nixpkgs: switch to read-only packages

Signed-off-by: Bloxx12 <charlie@charlieroot.dev>
Change-Id: I6a6a69641b8369b151024324d8d06f2acb790c15

default.nix

@@ -1,5 +1,5 @@
 let
-  inherit (builtins) currentSystem filter mapAttrs;
+  inherit (builtins) filter mapAttrs;
 
   # https://github.com/andir/npins?tab=readme-ov-file#using-the-nixpkgs-fetchers
   src = import ./npins;
@@ -20,10 +20,7 @@ let
       modules = [
         # This is used to pre-emptively set the hostPlatform for nixpkgs.
         # Also, we set the system hostname here.
-        {
-          networking.hostName = hostname;
-          nixpkgs.hostPlatform = system;
-        }
+        { networking.hostName = hostname; }
         ./hosts/common.nix
         ./hosts/${hostname}
       ]

modules/system/nix/nixpkgs.mod.nix

@@ -1,18 +1,32 @@
-# taken from raf
-{ sources, ... }:
 {
-  # Global nixpkgs configuration.
-  # This is ignored if nixpkgs.pkgs is set, which should be avoided.
-  nixpkgs = {
-    flake = {
-      source = sources.nixpkgs;
-      setFlakeRegistry = true;
-      setNixPath = true;
+  lib,
+  sources,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib.options) mkOption;
+  inherit (lib.types) str;
+in
+{
+  imports = [
+    # Going full schizo
+    "${sources.nixpkgs}/nixos/modules/misc/nixpkgs/read-only.nix"
+  ];
+
+  options.nixpkgs.system = mkOption {
+    type = str;
+    default = pkgs.system;
+    readOnly = true;
   };
 
+  config.nixpkgs.pkgs = (
+    import sources.nixpkgs {
+      hostPlatform = pkgs.stdenv.hostPlatform;
+      overlays = [ ];
+      config = {
         # Configuration reference:
         # <https://nixos.org/manual/nixpkgs/unstable/#chap-packageconfig>
-    config = {
         # Disallow broken packages to be built.
         allowBroken = false;
 
@@ -43,5 +57,6 @@
         #  See: <https://github.com/NixOS/nixpkgs/blob/master/pkgs/stdenv/generic/check-meta.nix>
         showDerivationWarnings = [ ];
       };
-  };
+    }
+  );
 }