I currently push to a private GitHub repository (planning on moving to a self-hosted Forgejo instance soon).
Although making my nix configuration public would be safe anyway since I use sops-nix which encrypts all my passwords in the repo using a key derived from my SSH key. During nixos-rebuild it decrypts them and puts them each in their own text file at /run/secrets, with permissions set so you need sudo to view them. (The permissions can be tweaked as needed)
It was a pain in the neck to get started with initially (like NixOS itself), but it was very much worth it. (Basically a necessity since putting secrets even in a private repo is considered bad practice)









I haven’t personally tried it, but Owncast might be an option if your friend knows someone who would be willing to host it. (I’m not sure if that would be considered technically demanding)