[kwsantiago]

NixOS module:

• The generated config now reaches wisp as a systemd credential (LoadCredential), so the relay's command line names /run/credentials/... rather than a store path.
• New services.wisp.settingsFile: the absolute path to an extra config file kept outside the Nix store, for example root-owned 0600. It is loaded as a second credential and joined after settings into a 0600 file under /run/wisp. Its keys override settings. Firewall, sandbox and network ordering are still decided from settings only.
• The VM test adds a secret node that covers settingsFile: the override, a leading top-level key not breaking [storage], the joined file's mode, and the command line.

CI nix job:

• The Nix installer is downloaded once and checked against a pinned sha256 before the action runs it. The installer itself checks the tarball hash.
• The CI user is no longer a trusted Nix user. accept-flake-config = false, require-sigs = true, and only cache.nixos.org as substituter and key.
• The module VM test (checks.x86_64-linux.wisp-module) runs on pushes to main and on pull requests that touch nix/, flake.nix, flake.lock or the workflow. The job timeout is raised to 30 minutes.

Verified locally: nix build .#, nix flake check (VM test) and scripts/verify-nix-deps.sh pass.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 4 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6e2b205d-9284-421c-83c3-6d72ddd252a1

📥 Commits

Reviewing files that changed from the base of the PR and between 5376112 and 704fec5.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• CHANGELOG.md
• nix/module.nix
• nix/test.nix

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}