Fix Matrix package references to use nixpkgs-unstable

Matrix packages (mautrix-*, matrix-continuwuity) only exist in
nixpkgs-unstable, not in nixpkgs 24.05 stable. This commit updates
all module defaults and references to use pkgs-unstable.

Changes:
- Add pkgs-unstable to module function signatures (4 modules)
- Update package option defaults from pkgs.* to pkgs-unstable.*
- Configure pkgs-unstable in flake.nix to permit olm-3.2.16
- Add VM config permittedInsecurePackages for olm (mautrix dependency)

The olm library is deprecated with known CVEs but required by mautrix
bridges. This is acceptable for testing; production should migrate to
newer cryptography implementations when available.

This maintains our stable base system (NixOS 24.05) while using
unstable only for Matrix ecosystem packages under active development.

flake.nix

@@ -35,7 +35,12 @@
         specialArgs = {
           pkgs-unstable = import nixpkgs-unstable {
             system = "x86_64-linux";
-            config.allowUnfree = true;
+            config = {
+              allowUnfree = true;
+              permittedInsecurePackages = [
+                "olm-3.2.16"  # Required by mautrix bridges (VM testing only)
+              ];
+            };
           };
         };
         modules = [

hosts/ops-jrz1-vm.nix

@@ -15,6 +15,13 @@
     # Note: Skip matrix-secrets for VM (no sops-nix in VM)
   ];
 
+  # Allow deprecated olm library for Matrix bridges (VM testing only)
+  # Note: olm is deprecated with known CVEs but required by mautrix bridges
+  # This is acceptable for local testing; production should migrate to newer crypto
+  nixpkgs.config.permittedInsecurePackages = [
+    "olm-3.2.16"
+  ];
+
   # VM-specific settings
   networking.hostName = "ops-jrz1-vm";
 

modules/dev-services.nix

@@ -1,5 +1,5 @@
 # Development services module - Matrix, Forgejo, and Slack bridge
-{ config, pkgs, lib, ... }:
+{ config, pkgs, pkgs-unstable, lib, ... }:
 
 with lib;
 
@@ -130,7 +130,7 @@ in
         # Load secrets via systemd credentials (proper way for DynamicUser)
         LoadCredential = "matrix-registration-token:/run/secrets/matrix-registration-token";
 
-        ExecStart = "${pkgs.matrix-continuwuity}/bin/conduwuit -c /var/lib/matrix-continuwuity/continuwuity.toml";
+        ExecStart = "${pkgs-unstable.matrix-continuwuity}/bin/conduwuit -c /var/lib/matrix-continuwuity/continuwuity.toml";
 
         Restart = "always";
         RestartSec = "10s";
@@ -199,7 +199,7 @@ in
     # mautrix-slack bridge
     services.mautrix-slack = mkIf cfg.slackBridge.enable {
       enable = true;
-      package = pkgs.mautrix-slack or (pkgs.callPackage ../pkgs/mautrix-slack {});
+      package = pkgs-unstable.mautrix-slack or (pkgs-unstable.callPackage ../pkgs/mautrix-slack {});
 
       matrix = {
         homeserverUrl = "http://localhost:${toString cfg.matrix.port}";

modules/mautrix-gmessages.nix

@@ -1,6 +1,6 @@
 # mautrix-gmessages Matrix-Google Messages bridge
 # Bridges Google Messages (RCS/SMS/MMS) to Matrix via web interface
-{ config, pkgs, lib, ... }:
+{ config, pkgs, pkgs-unstable, lib, ... }:
 
 with lib;
 
@@ -119,7 +119,7 @@ in
 
     package = mkOption {
       type = types.package;
-      default = pkgs.mautrix-gmessages;
+      default = pkgs-unstable.mautrix-gmessages;
       description = "Package providing the bridge executable.";
     };
 

modules/mautrix-slack.nix

@@ -1,7 +1,7 @@
 # mautrix-slack Matrix-Slack bridge
 # Bridges Slack to Matrix via appservice
 # Implementation follows mautrix-gmessages pattern for config management
-{ config, pkgs, lib, ... }:
+{ config, pkgs, pkgs-unstable, lib, ... }:
 
 with lib;
 
@@ -55,7 +55,7 @@ in
 
     package = mkOption {
       type = types.package;
-      default = pkgs.mautrix-slack;
+      default = pkgs-unstable.mautrix-slack;
       description = "Package providing the bridge executable.";
     };
 

modules/mautrix-whatsapp.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, pkgs-unstable, lib, ... }:
 
 with lib;
 
@@ -218,7 +218,7 @@ in
 
     package = mkOption {
       type = types.package;
-      default = pkgs.mautrix-whatsapp;
+      default = pkgs-unstable.mautrix-whatsapp;
       description = "Package providing the bridge executable.";
     };