The nixos_flake_info metric's current_rev label was incorrectly showing
the nixpkgs input revision (from /run/current-system/nixos-version)
instead of the flake's own revision.
Now reads from /run/current-system/configuration-revision which contains
the flake's self.rev when system.configurationRevision is set in the
NixOS configuration.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add a new info metric that exposes the current system's flake revision
and the latest remote revision as labels. This makes it easier to see
exactly which revision is deployed vs available.
Also adds version constant to Go code and extracts it in flake.nix,
providing a single source of truth for the version.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The flake collector needs Unix domain sockets to communicate with the
nix daemon. The RestrictAddressFamilies hardening was blocking this.
Also trim trailing newlines from stderr in error messages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Capture stderr from nix flake metadata to show the actual error
message instead of just "exit status 1".
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add 30-second timeout to nix flake metadata command to prevent hanging
on slow or unresponsive remotes. Add HTTP server timeouts (read, write,
idle) to protect against slowloris-style attacks.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
