Add NixOS module, container integration test, and restructure flake

[Ericson2314]

If we are to refactor Hackage, we want to have more tests to be more confident that we are not making mistakes. This commit reworks the Nix and makes a new end-to-end NixOS container test. Even if we aren't refactoring hackage, more tests don't hurt.

(NixOS Container tests are an (exciting!) new variant of the older NixOS VM test concept, and share most of the same infrastructure. I had to use them here because the current GitHub Actions runner doesn't support KVM, but they are nicer in general (quicker, lighter logs, etc.).)

The NixOS module (nix/nixos-module.nix) provides services.hackage-server with Claude's guess at usual options (baseUri, userContentUri, port, stateDir, etc.), automatic init on first start, and a systemd service matching production deployment conventions. It seems good to me — certainly good enough for testing purposes.

The container test (nix/test.nix) spins up a NixOS container with the module enabled and does a curl smoke test. This is the first time we have an automated test of the full deployment stack (systemd → init → server → HTTP), not just the Haskell code in isolation.

The flake is restructured so that flake.nix is a thin wrapper and all the actual configuration lives in nix/flake-module.nix. This also introduces lib.fileset to whitelist only Haskell-relevant source files, so that editing nix files, documentation, etc. does not trigger a full Haskell rebuild. That was very useful when editing the container test and other nix code — don't want to blow up my debug cycle by waiting for Hackage to rebuild each time!

No Haskell source code is modified. The running server, when deployed as it is today, should be entirely the same.

[Ericson2314]

Ah this didn't build because wherever Linux runner this is using does not support KVM for the VM test. I'll should look into using the new "container tests" instead.

[Ericson2314]

OK I reworked this to instead us the brand-new NixOS container tests. If someone can approve approve the CI runs, it should work now!

[ysangkok]

@peterbecich I don't know nix, so I requested your review

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[Ericson2314]

Hopefully I got the settings right so the build will run now

[Ericson2314]

Yay! succeeding finally.

[Copilot]

Pull request overview

Adds Nix-based deployment and test infrastructure for hackage-server: a NixOS module for services.hackage-server, a NixOS container integration test, and a flake refactor that centralizes configuration in nix/flake-module.nix while using lib.fileset to avoid unnecessary Haskell rebuilds when editing non-Haskell files.

Changes:

• Introduces a NixOS module (nix/nixos-module.nix) exposing services.hackage-server and a corresponding systemd service with automatic first-start init.
• Adds an end-to-end NixOS container test (nix/test.nix) that boots the service and runs curl smoke tests.
• Restructures flake configuration into nix/flake-module.nix and updates CI Nix settings to support container-based tests.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
nix/test.nix	Adds a container-based NixOS integration test that exercises systemd → init → server → HTTP.
nix/nixos-module.nix	Introduces services.hackage-server options and a systemd unit for running hackage-server on NixOS.
nix/flake-module.nix	Centralizes flake-parts configuration, exports the NixOS module, adds checks, and uses lib.fileset to narrow rebuild inputs.
flake.nix	Becomes a thin wrapper that imports nix/flake-module.nix.
.github/workflows/nix-flake.yml	Adjusts Nix config in CI to enable the Linux container test execution environment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Ericson2314]

For reference, the current handwritten systemd service file looks like this

[Unit]
Description=Hackage Server

Wants=network-online.target
After=network.target network-online.target

[Service]
Type=simple
User=hackage
Group=hackage
Restart=always

RestartSec=3
TimeoutStopSec=120
LimitNOFILE=1073741824

Environment=HACKAGE_INSTANCE=/home/hackage/hackage.prod
WorkingDirectory=/home/hackage/hackage.prod/tmp

ExecStart=/home/hackage/hackage.prod/bin/hackage-server run
--base-uri=https://hackage.haskell.org
--required-base-host-header=hackage-origin.haskell.org
--user-content-uri=https://hackage-content.haskell.org
--state-dir=${HACKAGE_INSTANCE}/state
--static-dir=${HACKAGE_INSTANCE}/datafiles
--tmp-dir=${HACKAGE_INSTANCE}/state/tmp --temp-run --hardlink-blobs
--ip=127.0.0.1 --port=8080 -v2 +RTS -N4 -A4M -qg -M38G

[Install]
WantedBy=multi-user.target