@@ -2,7 +2,7 @@ #!/usr/bin/env bash
 # the shebang is ignored, but nice for editors
 
 if type -P lorri &>/dev/null; then
-  eval "$(lorri direnv)"
+  eval "$(lorri direnv --flake .)"
   if has update-types; then
     update-types
   fi
@@ -14,5 +14,3 @@
 dotenv_if_exists
 # shellcheck disable=SC2046
 env_vars_required $(grep --only-matching '\$[A-Z_]\+' creds.json | cut -d\$ -f2)
-
-watch_file lon.lock lon.nix

@@ -0,0 +1,24 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1790450978,
+        "narHash": "sha256-GM0+sQwNfU1In6UEyBwpwjG3vX3g81kfKvcTlW2muL0=",
+        "rev": "5e2305d577ca00acbba631b05cb1094d172b29f3",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.10718.5e2305d577ca/nixexprs.tar.zst"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

@@ -0,0 +1,101 @@
+{
+  description = "A very basic flake";
+
+  inputs = {
+    nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
+  };
+
+  outputs = { nixpkgs, ... }: {
+    devShells = builtins.mapAttrs (system: pkgs: {
+      default =
+        let
+          inherit (pkgs) lib;
+          dnscontrol = pkgs.dnscontrol;
+
+          types = pkgs.runCommand "dnscontrol-types" {
+            runtimeInputs = [ dnscontrol ];
+          } "${lib.getExe dnscontrol} write-types -o $out";
+
+          update-types = pkgs.writeScriptBin "update-types" ''
+            f="types-dnscontrol.d.ts"
+            if [[ -e "$f" && ! -L "$f" ]]
+            then
+              echo "warn: file $f already exists, not updating. Remove to enable automatic updates." >&2
+            elif [[ ! ( -L "$f" && "$(readlink -f "$f")" == "${types}" ) ]]
+            then
+              ln -sf "${types}" "$f"
+            fi
+          '';
+
+          # fallback for using lorri (shellHook doesn't work as expected)
+          get-consumer-key = pkgs.writeScriptBin "get-consumer-key" ''
+            #!/${pkgs.fishMinimal}
+            # adapted from <https://docs.dnscontrol.org/provider/ovh#activation>
+
+            if set --query OVH_CONSUMER_KEY
+                echo >&2 "Nothing to do. OVH_CONSUMER_KEY is set."
+                exit 0
+            end
+
+            if ! set --query OVH_APP_KEY
+                echo >&2 'Need $OVH_APP_KEY! Go to https://eu.api.ovh.com/createApp/'
+                exit 1
+            end
+
+            set accessRules '[
+                {
+                    "method": "DELETE",
+                    "path": "/domain/zone/*"
+                },
+                {
+                    "method": "GET",
+                    "path": "/domain/zone/*"
+                },
+                {
+                    "method": "POST",
+                    "path": "/domain/zone/*"
+                },
+                {
+                    "method": "PUT",
+                    "path": "/domain/zone/*"
+                },
+                {
+                    "method": "GET",
+                    "path": "/domain/*"
+                },
+                {
+                    "method": "PUT",
+                    "path": "/domain/*"
+                },
+                {
+                    "method": "POST",
+                    "path": "/domain/*/nameServers/update"
+                }
+            ]'
+
+            xh --body \
+                POST https://eu.api.ovh.com/1.0/auth/credential \
+                X-Ovh-Application:"$OVH_APP_KEY" \
+                accessRules:="$accessRules"
+
+          '';
+        in
+        pkgs.mkShellNoCC {
+          packages = with pkgs; [
+            just
+            dnscontrol
+            prettier
+            get-consumer-key
+            update-types
+          ];
+        };
+
+      ci = pkgs.mkShellNoCC {
+        packages = with pkgs; [
+          just
+          dnscontrol
+        ];
+      };
+    }) nixpkgs.legacyPackages;
+  };
+}

@@ -1,15 +0,0 @@
-{
-  "version": "1",
-  "sources": {
-    "nixpkgs": {
-      "type": "GitHub",
-      "fetchType": "tarball",
-      "owner": "nixos",
-      "repo": "nixpkgs",
-      "branch": "nixpkgs-unstable",
-      "revision": "173d0ad7a974f8543a9ab01d2271b2e290341b33",
-      "url": "https://github.com/nixos/nixpkgs/archive/173d0ad7a974f8543a9ab01d2271b2e290341b33.tar.gz",
-      "hash": "sha256-ORvqDbb/LYxiJljGIejapjkc/kJbVote2N1WSb9W45I="
-    }
-  }
-}

@@ -1,53 +0,0 @@
-# Generated by lon. Do not modify!
-let
-
-  lock = builtins.fromJSON (builtins.readFile ./lon.lock);
-
-  # Override with a path defined in an environment variable. If no variable is
-  # set, the original path is used.
-  overrideFromEnv =
-    name: path:
-    let
-      replacement = builtins.getEnv "LON_OVERRIDE_${name}";
-    in
-    if replacement == "" then
-      path
-    else
-    # this turns the string into an actual Nix path (for both absolute and
-    # relative paths)
-    if builtins.substring 0 1 replacement == "/" then
-      /. + replacement
-    else
-      /. + builtins.getEnv "PWD" + "/${replacement}";
-
-  fetchSource =
-    args@{ fetchType, ... }:
-    if fetchType == "git" then
-      builtins.fetchGit (
-        {
-          url = args.url;
-          ref = args.branch;
-          rev = args.revision;
-          narHash = args.hash;
-          submodules = args.submodules;
-        }
-        // (
-          if args ? lastModified then
-            {
-              inherit (args) lastModified;
-              shallow = true;
-            }
-          else
-            { }
-        )
-      )
-    else if fetchType == "tarball" then
-      builtins.fetchTarball {
-        url = args.url;
-        sha256 = args.hash;
-      }
-    else
-      builtins.throw "Unsupported source type ${fetchType}";
-
-in
-builtins.mapAttrs (name: args: overrideFromEnv name (fetchSource args)) lock.sources

@@ -1,90 +0,0 @@
-{
-  pkgs ? (
-    let
-      sources = import ./lon.nix;
-      pkgs = import sources.nixpkgs { };
-    in
-    pkgs
-  ),
-  lib ? pkgs.lib,
-}:
-let
-  dnscontrol = pkgs.dnscontrol;
-
-  types = pkgs.runCommand "dnscontrol-types" {
-    runtimeInputs = [ dnscontrol ];
-  } "${lib.getExe dnscontrol} write-types -o $out";
-  update-types = ''
-    f="types-dnscontrol.d.ts"
-    if [[ -e "$f" && ! -L "$f" ]]
-    then
-      echo "warn: file $f already exists, not updating. Remove to enable automatic updates." >&2
-    elif [[ ! ( -L "$f" && "$(readlink -f "$f")" == "${types}" ) ]]
-    then
-      ln -sf "${types}" "$f"
-    fi
-  '';
-in
-pkgs.mkShellNoCC {
-  packages = with pkgs; [
-    lon
-    just
-    dnscontrol
-    prettier
-
-    # fallback for using lorri (shellHook doesn't work as expected)
-    (writeShellScriptBin "update-types" update-types)
-    (writeScriptBin "get-consumer-key" ''
-      #!/${pkgs.fishMinimal}
-      # adapted from <https://docs.dnscontrol.org/provider/ovh#activation>
-
-      if set --query OVH_CONSUMER_KEY
-          echo >&2 "Nothing to do. OVH_CONSUMER_KEY is set."
-          exit 0
-      end
-
-      if ! set --query OVH_APP_KEY
-          echo >&2 'Need $OVH_APP_KEY! Go to https://eu.api.ovh.com/createApp/'
-          exit 1
-      end
-
-      set accessRules '[
-          {
-              "method": "DELETE",
-              "path": "/domain/zone/*"
-          },
-          {
-              "method": "GET",
-              "path": "/domain/zone/*"
-          },
-          {
-              "method": "POST",
-              "path": "/domain/zone/*"
-          },
-          {
-              "method": "PUT",
-              "path": "/domain/zone/*"
-          },
-          {
-              "method": "GET",
-              "path": "/domain/*"
-          },
-          {
-              "method": "PUT",
-              "path": "/domain/*"
-          },
-          {
-              "method": "POST",
-              "path": "/domain/*/nameServers/update"
-          }
-      ]'
-
-      xh --body \
-          POST https://eu.api.ovh.com/1.0/auth/credential \
-          X-Ovh-Application:"$OVH_APP_KEY" \
-          accessRules:="$accessRules"
-
-    '')
-  ];
-  shellHook = update-types;
-}