common: *licks the infra*

Since Lix is now in nixpkgs-unstable-small, I think it's a good time to
use it. This does mean that we now pull in our nix implementation from
an unstable channel, but overall I'm more confident in the Lix team's
ability to not break things than I am in the Nix team's ability to
backport (& then actually release) security updates.

(once Lix is on a stable channel, we can switch back to using it from there)

common/default.nix

@@ -15,6 +15,7 @@
     SystemMaxUse=512M
     MaxRetentionSec=48h
   '';
+  nix.package = pkgs.lix;
   nix.gc.automatic = lib.mkDefault true;
   nix.gc.options = lib.mkDefault "--delete-older-than 7d";
   nix.settings.trusted-users = [ "root" "@wheel" ];

pkgs/default.nix

@@ -21,6 +21,9 @@ let
     uffd = oldstable.callPackage ./uffd { };
 
     inherit (oldstable) uwsgi flask;
+
+    # TODO: once on nixos 24.05, remove this inherit
+    inherit (unstable) lix;
   };
 
 in pkgs.extend(_: _: newpkgs)