From 4efbdc9bda9805499d5fdb87fec267b90084ef97 Mon Sep 17 00:00:00 2001
From: mikl <mikl@iscg.dev>
Date: Sat, 26 Sep 2026 16:56:43 +0300
Subject: [PATCH] heather: pin Forgejo 15.0.9 and isolate Arion service updates

---
 hosts/heather/arion-compose.nix | 2 +-
 hosts/heather/default.nix       | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/hosts/heather/arion-compose.nix b/hosts/heather/arion-compose.nix
index fd12d9b..906d270 100644
--- a/hosts/heather/arion-compose.nix
+++ b/hosts/heather/arion-compose.nix
@@ -145,7 +145,7 @@ in
     # === Forgejo (git.iscg.dev) ===
     # Первый сервис, proof-of-concept для цепочки arion→docker→Caddy.
     forgejo = {
-      service.image = "codeberg.org/forgejo/forgejo:9";
+      service.image = "codeberg.org/forgejo/forgejo:15.0.9";
       service.container_name = "forgejo";
       service.restart = "unless-stopped";
       service.volumes = [ "forgejo-data:/data" ];
diff --git a/hosts/heather/default.nix b/hosts/heather/default.nix
index 2d3851a..1241dd8 100644
--- a/hosts/heather/default.nix
+++ b/hosts/heather/default.nix
@@ -97,11 +97,16 @@
   # NB: settings — это модуль с imports, НЕ `import ./arion-compose.nix`.
   virtualisation.arion.backend = "docker";
   virtualisation.arion.projects.heather = {
-    serviceName = "heather";   # systemd: arion-heather.service
+    serviceName = "heather";   # systemd: heather.service
     settings = {
       imports = [ ./arion-compose.nix ];
     };
   };
+  # Applying the NixOS configuration must not run `arion up` for *all* services:
+  # in particular it would start the intentionally stopped Teable stack and
+  # touch production Matrix. After changing an image, update that one service
+  # explicitly with `arion --prebuilt-file <active-unit-compose> up -d --no-deps SERVICE`.
+  systemd.services.heather.restartIfChanged = false;
 
   networking = {
     hostName = "heather";