Scaffold self-hosted F-Droid repo tooling

Nix flake dev shell (fdroidserver + jdk + rsync), a NixOS module for
serving the repo via nginx/ACME, and a sync script for publishing updates.

nixos-module.nix

@@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.fdroidRepo;
+in {
+  options.services.fdroidRepo = {
+    enable = mkEnableOption "static F-Droid repo hosting via nginx";
+
+    domain = mkOption {
+      type = types.str;
+      description = "Domain the repo is served from, e.g. apps.example.com";
+    };
+
+    repoPath = mkOption {
+      type = types.path;
+      default = "/var/lib/fdroid-repo";
+      description = "Directory containing the synced repo/ output (index-v1.json, index-v2.json, apks, icons).";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.nginx = {
+      enable = true;
+      virtualHosts.${cfg.domain} = {
+        enableACME = true;
+        forceSSLRedirect = true;
+        root = cfg.repoPath;
+      };
+    };
+
+    # Requires security.acme.defaults.email and security.acme.acceptTerms = true
+    # to be set in your top-level NixOS config.
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.repoPath} 0755 nginx nginx -"
+    ];
+  };
+}