure we own tty1 exclusively - getty@tty1 will otherwise
+    # try to spawn a login prompt on the same console.
+    conflicts = [ "getty@tty1.service" ];
+    after = [ "systemd-udev-settle.service" "getty@tty1.service" ];
+
+    path = with pkgs; [
+      nix
+      git
+      util-linux
+      nixos-install-tools
+      curl
+      networkmanager
+      mount
+      umount
+      disko
+    ];
+
+    environment = {
+      NIX_PATH = "nixpkgs=${inputs.nixpkgs}";
+      KIOSK_FLAKE = "${self}";
+      DISKO_SCRIPT = "${diskoScript}";
+    };
+
+    serviceConfig = {
+      StandardInput = "tty";
+      StandardOutput = "tty";
+      StandardError = "tty";
+      TTYPath = "/dev/tty1";
+      TTYReset = true;
+      TTYVHangup = true;
+      TTYVTDisallocate = true;
+    };
+
+    script = ''
+      set -euo pipefail
+
+      echo "Running disko script..."
+      echo "Script: $DISKO_SCRIPT"
+
+      ${diskoScript}
+
+      echo "Installing RadiantWave"
+      echo "Closure Path: ${targetSystem}"
+
+      nixos-install \
+        --system "${targetSystem}" \
+        --no-root-passwd \
+        --no-channel-copy
+
+      echo "============================================"
+      echo " Installation complete!"
+      echo " Please shut down and remove the flash drive before restarting"
+      echo "============================================"
+      sleep 10000000
+    '';
+  };
+}

flake.lock

@@ -87,6 +87,24 @@
         "type": "github"
       }
     },
+    "flake-utils_3": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "nixos-facter-modules": {
       "locked": {
         "lastModified": 1773858690,
@@ -199,6 +217,22 @@
       }
     },
     "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1785967620,
+        "narHash": "sha256-IItrdb7Puk05RqOBWZYFC5X6Wl1sJmCfh5MWVHw5iMM=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b7c2ada94fe99c15b0dbcf4d11fd7850b957a436",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1776877367,
         "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
@@ -234,11 +268,31 @@
         "url": "ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git"
       }
     },
-    "radiantwave-legacy": {
+    "radiantwave-dev": {
       "inputs": {
         "flake-utils": "flake-utils_2",
         "nixpkgs": "nixpkgs_4"
       },
+      "locked": {
+        "lastModified": 1786826629,
+        "narHash": "sha256-DW8q8higedCMLlfcAwhEQyP57ZRTok7cG1N8g5P+1ms=",
+        "ref": "dev",
+        "rev": "e401bd4ec59d1ef4f2e8b117b5933293615a19f6",
+        "revCount": 27,
+        "type": "git",
+        "url": "ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git"
+      },
+      "original": {
+        "ref": "dev",
+        "type": "git",
+        "url": "ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git"
+      }
+    },
+    "radiantwave-legacy": {
+      "inputs": {
+        "flake-utils": "flake-utils_3",
+        "nixpkgs": "nixpkgs_5"
+      },
       "locked": {
         "lastModified": 1786170011,
         "narHash": "sha256-Vx/3kwIQFRYDZQtVdcdGgJPnNa2Y44HRYZyJAeug6OI=",
@@ -261,6 +315,7 @@
         "nixos-raspberrypi": "nixos-raspberrypi",
         "nixpkgs": "nixpkgs_2",
         "radiantwave": "radiantwave",
+        "radiantwave-dev": "radiantwave-dev",
         "radiantwave-legacy": "radiantwave-legacy"
       }
     },
@@ -293,6 +348,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -6,6 +6,7 @@
     nixos-facter-modules.url = "github:numtide/nixos-facter-modules";
     # radiantwave.url = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git?ref=main"; # This is the NEW RadiantWave
     radiantwave.url = "git+ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git?ref=main";
+    radiantwave-dev.url = "git+ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave.git?ref=dev";
     radiantwave-legacy.url = "git+ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/radiantwave-legacy.git?ref=main";
     nixos-raspberrypi.url = "github:nvmd/nixos-raspberrypi/main";
   };
@@ -17,6 +18,7 @@
       disko,
       nixos-facter-modules,
       radiantwave,
+      radiantwave-dev,
       radiantwave-legacy,
       nixos-raspberrypi,
       ...
@@ -126,7 +128,7 @@
         # Kiosk-dev
         radiantwavekiosk-dev = mkKioskSystem {
           system = "x86_64-linux";
-          radiantwave = radiantwave;
+          radiantwave = radiantwave-dev;
           diskModule = ./disk-config.nix;
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-dev";
           extraModules = [];
@@ -142,9 +144,9 @@
         # Commercial-dev
         radiantwavekiosk-commercial-dev = mkKioskSystem {
           system = "x86_64-linux";
-          radiantwave = radiantwave;
+          radiantwave = radiantwave-dev;
           diskModule = ./commercial-disk-config.nix;
-          upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-commercial";
+          upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-commercial-dev";
           extraModules = [];
         };
         # Kiosk - rotated screen for android displays
@@ -162,7 +164,7 @@
         };
         # Raspberry pi 5 dev
         radiantwavekiosk-rpi-dev = mkRpiKioskSystem {
-          radiantwave = radiantwave;
+          radiantwave = radiantwave-dev;
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-rpi-dev";
         };
         # === USB Images ===
@@ -222,7 +224,7 @@
           modules = [
             "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
             disko.nixosModules.disko
-            ./iso-config.nix
+            ./android-iso.nix
             ./disk-config.nix
             ({ pkgs, ... }: {
               environment.systemPackages = [