Update download.nix

deploy/nixos/download.nix

@@ -7,12 +7,6 @@
 let
   cfg = config.services.download;
 
-  # The source tree the package is built from. By default it follows
-  # `workingDir` (the boot-cloned/pulled checkout) so `deployOnBoot` actually
-  # updates the built binary on the next rebuild; a caller may pin an explicit
-  # `src` path instead (e.g. from a flake) to build reproducibly.
-  sourcePath = if cfg.src != null then cfg.src else /. + cfg.workingDir;
-
   # ---- Backend: Rust binary built with nixpkgs cargo hooks (offline-safe). ----
   filehostBackend = pkgs.rustPlatform.buildRustPackage {
     pname = "filehost";
@@ -20,26 +14,23 @@ let
 
     # The repository root (backend/ + frontend/). `cargoRoot` points the build
     # at backend/Cargo.toml while keeping the rest of the tree available.
-    src = sourcePath;
+    src = cfg.src;
     cargoRoot = "backend";
 
+    # Build/test from the backend/ subdirectory. `cargoRoot` locates the
+    # Cargo.lock/vendor, `buildAndTestSubdir` points cargo at backend/Cargo.toml.
+    buildAndTestSubdir = "backend";
+
     # Derive the dependency hash automatically from the checked-in
     # backend/Cargo.lock (version 4; all deps are crates.io registry entries, so
     # no extra outputHashes are needed). No manual cargoHash to maintain.
-    cargoLock.lockFile = sourcePath + "/backend/Cargo.lock";
+    cargoLock.lockFile = "${cfg.src}/backend/Cargo.lock";
 
     buildInputs = [ ];
     nativeBuildInputs = with pkgs; [ ];
 
     # We only need the binary; disable tests to keep the closure small.
     doCheck = false;
-
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/bin
-      install -Dm755 target/release/filehost $out/bin/filehost
-      runHook postInstall
-    '';
   };
 
   # ---- Frontend: Svelte static assets built with node/npm. ----
@@ -47,11 +38,11 @@ let
     pname = "filehost-frontend";
     version = "1.0.0";
 
-    src = sourcePath;
+    src = cfg.src;
 
     nativeBuildInputs = with pkgs; [
+      # `nodejs` ships `npm`/`npx` in its own bin/ (Node 24 bundles npm).
       nodejs
-      (nodejs.pkgs.npm or nodePackages.npm)
     ];
 
     # `npm install` needs writable dirs that default to the source; redirect
@@ -78,13 +69,12 @@ in
   options.services.download = {
     enable = lib.mkEnableOption "the File Drop private file host";
 
-    # Optional: pin an explicit source path. When unset (default), the package
-    # is built from `workingDir` so `deployOnBoot` (git pull + rebuild) actually
-    # updates the binary.
+    # The source tree (backend/ + frontend/) the package is built from. Provide
+    # a flake-local path (e.g. `src = ./.` or a `fetchFromGitHub` result) so the
+    # build stays pure and reproducible.
     src = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
-      description = "Path to the download source tree (backend/ + frontend/). Defaults to workingDir.";
+      type = lib.types.path;
+      description = "Path to the download source tree (backend/ + frontend/).";
     };
 
     user = lib.mkOption {
@@ -226,8 +216,8 @@ in
           git -C ${cfg.workingDir} pull --ff-only
         fi
 
-        # Apply the freshly-pulled code. If the source is pinned via `src`,
-        # nothing changed on disk, but the rebuild is still harmless.
+        # Apply the freshly-pulled code via a rebuild. The built binary comes
+        # from `services.download.src` (flake) and is rebuilt by this command.
         ${cfg.rebuildCommand}
       '';
     };