bump to nix 26.05

nix/hosts/common.nix

@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 {
-  system.stateVersion = "25.05";
+  system.stateVersion = "26.05";
 
   nix.settings = {
     experimental-features = [ "nix-command" "flakes" ];

nix/hosts/default.nix

@@ -9,6 +9,7 @@ let
       specialArgs = { inherit inputs; };
       modules = [
         ./common.nix
+        ./placeholder-hardware.nix
         inputs.sops-nix.nixosModules.sops
         modules.gebos-secrets
         modules.gebos-postgres

nix/hosts/placeholder-hardware.nix

@@ -0,0 +1,24 @@
+{ lib, ... }:
+
+# SKELETON PLACEHOLDER — not a real machine description.
+#
+# The three hosts don't have actual boxes yet, but `nix flake check` evaluates
+# `system.build.toplevel` for every nixosConfiguration, which asserts a root
+# filesystem and a boot device exist. This stub satisfies those assertions so
+# the structure type-checks in CI.
+#
+# When a real machine is provisioned, generate its hardware-configuration.nix
+# (`nixos-generate-config`) and import that from the host file instead of this
+# placeholder (see the commented import in db-host.nix). Do NOT deploy a host
+# that still relies on this file — the device paths below are fictional.
+{
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+  };
+
+  boot.loader.grub = {
+    enable = true;
+    devices = [ "/dev/sda" ];
+  };
+}

nix/modules/gebos-postgres.nix

@@ -13,12 +13,20 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    # TimescaleDB ships under the non-OSI "Timescale License" (TSL), which
+    # nixpkgs flags as unfree. Allow just this package rather than opening the
+    # whole config to unfree.
+    nixpkgs.config.allowUnfreePredicate = pkg:
+      lib.elem (lib.getName pkg) [ "timescaledb" ];
+
     services.postgresql = {
       enable = true;
       package = pkgs.postgresql_17;
-      enableTCPIP = true;
+      # listen_addresses is managed explicitly below. The upstream postgresql
+      # module also defines it (via its own default / enableTCPIP), so mkForce
+      # makes this module the single source of truth and avoids the collision.
       settings = {
-        listen_addresses = lib.concatStringsSep "," cfg.listenAddresses;
+        listen_addresses = lib.mkForce (lib.concatStringsSep "," cfg.listenAddresses);
         shared_preload_libraries = "timescaledb,pg_stat_statements";
       };
       extensions = ps: with ps; [