Use new bind mounts

.gitea/workflows/build-image.yml

@@ -1,10 +1,40 @@
 name: Build image
 on:
-  pull_request:
+  push:
+    tags:
+      - 'v*'
 jobs:
   build-image:
-    runs-on: nix
+    container:
+      image: node:24-bookworm
+      env:
+        USER: node
+        HOME: /home/node
+        NIX_CONFIG: experimental-features = nix-command flakes
+      volumes:
+        - /var/lib/pbri/docker/nix_runner_nix:/nix
+        - /var/lib/pbri/docker/nix_runner_etc:/etc/nix
+        - /var/lib/pbri/docker/nix_runner_home_node:/home/node
+      options: --user 1000:1000
     steps:
+      - name: Prep nix env
+        run: |
+          if [ ! -f ~/.nix-profile/etc/profile.d/nix.sh ]; then
+            curl -L https://nixos.org/nix/install | bash -s -- --no-daemon
+          fi
+          . ~/.nix-profile/etc/profile.d/nix.sh 
+          env >> "$GITHUB_ENV"
       - name: Checkout repo
         uses: actions/checkout@v4
-      - run: ls -lah
+      - name: Get image meta
+        run: nix build .#image-meta -o image-meta
+      - name: Version check
+        run: |
+          VERSION=$(cat image-meta/version)
+          [ "$GITHUB_REF_NAME" = v"$VERSION" ]
+      - run: nix build --log-format raw --print-build-logs .#image -o image.tar.gz
+      - run: gunzip -c image.tar.gz > image.tar
+      - run: nix run .#crane -- auth login git.pbrinkmeier.de -u paul -p "$PASSWORD"
+        env:
+          PASSWORD: "${{ secrets.REGISTRY_PASSWORD }}"
+      - run: nix run .#crane -- push image.tar $(cat image-meta/name)

flake.nix

@@ -16,15 +16,22 @@
 
       vrnp-static = pkgs.buildGoModule {
         pname = "vrnp";
-        version = "0.0.10";
+        version = "0.0.10-bindmounts";
         vendorHash = null;
 
         # For building the package, we use only the files not ignored by Git as inputs.
-        # Also, flake.nix and flake.lock are not included to avoid annoying rebuilds when
+        # Also, flake.nix, flake.lock and .gitea are not included to avoid annoying rebuilds when
         # working on them.
         src = pkgs.lib.cleanSourceWith {
-          src = gitignore.lib.gitignoreSource ./.;
+          src = ./.;
-          filter = path: type: builtins.baseNameOf path != "flake.nix" && builtins.baseNameOf path != "flake.lock";
+          filter = gitignore.lib.gitignoreFilterWith {
+            basePath = ./.;
+            extraRules = ''
+              flake.nix
+              flake.lock
+              .gitea
+            '';
+          };
         };
 
         # Avoid linking against libc
@@ -55,6 +62,12 @@
           config.Cmd = [ "${vrnp-static}/bin/vrnp" ];
         };
       };
+      apps = {
+        crane = {
+          type = "app";
+          program = "${pkgs.crane}/bin/crane";
+        };
+      };
     }
   );
 }