vm: serve media directory from virtiofs

This required a serveMediaUsingNginx argument, because
nginx fails to serve media files correctly from the virtiofs
filesystem.

(It works with /nix, because that's mounted using a cache flag,
but we can't do that for the media directory because we want to
reflect file changes.)

nix/infra.nix

@@ -256,6 +256,8 @@ in rec {
       '';
     };
     kn.django.package = "/kninfra-pub";
+    kn.django.serveMediaUsingNginx = false;
+    kn.settings.INFRA_REPO = "/kninfra-pub";
     kn.mailserver.hostname = "mail.local";
     programs.bash.shellAliases."vm.stop" = "poweroff";
     system.fsPackages = [ pkgs.bindfs ];
@@ -268,6 +270,7 @@ in rec {
       sharedDirectories.kninfra = {
         source = "\${PRJ_ROOT:?please run this inside the devshell}";
         target = "/kninfra";
+        securityModel = "none";
       };
       # use bindfs to make it world-readable
       fileSystems."/kninfra-pub" = {

nix/services/kn/django.nix

@@ -38,19 +38,33 @@ in {
       defaultText = "pkgs.kninfra";
       type = types.path;
     };
+    serveMediaUsingNginx = mkOption {
+      # doesn't work in VM :(
+      description = ''
+        Use nginx to serve media directory.
+      '';
+      default = true;
+      type = types.bool;
+    };
   };
   config = lib.mkIf cfg.enable {
     kn.shared.enable = true;
     services.nginx = {
       enable = true;
-      virtualHosts.kn = {
-        serverName = config.kn.settings.DOMAINNAME;
-        locations."/djmedia/".alias = "${pkgs.kninfra}/media/";
-        locations."/".extraConfig = ''
-          include ${pkgs.nginx}/conf/uwsgi_params;
-          uwsgi_pass unix:${config.kn.django.socket};
-         '';
-      };
+      virtualHosts.kn = lib.mkMerge [
+        {
+          serverName = config.kn.settings.DOMAINNAME;
+          locations."/".extraConfig = ''
+            include ${pkgs.nginx}/conf/uwsgi_params;
+            uwsgi_pass unix:${config.kn.django.socket};
+          '';
+        }
+        {
+          locations = lib.mkIf cfg.serveMediaUsingNginx {
+            "/djmedia/".alias = "${cfg.package}/media/";
+          };
+        }
+      ];
     };
     systemd.sockets.kndjango = {
       wantedBy = [ "sockets.target" ];