nix: module + flake cannot boot a real instance (secrets inert, ReadWritePaths, broken test, no flake.lock/CI)

[forkwright]

Finding

The NixOS module (nix/module.nix) and flake cannot boot a real harmonia instance — verified against the tree, several independent breaks.

Evidence

• Secrets mechanism is inert: the module sets HARMONIA_SECRETS_PATH via LoadCredential, but no Rust code reads that variable (repo-wide grep: only nix/module.nix + docs reference it). secrets.toml is resolved as a sibling of the config file (crates/horismos/src/secrets.rs:4-9), which the module places in the read-only Nix store — so there is no working path to supply the REQUIRED exousia.jwt_secret except raw HARMONIA__EXOUSIA__JWT_SECRET, which the module does not plumb. A fresh instance will not start (jwt_secret is a hard boot validation).
• ReadWritePaths omits ergasia.download_dir (and komide.podcast_dir); with ProtectSystem=strict, validate_download_dir (crates/archon/src/serve.rs:2426-2456) fails → boot fails even with valid config.
• nix/tests/module-test.nix asserts the service comes up with settings that cannot pass validation (no jwt_secret, no download dir) — the flake check must fail if ever run.
• No flake.lock is committed and no .github/workflows/ job runs any nix build/check — nothing exercises the flake, so the breaks went unnoticed.
• docs/nix-deployment.md full-config example is invalid against the schema (media_type = "audiobook" — enum is music|video|book; epignosis.musicbrainz_user_agent — field does not exist, deny_unknown_fields → parse error).

Why this matters

Deployment packaging is a step on the path to a usable instance. The module presents as the fleet-proper deploy unit but cannot produce a booting service; anyone following it hits a wall, and the missing flake.lock + nix CI mean it silently rots. A plain systemd unit + config works today (the HTTP acquisition loop is functional on origin/main), so this blocks the declarative deploy, not all deploys.

Desired correction

• Honor HARMONIA_SECRETS_PATH in horismos (read the credential file as the secrets source), or plumb HARMONIA__EXOUSIA__JWT_SECRET from the module.
• Extend ReadWritePaths from ergasia.download_dir + komide.podcast_dir.
• Fix module-test.nix to a config that actually validates (jwt_secret + a writable download dir); commit flake.lock; add a nix build/check CI job so the module cannot re-rot.
• Correct docs/nix-deployment.md against the real schema.

Done when: nixos-rebuild/the flake check boots a harmonia service that passes config validation, in CI.

[forkwright]

Reopening — PR #619 landed the secrets fix + module/doc repairs, but this issue's acceptance (a nix build that boots a real instance, verified in CI) is not met. Auto-closed by a stray Closes #610 carried in the squashed commit body; corrected here.

Landed in #619 (gate-verified):

• crates/horismos/src/secrets.rs: secrets_path() honors HARMONIA_SECRETS_PATH — the systemd LoadCredential delivery path — so the module's secrets are no longer inert. 3 tests (env wins / absent / blank).

Landed in #619 (NOT boot-verified — metis has no nix toolchain):

• nix/module.nix: ReadWritePaths extended with the ergasia download dir + komide podcast dir (+ tmpfiles to create them).
• nix/tests/module-test.nix: supplies a valid 32-byte jwt_secret via the now-working credential path.
• docs/nix-deployment.md: schema errors corrected (invalid media_type, nonexistent field, required per-library fields).

Remaining (operator-gated — this is why the issue stays open):

1. Commit flake.lock — missing from the tree; needs a nix toolchain (nix flake lock) to generate. metis has none.
2. Add a nix flake check CI job — an ask-first .github/workflows/ change; it's what actually verifies the three nix edits above boot. Proposed job body is in the chore(docs,nix,horismos): delete fabricated-feature docs and repair the NixOS module #619 description.

Done when: flake.lock is committed and a nix flake check CI job passes against the module.

[forkwright]

Most of this is already resolved on origin/main (verified this pass):

• horismos::secrets::secrets_path reads HARMONIA_SECRETS_PATH and prioritizes it over the config-sibling default.
• nix/module.nix ReadWritePaths already includes downloadDir + podcastDir.
• nix/tests/module-test.nix supplies a valid 32+ byte secretsFile via LoadCredential + HARMONIA_SECRETS_PATH; its own comment cites "as of nix: module + flake cannot boot a real instance (secrets inert, ReadWritePaths, broken test, no flake.lock/CI) #610" as resolved.
• docs/nix-deployment.md uses a valid media_type = "audiobook" and no longer references the invalid epignosis.musicbrainz_user_agent field.

Two genuine gaps remain, both requiring actual nix-tooling invocation (not edit-only-fixable): (1) no committed flake.lock (nix flake lock resolves real network hashes); (2) no nix build/check CI job (must be tested against a real nix build). Suggest narrowing this issue to those two.