Scaffold self-hosted F-Droid repo tooling

Nix flake dev shell (fdroidserver + jdk + rsync), a NixOS module for
serving the repo via nginx/ACME, and a sync script for publishing updates.

.gitignore

@@ -0,0 +1,7 @@
+keystore.p12
+config.yml
+repo/
+unsigned/
+archive/
+tmp/
+stats/

flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1791594108,
+        "narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,16 @@
+{
+  description = "Self-hosted F-Droid repo tooling";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+  outputs = { self, nixpkgs }:
+    let
+      pkgs = nixpkgs.legacyPackages.x86_64-linux;
+    in {
+      devShells.x86_64-linux.default = pkgs.mkShell {
+        buildInputs = [ pkgs.fdroidserver pkgs.rsync pkgs.jdk ];
+      };
+
+      nixosModules.fdroid-repo = import ./nixos-module.nix;
+    };
+}

nixos-module.nix

@@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.fdroidRepo;
+in {
+  options.services.fdroidRepo = {
+    enable = mkEnableOption "static F-Droid repo hosting via nginx";
+
+    domain = mkOption {
+      type = types.str;
+      description = "Domain the repo is served from, e.g. apps.example.com";
+    };
+
+    repoPath = mkOption {
+      type = types.path;
+      default = "/var/lib/fdroid-repo";
+      description = "Directory containing the synced repo/ output (index-v1.json, index-v2.json, apks, icons).";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.nginx = {
+      enable = true;
+      virtualHosts.${cfg.domain} = {
+        enableACME = true;
+        forceSSLRedirect = true;
+        root = cfg.repoPath;
+      };
+    };
+
+    # Requires security.acme.defaults.email and security.acme.acceptTerms = true
+    # to be set in your top-level NixOS config.
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.repoPath} 0755 nginx nginx -"
+    ];
+  };
+}

sync.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Usage: ./sync.sh user@host:/var/lib/fdroid-repo
+# Regenerates the index, then rsyncs repo/ to the serving host.
+
+cd "$(dirname "$0")"
+
+fdroid update -c
+
+if [ $# -lt 1 ]; then
+  echo "Usage: $0 user@host:/var/lib/fdroid-repo" >&2
+  exit 1
+fi
+
+rsync -av --delete repo/ "$1/"