The nixpkgs angie build hardcodes /var/log/nginx for error_log and
defaults its worker group to 'nogroup' (which fakeNss doesn't ship).
Run as root in the container, mkdir the compiled-in log dir, and pass
-c /etc/angie/angie.conf explicitly so our custom main config wins
over whatever default ships in /etc/angie/.
Use `nix eval --raw .#angieVersion` instead of trying to read a
writeText derivation that was never built. Also call streamLayeredImage
output via process-substitution properly.
Builds via dockerTools.streamLayeredImage from nixpkgs unstable's
pkgs.angie. Woodpecker pipeline pushes to git.oleks.space/oleks/angie
with both <version>-arm64 and latest-arm64 tags. Used by the
kotkanagrilli.fi staging Helm chart on the kotkan node (arm64) to
replace the upstream amd64-only runalsh/angie image.