feat(nix): Import nixpkgs from a configured Nix channel

Instead of using whatever the current system default is, import a Nix
channel when building an image.

This will use Nix' internal caching behaviour for tarballs fetched
without a SHA-hash.

For now the downloaded channel is pinned to nixos-19.03.

tools/nixery/build-registry-image.nix

@@ -34,10 +34,16 @@
   # plenty of room for extension. I believe the actual maximum is
   # 128.
   maxLayers ? 24,
-  # Nix package set to use
-  pkgs ? (import <nixpkgs> {})
+  # Nix channel to use
+  channel ? "nixos-19.03"
 }:
 
+# Import the specified channel directly from Github.
+let
+  channelUrl = "https://github.com/NixOS/nixpkgs-channels/archive/${channel}.tar.gz";
+  pkgs = import (builtins.fetchTarball channelUrl) {};
+in
+
 # Since this is essentially a re-wrapping of some of the functionality that is
 # implemented in the dockerTools, we need all of its components in our top-level
 # namespace.

tools/nixery/static/index.html

@@ -75,10 +75,15 @@
       <li>
         <strong>Which revision of <code>nixpkgs</code> is used?</strong>
         <br>
-        Currently whatever was <code>HEAD</code> at the time I deployed this. One idea I've had is
-        to let users specify tags on images that correspond to commits in nixpkgs, however there is
-        some potential for abuse there (e.g. by triggering lots of builds on commits that have
-        broken Hydra builds) and I don't want to deal with that yet.
+        Nixery imports a Nix channel
+        via <code>builtins.fetchTarball</code>. Currently the channel
+        to which this instance is pinned is NixOS 19.03.
+        <br>
+        One idea I've had is to let users specify tags on images that
+        correspond to commits in nixpkgs, however there is some
+        potential for abuse there (e.g. by triggering lots of builds
+        on commits that have broken Hydra builds) and I don't want to
+        deal with that yet.
       </li>
       <li>
         <strong>Who made this?</strong>