Add Moonfin Flatpak bundle support and update Flatpak configuration

modules/hosts/14900k/_private/moonfin-flatpak.nix

@@ -0,0 +1,14 @@
+# Moonfin 2.0.0 Jellyfin client — upstream Flatpak bundle (not on Flathub yet).
+# https://github.com/Moonfin-Client/Moonfin-Core/releases/tag/2.0.0
+{ pkgs, ... }:
+{
+  chiasson.system.flatpak.bundles = [
+    {
+      appId = "org.moonfin.linux";
+      bundle = pkgs.fetchurl {
+        url = "https://github.com/Moonfin-Client/Moonfin-Core/releases/download/2.0.0/Moonfin_Linux_v2.0.0.flatpak";
+        hash = "sha256-sLtrsqBaJ1wriTkIdLylqMc9ygNkHrNm4YS/816nIFQ=";
+      };
+    }
+  ];
+}

modules/hosts/14900k/configuration.nix

@@ -19,6 +19,7 @@
         ./_private/displays.nix
         ./_private/media-disk.nix
         ./_private/jellyfin-nfs-export.nix
+        ./_private/moonfin-flatpak.nix
       ];
 
       sops = {

modules/system/flatpak.nix

@@ -12,7 +12,8 @@
             else true
           )
           cfg.flathub.appIds;
-      allowedAppIds = cfg.flathub.appIds ++ cfg.unmanaged.appIds;
+      bundleAppIds = map (b: b.appId) cfg.bundles;
+      allowedAppIds = cfg.flathub.appIds ++ cfg.unmanaged.appIds ++ bundleAppIds;
       # Bump in Nix when allowlists change; used to skip slow `flatpak update` / `uninstall --unused` on no-op rebuilds.
       declarativeHash = builtins.hashString "sha256" (
         lib.concatStringsSep "\n" (
@@ -20,6 +21,8 @@
           ++ lib.sort lib.lessThan allowedAppIds
           ++ [ "flathub" ]
           ++ lib.sort lib.lessThan flathubForSystem
+          ++ [ "bundles" ]
+          ++ map (b: "${b.appId}@${b.bundle.outPath}") cfg.bundles
         )
       );
       stateFile = "/var/lib/nixos/flatpak-declarative.hash";
@@ -60,6 +63,28 @@
             Installed from elsewhere (not Flathub); never auto-installed and never removed by the script.
           '';
         };
+
+        bundles = lib.mkOption {
+          type = lib.types.listOf (
+            lib.types.submodule {
+              options = {
+                appId = lib.mkOption {
+                  type = lib.types.str;
+                  description = "Flatpak application ID inside the bundle (e.g. org.moonfin.linux).";
+                };
+                bundle = lib.mkOption {
+                  type = lib.types.package;
+                  description = "Upstream .flatpak bundle file (e.g. pkgs.fetchurl { ... }).";
+                };
+              };
+            }
+          );
+          default = [ ];
+          description = ''
+            System-wide installs from upstream Flatpak bundles (not Flathub).
+            Reinstalled on switch when the bundle path or appId changes.
+          '';
+        };
       };
 
       config = lib.mkIf cfg.enable {
@@ -104,6 +129,22 @@
               fi
             done
 
+            ${lib.concatStringsSep "\n" (
+              map (
+                b: ''
+                  echo "flatpak: ensuring ${b.appId} from bundle."
+                  if ! ${pkgs.flatpak}/bin/flatpak --system install \
+                    --assumeyes \
+                    --noninteractive \
+                    --reinstall \
+                    --bundle \
+                    ${lib.escapeShellArg b.bundle.outPath}; then
+                    echo "flatpak: WARN failed to install ${b.appId} from bundle (skip)." >&2
+                  fi
+                ''
+              ) cfg.bundles
+            )}
+
             run_heavy=0
             if [ "$HEAVY" -eq 1 ]; then
               run_heavy=1