Update download.nix

deploy/nixos/download.nix

@@ -34,33 +34,23 @@ let
   };
 
   # ---- Frontend: Svelte static assets built with node/npm. ----
-  filehostFrontend = pkgs.stdenv.mkDerivation {
+  filehostFrontend = pkgs.buildNpmPackage {
     pname = "filehost-frontend";
     version = "1.0.0";
 
-    src = cfg.src;
+    # Build from the frontend/ subdirectory (contains package.json + lock).
+    src = "${cfg.src}/frontend";
 
-    nativeBuildInputs = with pkgs; [
-      # `nodejs` ships `npm`/`npx` in its own bin/ (Node 24 bundles npm).
-      nodejs
-    ];
+    # Hash of the npm dependency fetch (generated from frontend/package-lock.json).
+    npmDepsHash = "sha256-ec2rDPuTIGOMdx7oHq+At1Fez6WFCVnFaYydzVF+5Ws=";
 
-    # `npm install` needs writable dirs that default to the source; redirect
-    # caches so the build stays sandbox-friendly.
-    npm_config_cache = "/tmp/npm-cache";
-
-    buildPhase = ''
-      runHook preBuild
-      cd frontend
-      npm install --no-audit --no-fund
-      npm run build
-      runHook postBuild
-    '';
+    # The default npm build script is `build` (vite build).
+    npmBuildScript = "build";
 
     installPhase = ''
       runHook preInstall
       mkdir -p $out/share/filehost
-      cp -r frontend/dist $out/share/filehost/dist
+      cp -r dist $out/share/filehost/dist
       runHook postInstall
     '';
   };
@@ -210,6 +200,13 @@ in
 
       script = ''
         set -euo pipefail
+
+        # The service runs as root but the checkout is owned by another user;
+        # allow git to operate on it without a persistent global config.
+        export GIT_CONFIG_COUNT=1
+        export GIT_CONFIG_KEY_0=safe.directory
+        export GIT_CONFIG_VALUE_0="${cfg.workingDir}"
+
         if [ ! -d "${cfg.workingDir}/.git" ]; then
           git clone ${cfg.repoUrl} ${cfg.workingDir}
         else