Log from Radicle native CI

Table of contents

Request message

{
  "request": "trigger",
  "version": 1,
  "event_type": "push",
  "repository": {
    "id": "rad:z2ddH8djdXXq1eKuhAwnyAzWyaivR",
    "name": "infrastructure",
    "description": "Infrastructure configurations for orzklv's public servers.",
    "private": false,
    "default_branch": "main",
    "delegates": [
      "did:key:z6MkwPociLTRDKKW4EYFF8oP5N2r5FycoRMH1FZsxRvetBwy"
    ]
  },
  "pusher": {
    "id": "did:key:z6MkwPociLTRDKKW4EYFF8oP5N2r5FycoRMH1FZsxRvetBwy",
    "alias": "orzklv"
  },
  "before": "3348d79695291b3a7c23591bb4d5f6a91968447a",
  "after": "3348d79695291b3a7c23591bb4d5f6a91968447a",
  "branch": "main",
  "commits": [
    "3348d79695291b3a7c23591bb4d5f6a91968447a"
  ]
}

.radicle/native.yaml

shell: |
  nix flake check -L --show-trace

Run: git clone /var/lib/radicle/storage/z2ddH8djdXXq1eKuhAwnyAzWyaivR /var/lib/radicle-ci/adapters/native/native/dcc1d408-ad50-4834-831b-fd58f117ab35/src

Command arguments:

In directory: /run/radicle-ci-broker

Exit code: 0

Output (stdout and stderr):

Cloning into '/var/lib/radicle-ci/adapters/native/native/dcc1d408-ad50-4834-831b-fd58f117ab35/src'...
done.

Run: git config advice.detachedHead false

Command arguments:

In directory: /var/lib/radicle-ci/adapters/native/native/dcc1d408-ad50-4834-831b-fd58f117ab35/src

Exit code: 0

Run: git checkout 3348d79695291b3a7c23591bb4d5f6a91968447a

Command arguments:

In directory: /var/lib/radicle-ci/adapters/native/native/dcc1d408-ad50-4834-831b-fd58f117ab35/src

Exit code: 0

Output (stdout and stderr):

HEAD is now at 3348d796 chore: radicle search bakend

Run: git show 3348d79695291b3a7c23591bb4d5f6a91968447a

Command arguments:

In directory: /var/lib/radicle-ci/adapters/native/native/dcc1d408-ad50-4834-831b-fd58f117ab35/src

Exit code: 0

Output (stdout and stderr):

commit 3348d79695291b3a7c23591bb4d5f6a91968447a
Author: Sokhibjon Orzikulov <sakhib@orzklv.uz>
Date:   Fri Oct 9 06:23:59 2026 +0500

    chore: radicle search bakend

diff --git a/modules/radicle/default.nix b/modules/radicle/default.nix
index 2c8e7be6..dceccebb 100644
--- a/modules/radicle/default.nix
+++ b/modules/radicle/default.nix
@@ -30,6 +30,11 @@ let
   '';
 in
 {
+  imports = [
+    # Radicle Search
+    ./search.nix
+  ];
+
   options = {
     kolyma.radicle = {
       enable = lib.mkEnableOption "radicle infrastructure";
@@ -127,9 +132,13 @@ in
       };
     };
 
-    systemd.services.radicle-node.serviceConfig.LoadCredential = [
-      "dev.radicle.node.passphrase:${config.sops.secrets."radicle/password".path}"
-    ];
+    systemd.services = {
+      radicle-ci-broker.serviceConfig.UMask = lib.mkForce "0022";
+
+      radicle-node.serviceConfig.LoadCredential = [
+        "dev.radicle.node.passphrase:${config.sops.secrets."radicle/password".path}"
+      ];
+    };
 
     services = {
       radicle = {
@@ -146,7 +155,6 @@ in
             enableACME = true;
             serverName = cfg.domains.seed;
           };
-
         };
 
         # Seeding node
@@ -251,7 +259,5 @@ in
         };
       };
     };
-
-    systemd.services.radicle-ci-broker.serviceConfig.UMask = lib.mkForce "0022";
   };
 }
diff --git a/modules/radicle/search.nix b/modules/radicle/search.nix
new file mode 100644
index 00000000..4bfc858a
--- /dev/null
+++ b/modules/radicle/search.nix
@@ -0,0 +1,134 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  # Keep it literal and local
+  search-url = with config.services.meilisearch; "http://${listenAddress}:${toString listenPort}";
+
+  #
+  public-key =
+    with config.services.radicle;
+    if lib.types.path.check publicKey then publicKey else pkgs.writeText "radicle.pub" publicKey;
+
+in
+{
+  config = {
+    assertions = [
+      {
+        assertion = lib.versionAtLeast config.services.radicle.httpd.package.version "0.26.0";
+        message = "Repository search needs radicle-httpd >= 0.26.0, the first release that ships the radicle-search indexer.";
+      }
+    ];
+
+    sops = {
+      secrets = {
+        "radicle/meilisearch" = {
+          format = "binary";
+          sopsFile = ../../secrets/radicle/meilisearch.hell;
+          restartUnits = [ "meilisearch.service" ];
+        };
+      };
+      templates."radicle-search.env" = {
+        content = ''
+          RADICLE_SEARCH_KEY=${config.sops.placeholder."radicle/meilisearch"}
+          RADICLE_SEARCH_MEILI_KEY=${config.sops.placeholder."radicle/meilisearch"}
+        '';
+        restartUnits = [
+          "radicle-httpd.service"
+          "radicle-search.service"
+        ];
+      };
+    };
+
+    services.meilisearch = {
+      enable = true;
+      listenAddress = "127.0.0.1";
+      masterKeyFile = config.sops.secrets."radicle/meilisearch".path;
+      settings.env = "production";
+    };
+
+    systemd.services = {
+      radicle-httpd = {
+        wants = [ "meilisearch.service" ];
+        after = [ "meilisearch.service" ];
+        environment.RADICLE_SEARCH_URL = search-url;
+        serviceConfig.EnvironmentFile = config.sops.templates."radicle-search.env".path;
+      };
+
+      radicle-search = {
+        description = "Radicle search indexer";
+        wantedBy = [ "multi-user.target" ];
+        wants = [
+          "meilisearch.service"
+          "radicle-node.service"
+        ];
+        after = [
+          "meilisearch.service"
+          "radicle-node.service"
+        ];
+
+        environment = {
+          HOME = config.users.users.radicle.home;
+          RAD_HOME = config.users.users.radicle.home;
+          RADICLE_SEARCH_MEILI_URL = search-url;
+          RUST_LOG = lib.mkDefault "info";
+        };
+
+        serviceConfig = {
+          ExecStart = lib.getExe' config.services.radicle.httpd.package "radicle-search";
+          EnvironmentFile = config.sops.templates."radicle-search.env".path;
+          Restart = "on-failure";
+          RestartSec = 10;
+
+          User = config.users.users.radicle.name;
+          Group = config.users.groups.radicle.name;
+          WorkingDirectory = config.users.users.radicle.home;
+
+          BindReadOnlyPaths = [
+            "${config.services.radicle.configFile}:${config.users.users.radicle.home}/config.json"
+            "${public-key}:${config.users.users.radicle.home}/keys/radicle.pub"
+          ];
+          StateDirectory = "radicle";
+          StateDirectoryMode = "0750";
+          UMask = "0066";
+
+          CapabilityBoundingSet = "";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_UNIX"
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SocketBindDeny = "any";
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+            "~@resources"
+          ];
+        };
+      };
+    };
+  };
+}
diff --git a/secrets/radicle/meilisearch.hell b/secrets/radicle/meilisearch.hell
new file mode 100644
index 00000000..bda81bb1
--- /dev/null
+++ b/secrets/radicle/meilisearch.hell
@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:rtD/WsGakkjwexXrGjlP/B3a30Ts2B7HxkKR96fO/jyw1XUDTwyvcqV/1CXgHphfR1EZNtPJkEzomAPXRkAoXCA=,iv:fH4jkvIc5TZCPMEeSlXJ7ZEtznLAfzL87FDqee05USk=,tag:ZOE0dkwQDrcqsmOnALSKTQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IEdUd01BajF3\nNmlVRGtPTnVRbGo5R082bWFLM0UzRE54cGJxNU05aE5nWFRLN09MbEdXMzRpbE9n\najlSYTRYNllock1vKzRPSkFUSVdoR2ZYbHZNbXhBZnk5UDYvd0V0TzA4T0RDV0JV\nVjNOMEJDMkZqQUVxSmdtL3ptVSt4anpONU9Ja0ZKZW9qOGxza2RUVElFUDBRVGY1\nYnVzQWNtaElrWUpVNktnMTdVZ3BoVVIzOFU5M1g4RmFQdzJEa05lUlNMalpBUVY2\ncEpOM0hMdUhuaFRXL3BGSGgzdmVOenNMdm9WS2ovb2RMVXFWV3N2WURLK3hlUmlw\nYnVCUlZuV1g5OVN3eW1UNk40QXUvMzdNekNKMytVVTN4dkM0QWxEcngyTUJCYWJN\nSmZyUjBWNzM4amIzYldBY0J5Q1V5R2Y1aXpacnBJVTJaQkJLR1p6OHFIdlVrREFB\nbmxSVndQbTBsTWV5N1JaUjdRQ3ZWODJkWWlnUW9EdjFIam92VmJrZ0lGNVp4Wm5N\naFlKRVRqUkpsQ1ZFQ1FPUHpYV3RvS3NOWjN3Ykl0Z3NHbkEyZmRKNnhsR0VOZ1JW\neVMrSVkxNGNISUxaVU41OTArQTF1UHN2Yk9yS2x2U1FCTmVpRkwrelpsSWtmeG0y\nb29FWEJ1NW9DcVVMeHRaZXJCeXZKRGNYa28vbjlTOG4rVkM0MGJWZGV3NHhySjBw\nUCs0RlNCVzNqZ0RLYjlyT0NzU2J5VkZGVzF5L2FBRFQ4ekNiUlVPemxlYmo5SkZp\nVjB2TDFNS2pONVhzTmVaU1FBTmRmeUtDWDhFOUdwbi9DaVZxWGhjMVY2b0I3bXk5\ndk01TGVqTUhxazEvS1lIQ2FCUE53MkU1ZGdyLzkzYXAvWTM3NUpnN0dhZnVkbTk3\nVnlVWXFTT21jdFVKMGFESlFQeTV6SUhXM0JjSWhraWoySmtjQnJhV3c0UEZGbnNH\nQUZiYjc5bDFUZ05vNWEvYS9qTVhSZEpUdG4weDU2eFIvdHBSQVpROWdaYmt2aXE2\ncjVuaTVHZ2Q1bDg5cmRaR0ZxUXVaOTdCSTE4c0FqVVpSc3lhVDY0MGhFdUd5ejZt\nNGpwWlRmSDhaQk1iYjVFVDNISjk4cmlPR0FOQXhBK2Z1eWEvZVdTUytpbDRGc0tW\nbXV1OGl6cUZ3aFlrWmV1c1A2MkRSZy93U3N0M1JRVHA5Y2VsRW9lQVdOaWN2U215\nU3I0Ry9iaHZlcVNvUkx1ZHF0d0RJVE9nZDhKSkRiMzErZVhQZGN2c0pxaUFvWlR0\nZm9LbW15VlJJc2NhSUFSUTRBbC9WcFVGaFhwdUg5STFpbXZOcUdrWmEySGo3R2c5\nMVdyOUFoYTNERWFPcHRLeS83ZE5QZXFKdlNjTzB3R0dkakR2L3VnNUhVdk0zV0JG\nOCtvMDB4aEFuL2RhZWtrN1BHcmhJVjRQLzYrQVVUa29SenJzRG9EdFZtZkQrRjRK\nSDI2MG1zUXhHL2dWVGExNitWUk5yOWtGT2dvZnRjYkJ4amlPcmcxZnc5NzF2Zkpa\nL2E2ZVZBazNpSkNpNHFzRWJrTUo4WDJzTDdLOUhpbEZadmhwY3prK3VncWhaakQ4\nY05Lc2xPRlJTOFpYelRZYWdkOTVoczhxNDR1dEt4WlBXUTgvK2dodEEweVZkZ1Bz\nNnJrZU1FR1lUMCt6eGorb0RaalAvdjVaOXZiOEtyd2pMaU12NWdrRkprNXY4cmdj\nRTE0dDErbjBGVTkzbURuNzhLbWRxQnhuM0tBSFdCT3Bzc2IvSXhhOEwrMC80WVc4\nenZHaGFZQUg4RmkwelVQSzl4eDZmNCtMYXRmTFJYQXR0eGg5bFBVbUNMNVY4RDBo\nZ2tFeDM5T1AxNE16NzZKYVBKZ0RiUDQxTVdZU1VQL1Z0QkhrS28rQlJ0Zkp4bzdt\nK29vc0pvUTZXZmlUNXlBMGJvRHJKQ3F5Qy83YXluRjVsVjdIaU9OdmFKR0NYdwpj\naXVrcVVjZ1JzQldFZ05kWlJDdnlaYXpBdXNVTkhWMEpBSG5sZ1BveEgwCi0tLSB2\nT1lTbDd2TWZIRWRNU0RKUFVuVTA5MlViaUo2bFJMYkRLeHp6UUJCdHRBCoGg315i\ntN0Eb/6S8tDPx4jEgVZ4RI8jL4yhS8v55n+khLk1a/yze5YuTE0tLbvqX+S4f1M2\nFz3Ol8cvW1Tf+2c=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1pq15ljmze3nvkgsys6e4p98peamudqy7272vvgxylj06lzpuznsl8vg6c48jhf2pw4tya4ackj8vcuyvkgnfrt2n8u6fy74672p8dse9ua89htrfrulpsm24ck205vupyjpfgkffjggxsutxsujsdt6nqq3c5ngz09ax4w593ar9u593ps9p76j20u9dv9hyf4eheuuz7ajn4pczggqv8qlp2vwpkccdrc3n2tdgw3fwvnqnc5durnv2a3u3yjchxkvkuk6l3zkdhavv7jt40xhc90tdw5zc3dddxj6p3dc40qc4pqsyypk6adxccc429f625mxr8t82kn45jscrf6p7pkyjd4kkac423cqra7qmrtev4sq8w2vvwwnkwr9muflc8gyg0xu8ly78zglvepvkagty4ss6mr55u0xrd9ugwx7vay7vc9cdp6tkt29zkt9guhl2gtrzt2npn3ftr7dexmfdy3n5dsu92eex86v3flmgx3ntqup3cnna5vgzfdkvjr7ftx0w72mdv4m7u3v69yj93wuh3gn80puvryksut6qjfpym9xwhv54fqu5gr2apsfek3mngggkmfez7w5ngarz652pccvrenegl9e4d68mj2727pezrzq9wqhnns3c0xg9z5psam4n482slzw9ppjljup5gstrajhl7xprg65rgwagw7lzswg365h5kevdvky9nup5vfg6hrjf6mggvyvzd3jgnkh68yqnrqlqq5seqg2e2gevm4jnxlvvxskwj65hc2m5z0gp39xw4p5aau9q8gq8073nuu2v0cknzn8a3v4e4mge0epz5g0cyplgcdqv5yz2xyccwk9pyt78nxa2cqza62x74uyh6as40rtrgj26x3ft4dfh4z8kfx3kg5fhzjwqvmerkfsmez9cu79zsltc8n2sv39uqqwsdg2sc3ece0ghyc72ss8s9t8q659hhy2yx0pdgge4dl3tnpt8cc4d23srtv4c2weck9flvvxrqzx073mrfz4dv4vjssyza72hneqq6s4x76d3zlvj43ntfng7t5f8dmmxrkdkf2yw0y30xrwu0gr2ndxduukpzc9gjexq5p7r9d45jk43k4jxh4kywz3fp4enmtsgd0krf8xn3xs8qzcckyx5u52qj2yzzpmk5wz27mzmzedavgreujj5yrw8wf2gpweey7prk4mvtnp44g9q8vwm382se25v47fr9nfja77wr05kw05mj2aycr6pyy9k6mly74r8s56hwvcclrpurcjns0rhrcs2xhmhafxfdgkx3yy2plvdgrv9pq4zjxgdw5s7vm9xxarjh8y4xn90ja7v2v9qw324uxenyzmdptq7vt3fxx2pelp2f4gjla2zfx33v9knypkza7xn6yeq4vy5qwv0jerjldzq5jnx8v7gfl8csjk5jagajsrjjecq34usxs528yynvuwhn2qh7rqda7gt8xygya4akr8amjxfq6ufmlyv868ggu2243ad2u4j78rvheek2332aftw35ca6suz0pm0tttysttu65yrpm50lr3lqqgzxa80j0kcv8fnqwd9vqxvmc2vpd2yd4ft35qej9ennzcu5xqylv8yz2eylrjxpuvl8d5q2a4d695hppqhd84cgwxacaz5j943tjpcqwpnwk8w5zkdnfh9ea5emk6z7sjpfl2yw507jkymdtqxrnl2jt9qddk5zahfuk2n4k49mc6txhlgv2lxy6ml562jztrt6whg2gxx6ep0sc9pne8psuufh6kgx9tykxt2r99yj53tfhsx0nyqzkcs6s50k60lgafa3q45ud2ja6wcay2ta7pdv46d3p2m9uujcfda48nurmhlf9879mu62n4yxedgec3ca2kdysjaenlye8y5sxa09w4gf52cgk7susyxx669r09afvcj26m2vgzxka3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IHd4R3ljTjVI\nbGRpVVFZR0FEQUxVcW54cEptdTh4U1F5ZGtLdGlIQmg3QlV6TmwzbmJLdUwvMVBG\nMVYrdlk1a0JoYWt5TFpsTUE1MXRHVk52czFFNE5HcTRWU1VZMWw1WlA0NEtja2ZM\nZkkrRXh2UlNNOWhpeEpnRUR6UTEzZUt0dEw3YzRaQ1IyS2tUZ1BZSXBiS2VqNmlI\nUEpIajlYUVZGaC9DQWpDY1U4VzRHamxQOE9jTEZYZW9nR3hlcHNBWW1NbkNQQW5D\nQi9FcFVrOXhmTlVMTkFBa1pvWllUeU1XSitOWjZjYjJhem1UeG9oclJ0R3g1b2ZC\namNWaVZndmpBcXozNG84TDl3MVB0M2k0dGRwSGhhMUdDRWg5cDllenJ1ckFqU3JT\nWnJXNTNadnhwaGFVdEpyUDdYUllIcGNSdzZ4TzV6SGNqYkxvcExlcjdqdzJDMWFB\nYzd2dGU3eUFBc3JIVG50T2ZkN3VjZXhKOGxaQk00RUlDQXdhbnFvS3ZlQ2t1WEJF\nc1htQ3g1WmVaS3BPNk9XaSs3Q1BFVkFxREQ1ZXM1cDlIQnY1MklYMnVOWXZsdmQ5\naVdUcUVaaUxRNWFJY1YwQ2E2T1NJQUJ2Y0xaREJnNW03T2JiVitiZVNIRENoS29L\nMU5UYU9vc21uTk1tbFF3L3ZiMks1L08xWlhUTFR2YUVScUFGWWlneVRENUFRemlL\nVzIyaTViQTc3ZVFwN0tITmtVeTJMbldVS2ZjK3Q3c3ZWam1aWVJlYmNES1JJS0Ft\nMnQxUXphQUJWOU40anN3MzllRS9hSWhzNlhVb25VNlcrU2pXU2FvNWdSempldlBw\nM1FKTU5MLzh0Z3hBdUlWZm5nbHI1NitFSEpCTktTV2x1UXBMcnpIVEs0emVZK09u\nQk1XZHRLY0MwTkI0VERGSjAyVDZsZG1tS2tVMjFCVElXSDZrSUpnQkJONnRNRWd3\nZ1FzeWttWWNVdG8zU095WFI4ZEVrNGRNbWdNVDNMMTRjQStyRXBpd0syODdQeDdS\nRGtMcklPRGRiZkhRcnRHUkc3SkIwUUVrR1dGVEhEdjRRaDJNNEhneEZwUFBMcmhv\nck9BaVZMYzFRV2JHWW93R2JYK3ZnanZIdENieDdUeExiMys1eGNjNWNYbng1Sk9S\nLzlNZUtVYkNJTWd0TFFQZWlLdzlBWEs0L0RQRGhDNmxJSmozQ1c2eUx5cTIrNjgy\nTWpTcmQ0M1JiQlRqUlMyNXVGSVlQWVVlZkgwK2dWMFF4Mm9aQ1phQ0pFczRIcXRq\nOWVIL3E5VkdSTFB6eS9ORWZQUmZxMVFVcGs0eDJNRjVnazU3a2UxSUpvM2NzZmZl\nOTE0ZVdYbUIzRXV2YmhLb2oveE1mamlRKytnazdhV1N3S2V2Z0pIb2VENm1CV0gw\nWDZwZUtoSklXWHF3ZmNLRkE1UXRyM0JTeU1rdVMycm9IOW1oSm5tQnVRWXBHM2J0\nQmhUN2VhMG9WTVhNYStFUHZkM21NVmJRQWQ3bkEyYjJSelQ4RUNHWDVXRk11NjIw\nOXNuMmgyTG9Mdm45Kzg1VGxMT3dNVjB5Q1hINkRmQlA2ZjNnY3NTZENEcGtVVTM0\nSXNyRVUzWDJpWXo3SDh4YXNUSHFHMXBYMElMRitSZHIvWmRrUDM1UzM1SFQ5Zjk4\nM09ISEJOVWNNV21TRzd5dHcraDVESGhmYkZhTDRGc1k0Ym1JYnhGVzdVWjJ3QWJ4\nZjg0eFdYVFcwbUhSd1k3TitOMTEySmgyYjZuRUc3WE8wZm9yQTVQaFZ1OWRDbWJn\nUmtSOUhMQnRyYUp6VDJHQkx4WDczVnQ5NXJtcElmamt4dWlFR0tOVWZLMmZJV2gw\nM1ovRUFEUEkzT3BYMFVFOFRTY0p1aklCOHZRSlVsTHIxOWM0N05kd0pZbit0b3c3\nUytibU9sS0FBVlY3SVJZSzFFNSt3bjNYUHBGY3ZvdVdyUTh5YjVFaEtuekJMUQpo\nS2tiUm1WcTFsaFZ1QnJYVTlRUGV0aGpGNGFMRlpRT0hBcHBzYmx0L3hRCi0tLSAv\nYnREWHZOWVgycVhLNWFHTWtWOWJBUEMvTEtsU1NCL0ladUZPTXdxeWpFCnlX9MsP\nsogBElxC47ExwKRLfqwMmMaJPxWO/DSUG5efWuF0HXKaI8lf/2CkSeFc8DZ/EsVt\n1CiQprsuOIYxm2g=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1pq1j9s5vrzev6x5ygv7fpqjc0pr82wfht0y8xh69n9my9gcp9nqepdmraef40t9fqfejzxydgz2kvkrkrvcjrq7esrgmvg846yutqwq54eq8u2pfndrktpvfuch6yp6awzssav6c5zy4gsf4qg4aw59sl5scgxukp5q54defavf0vavc9h3slr3v5q8zfhzmsuvcqpfsq7hstvye3mcj0zhyvyjr0ztjgzgh2scx6tfavh72cp4h2zg7wcudfls8xaydx2e3hxxdrq9dkkstcg5xtrzh9elfuscpx5qgzduc693t8r35yj359f2kp35pv56wkfdzag5ganzz6s0gud4kfcehxylrfxewxk52dj0wkxv2dex0u530yz5cs5nq290unm44zl6h0htyjnuj54hwv44xtehyd6334tzp3j62gu7qwrsrytquuu4wzl4wr4cgymrq7axxqd2ga688fvexh0fg5re83arrrxpd0ws9du78t70lpkwgwswp82njhemdger2n8avdx27dqwt9zyvf3hg5udrzlr63uv93p2z53k6rmg355pjldvhvr294cjtsg80wh2x9cqv8dv895dzpryv8n4w2lgyk6zn97zyfc8y4xyc7t659fc53n8yq79x4fhckaa0a68ege2ezsahxapwm8hregmfden9sq6vmhmfx222fe5a0zjuhq3vu25r70fez7vqdgh8gjl942s4z8gjlfvcjj22zz3rgedvlve0xdyzn7m8ydke3lw4kfzs959m2gpeay8pq738jn6lg5gdvcx7zdgthn4hd42jrxnyegu5u6e57ugwljk4s3mr3xp9rytmt58m8hjrjh6d9sdd3yzgzd6zxjx56tg80vh02pwjjn4svtc34e92v22df5axkf9ujnul6nr7uf9spjyqywddqvwcet4gvc7kp4errrpcas9vl73kn9ef9y4leamd3l2reg8vf6vlgpc4fv6v05varv6px9ugssjzjmnt6xx0ss3mv55dajqjfxlqf6zsz3dsx6ywe8nry9rsrs0yw9xurzzxv5pal0x9rqagzeu7x9jven3y7eywycmsslfyj8s2dwnr33x03j4phvyh08tggq9ku7wk3kp6n3904qtphp3zvwuv6u8e6e206gqc4xzx78c2r5yrzu9g9rrylycjth25x0mx5fwqu0kuxkzz6xv50tuklq4wxyrc2fn8vzt9xvshv2fv6ts5flz2zkk0s6uxm69vzgg04pzwufzueawuhq0gsfv0ez88f4lexhvuxgsz6uz3cnsqgpe5sq7vfndlvqu3aw26tm59235p82cve5ztq4yn24sevsnw2zcfmhu54cgd2mta633qvrmgzyu4wfgxlzss4k837p2z4zqcz6gguawq5k0hvp0v3yufv22hnefd0c6kjrpfxdzmpeaaf5q6e6hwnppsvv9w9axrq2v5xu62rmt2cn5q9kfsy6epa95rpxxcwk2hhz7hrcs9s2nmsm7nyckt923h7xcsteuqwa0m7t45eqfpjv3px3nfjlf0v5wndfyzs9cplj50fvr8jfre274cgukkhev59ukh4mrrwnuzjcfcgt54xyeyq6qp86p9vduq7lpt6z40utmudapjrawjswhvc7v8z436yanktf8r59ppg33nw6w453ze8vpqmkpxmszcyjmjjlv3g6vslznvy25sv3upx4thdjeyk665q5pdzps246zs6vz5etjppn7zwz4ggd5eh6gs87a750f46aqp3amphs9jh2w4q46x96feg9xra9zshnvsj7drrmev7n89zgcglvusr8sfaryjj28jcjhue6dqh53ty7kslg26629zduzy8x6laqqr050m6zeeeaq2vpxh26hhz8d3zz57azm52yp4rlca4kpmhqg9nscl49ujetpgu4e0wvwtvcl2g8s"
+			}
+		],
+		"lastmodified": "2026-10-09T01:20:35Z",
+		"mac": "ENC[AES256_GCM,data:j1bNOMpa+ggERenXKnoFdk71zR5v8UxTmX57BuVwieGHZ6EVf0E5rXCu1MyKfOY83H/quiNUaUUCcvrtFf91pOUvdv9YDD7uCMYtfTqBZLLkPXBWfLUDMRkIRxA0LqUAvVcO1Ug3r6Z9S0OoEfAn4kXHPXVNyDENcOElKb4Kar0=,iv:Nk39y1WFsXjFMd6SrqF1ygJu1NRGAfMKSwCVUBq+Rc8=,tag:kFXtggLt8h/GfANB2lsw2w==,type:str]",
+		"version": "3.13.3"
+	}
+}
diff --git a/shell.nix b/shell.nix
index 21614e1c..869eef7d 100644
--- a/shell.nix
+++ b/shell.nix
@@ -18,7 +18,7 @@ pkgs.stdenv.mkDerivation {
   nativeBuildInputs = with pkgs; [
     git
     age
-    # sops
+    sops
 
     # Nix management
     nixd

Run: bash -c set -xeuo pipefail nix flake check -L --show-trace

Command arguments:

In directory: /var/lib/radicle-ci/adapters/native/native/dcc1d408-ad50-4834-831b-fd58f117ab35/src

Exit code: 0

Output (stdout and stderr):

+ nix flake check -L --show-trace
GC Warning: Could not open /proc/stat
warning: ignoring untrusted flake configuration setting 'experimental-features'.
Pass '--accept-flake-config' to trust it
evaluating flake...
checking flake output 'hydraJobs'...
checking Hydra job 'hydraJobs'...
checking Hydra job 'hydraJobs.Varlam'...
checking derivation hydraJobs.Varlam...
derivation evaluated to /nix/store/hjfqvj2i1qp5w0gf6g98cbz5xy7dk7iv-nixos-system-Varlam-26.05.20261008.7c8764b.drv
checking flake output 'lib'...
checking flake output 'overlays'...
checking overlay 'overlays.modifications'...
checking overlay 'overlays.unstable-packages'...
checking overlay 'overlays.additional-packages'...
checking flake output 'checks'...
checking derivation checks.x86_64-linux.pre-commit-check...
derivation evaluated to /nix/store/k64yxmqfxi8rap01mzvqlvwcs3qzsx77-pre-commit-run.drv
checking flake output 'formatter'...
checking derivation formatter.x86_64-linux...
derivation evaluated to /nix/store/c58lfjs7qhwz62dsq0pv4i8d87fx6ng7-pre-commit-run.drv
checking flake output 'devShells'...
checking derivation devShells.x86_64-linux.default...
derivation evaluated to /nix/store/kqz86avakhza1fgc4nmdifv40cra8y8g-instances.drv
checking flake output 'nixosModules'...
checking NixOS module 'nixosModules.minecraft'...
checking NixOS module 'nixosModules.users'...
checking NixOS module 'nixosModules.base'...
checking NixOS module 'nixosModules.bind'...
checking NixOS module 'nixosModules.postfix'...
checking NixOS module 'nixosModules.nginx'...
checking NixOS module 'nixosModules.navidrome'...
checking NixOS module 'nixosModules.extra'...
checking NixOS module 'nixosModules.radicle'...
checking NixOS module 'nixosModules.tuwunel'...
checking NixOS module 'nixosModules.apps'...
checking NixOS module 'nixosModules.runner'...
checking flake output 'nixosConfigurations'...
checking NixOS configuration 'nixosConfigurations.Varlam'...
running 1 flake checks...
building '/nix/store/k64yxmqfxi8rap01mzvqlvwcs3qzsx77-pre-commit-run.drv'...
pre-commit-run> Sourcing pytest-check-hook
pre-commit-run> Using pytestCheckPhase
pre-commit-run> Running phase: unpackPhase
pre-commit-run> unpacking source archive /nix/store/ih975rrsz5crg773wifc6w6gxwkv9fkw-ci8ahfhhj0r5kg195hyx3dykmymlv2fh-source
pre-commit-run> source root is ci8ahfhhj0r5kg195hyx3dykmymlv2fh-source
pre-commit-run> Running phase: patchPhase
pre-commit-run> Running phase: updateAutotoolsGnuConfigScriptsPhase
pre-commit-run> Running phase: configurePhase
pre-commit-run> no configure script, doing nothing
pre-commit-run> Running phase: buildPhase
pre-commit-run> Running: $ pre-commit run --all-files
pre-commit-run> deadnix..................................................................Passed
pre-commit-run> nixfmt...................................................................Passed
pre-commit-run> statix...................................................................Passed
all checks passed!
warning: The check omitted these incompatible systems: aarch64-darwin
Use '--all-systems' to check all.