Add riverside.coldairnetworks.com and fix arion nix-instantiate PATH

Add riverside OCI container (forge.quinefoundation.com/ironmagma/riverside)
on port 3011 with nginx vhost. Fix forgejo-arion service failure by ensuring
nix-instantiate is in PATH when arion evaluates the compose config.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

nixos/linux.nix

@@ -33,6 +33,7 @@
 
   start-arion-run = pkgs.writeShellScriptBin "start-arion-run" ''
     set -e
+    export PATH="${pkgs.nixVersions.stable}/bin:$PATH"
     cd /root/petersweb-infra/nixos/arion
     ${pkgs.arion}/bin/arion down 2>> /var/log/start-arion-run.log >> /var/log/start-arion-run.log
     ${pkgs.arion}/bin/arion up -d 2>> /var/log/start-arion-run.log >> /var/log/start-arion-run.log
@@ -206,7 +207,15 @@ in {
         environment = {};
         ports = ["3010:8080"];
       };
-      
+
+      "riverside" = {
+        autoStart = true;
+        image = "forge.quinefoundation.com/ironmagma/riverside@sha256:ab62339730a4ea31a01b05e7fef6a5717d4217a79eb3480c2218eab9305181c3";
+        volumes = [];
+        environment = {};
+        ports = ["3011:8080"];
+      };
+
     };
   };
 

nixos/nginx.nix

@@ -137,6 +137,15 @@
           proxyPass = "http://127.0.0.1:3010/"; # pass through to docker container
         };
       };
+      "riverside.coldairnetworks.com" = {
+        enableACME = false;
+        forceSSL = false;
+        addSSL = false;
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:3011/";
+        };
+      };
       "quineglobal.com" = {
         enableACME = false;
         forceSSL = false;