From 81319cee4f4a4dc7ee3c8ce85d5a575c167f9650 Mon Sep 17 00:00:00 2001
From: randogoth <kflux@posteo.de>
Date: Mon, 12 Oct 2026 17:58:09 +0300
Subject: [PATCH] Scaffold self-hosted F-Droid repo tooling

Nix flake dev shell (fdroidserver + jdk + rsync), a NixOS module for
serving the repo via nginx/ACME, and a sync script for publishing updates.
---
 .gitignore       |  7 +++++++
 flake.lock       | 27 +++++++++++++++++++++++++++
 flake.nix        | 16 ++++++++++++++++
 nixos-module.nix | 40 ++++++++++++++++++++++++++++++++++++++++
 sync.sh          | 16 ++++++++++++++++
 5 files changed, 106 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 flake.lock
 create mode 100644 flake.nix
 create mode 100644 nixos-module.nix
 create mode 100755 sync.sh

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..2c837ac
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,7 @@
+keystore.p12
+config.yml
+repo/
+unsigned/
+archive/
+tmp/
+stats/
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..915f6ef
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1791594108,
+        "narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..7dfdeca
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,16 @@
+{
+  description = "Self-hosted F-Droid repo tooling";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+  outputs = { self, nixpkgs }:
+    let
+      pkgs = nixpkgs.legacyPackages.x86_64-linux;
+    in {
+      devShells.x86_64-linux.default = pkgs.mkShell {
+        buildInputs = [ pkgs.fdroidserver pkgs.rsync pkgs.jdk ];
+      };
+
+      nixosModules.fdroid-repo = import ./nixos-module.nix;
+    };
+}
diff --git a/nixos-module.nix b/nixos-module.nix
new file mode 100644
index 0000000..4ef5572
--- /dev/null
+++ b/nixos-module.nix
@@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.fdroidRepo;
+in {
+  options.services.fdroidRepo = {
+    enable = mkEnableOption "static F-Droid repo hosting via nginx";
+
+    domain = mkOption {
+      type = types.str;
+      description = "Domain the repo is served from, e.g. apps.example.com";
+    };
+
+    repoPath = mkOption {
+      type = types.path;
+      default = "/var/lib/fdroid-repo";
+      description = "Directory containing the synced repo/ output (index-v1.json, index-v2.json, apks, icons).";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.nginx = {
+      enable = true;
+      virtualHosts.${cfg.domain} = {
+        enableACME = true;
+        forceSSLRedirect = true;
+        root = cfg.repoPath;
+      };
+    };
+
+    # Requires security.acme.defaults.email and security.acme.acceptTerms = true
+    # to be set in your top-level NixOS config.
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.repoPath} 0755 nginx nginx -"
+    ];
+  };
+}
diff --git a/sync.sh b/sync.sh
new file mode 100755
index 0000000..e9063f2
--- /dev/null
+++ b/sync.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Usage: ./sync.sh user@host:/var/lib/fdroid-repo
+# Regenerates the index, then rsyncs repo/ to the serving host.
+
+cd "$(dirname "$0")"
+
+fdroid update -c
+
+if [ $# -lt 1 ]; then
+  echo "Usage: $0 user@host:/var/lib/fdroid-repo" >&2
+  exit 1
+fi
+
+rsync -av --delete repo/ "$1/"