m
This commit is contained in:
parent
f81d5604ae
commit
d88355267a
4 changed files with 60 additions and 73 deletions
|
|
@ -22,12 +22,12 @@ This repo uses Bun as the package manager and `bun2nix` for reproducible Nix bui
|
||||||
- `bun.lock` is the source of truth for JS dependencies.
|
- `bun.lock` is the source of truth for JS dependencies.
|
||||||
- `bun.nix` is generated from `bun.lock` with `bun run update:bun-nix`.
|
- `bun.nix` is generated from `bun.lock` with `bun run update:bun-nix`.
|
||||||
- `flake.nix` imports the `bun2nix` overlay and exposes `packages.<system>.default` plus `nixosModules.default`.
|
- `flake.nix` imports the `bun2nix` overlay and exposes `packages.<system>.default` plus `nixosModules.default`.
|
||||||
- `nix/package.nix` uses `bun2nix.fetchBunDeps` with `bun.nix`, runs `bun run build`, and installs the bundled `server.js` plus frontend assets as the `leo-ed` executable.
|
- `nix/package.nix` uses `bun2nix.fetchBunDeps` with `bun.nix`, runs `bun run build`, and installs the bundled `server.js` plus frontend assets as the `kotsukotsu` executable.
|
||||||
|
|
||||||
Whenever dependencies change, update both `bun.lock` and `bun.nix` in the same commit. CI checks that `bun.nix` matches the lockfile by regenerating it and failing on diff.
|
Whenever dependencies change, update both `bun.lock` and `bun.nix` in the same commit. CI checks that `bun.nix` matches the lockfile by regenerating it and failing on diff.
|
||||||
|
|
||||||
## Server and Deployment Model
|
## Server and Deployment Model
|
||||||
This repo is the application source, not the full server configuration. Production is intended to be managed from a separate NixOS infra repo that imports this flake and sets `services.leo-ed.package = inputs.leo-ed.packages.${pkgs.system}.default;`. The included module in `nix/module.nix` defines the systemd service, runtime env (`APP_ORIGIN`, `PORT`, `SQLITE_PATH`, `SESSION_COOKIE_SECURE`), and persistent state directory.
|
This repo is the application source, not the full server configuration. Production is intended to be managed from a separate NixOS infra repo that imports this flake and sets `services.kotsukotsu.package = inputs.kotsukotsu.packages.${pkgs.system}.default;`. The included module in `nix/module.nix` defines the systemd service, runtime env (`APP_ORIGIN`, `PORT`, `SQLITE_PATH`, `SESSION_COOKIE_SECURE`), and persistent state directory.
|
||||||
|
|
||||||
`server/config.ts` exists so production behavior is explicit: WebAuthn origin/RP ID, SQLite path, bind host, and secure cookies should come from NixOS service configuration, not reverse-proxy accident.
|
`server/config.ts` exists so production behavior is explicit: WebAuthn origin/RP ID, SQLite path, bind host, and secure cookies should come from NixOS service configuration, not reverse-proxy accident.
|
||||||
|
|
||||||
|
|
|
||||||
39
flake.nix
39
flake.nix
|
|
@ -1,5 +1,5 @@
|
||||||
{
|
{
|
||||||
description = "leo-ed typing app";
|
description = "kotsukotsu typing app";
|
||||||
|
|
||||||
inputs = {
|
inputs = {
|
||||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||||
|
|
@ -7,43 +7,30 @@
|
||||||
bun2nix.inputs.nixpkgs.follows = "nixpkgs";
|
bun2nix.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
|
||||||
nixConfig = {
|
outputs = {
|
||||||
extra-substituters = [
|
self,
|
||||||
"https://cache.nixos.org"
|
nixpkgs,
|
||||||
"https://nix-community.cachix.org"
|
bun2nix,
|
||||||
];
|
}: let
|
||||||
extra-trusted-public-keys = [
|
|
||||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
|
||||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
outputs = { self, nixpkgs, bun2nix }:
|
|
||||||
let
|
|
||||||
systems = ["x86_64-linux" "aarch64-linux"];
|
systems = ["x86_64-linux" "aarch64-linux"];
|
||||||
forAllSystems = nixpkgs.lib.genAttrs systems;
|
forAllSystems = nixpkgs.lib.genAttrs systems;
|
||||||
in
|
in {
|
||||||
{
|
packages = forAllSystems (system: let
|
||||||
packages = forAllSystems (system:
|
|
||||||
let
|
|
||||||
pkgs = import nixpkgs {
|
pkgs = import nixpkgs {
|
||||||
inherit system;
|
inherit system;
|
||||||
overlays = [bun2nix.overlays.default];
|
overlays = [bun2nix.overlays.default];
|
||||||
};
|
};
|
||||||
in
|
in rec {
|
||||||
rec {
|
kotsukotsu = pkgs.callPackage ./nix/package.nix {};
|
||||||
leo-ed = pkgs.callPackage ./nix/package.nix { };
|
default = kotsukotsu;
|
||||||
default = leo-ed;
|
|
||||||
});
|
});
|
||||||
|
|
||||||
devShells = forAllSystems (system:
|
devShells = forAllSystems (system: let
|
||||||
let
|
|
||||||
pkgs = import nixpkgs {
|
pkgs = import nixpkgs {
|
||||||
inherit system;
|
inherit system;
|
||||||
overlays = [bun2nix.overlays.default];
|
overlays = [bun2nix.overlays.default];
|
||||||
};
|
};
|
||||||
in
|
in {
|
||||||
{
|
|
||||||
default = pkgs.mkShell {
|
default = pkgs.mkShell {
|
||||||
packages = with pkgs; [
|
packages = with pkgs; [
|
||||||
bun
|
bun
|
||||||
|
|
|
||||||
|
|
@ -1,16 +1,16 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
cfg = config.services.leo-ed;
|
cfg = config.services.kotsukotsu;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
options.services.leo-ed = {
|
options.services.kotsukotsu = {
|
||||||
enable = lib.mkEnableOption "leo-ed typing app";
|
enable = lib.mkEnableOption "kotsukotsu typing app";
|
||||||
|
|
||||||
package = lib.mkOption {
|
package = lib.mkOption {
|
||||||
type = lib.types.nullOr lib.types.package;
|
type = lib.types.nullOr lib.types.package;
|
||||||
default = null;
|
default = null;
|
||||||
description = "The leo-ed package to run, typically inputs.leo-ed.packages.${pkgs.system}.default.";
|
description = "The kotsukotsu package to run, typically inputs.kotsukotsu.packages.${pkgs.system}.default.";
|
||||||
};
|
};
|
||||||
|
|
||||||
host = lib.mkOption {
|
host = lib.mkOption {
|
||||||
|
|
@ -34,19 +34,19 @@ in
|
||||||
|
|
||||||
dataDir = lib.mkOption {
|
dataDir = lib.mkOption {
|
||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
default = "/var/lib/leo-ed";
|
default = "/var/lib/kotsukotsu";
|
||||||
description = "Directory for the persistent SQLite database.";
|
description = "Directory for the persistent SQLite database.";
|
||||||
};
|
};
|
||||||
|
|
||||||
user = lib.mkOption {
|
user = lib.mkOption {
|
||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
default = "leo-ed";
|
default = "kotsukotsu";
|
||||||
description = "User account for the service.";
|
description = "User account for the service.";
|
||||||
};
|
};
|
||||||
|
|
||||||
group = lib.mkOption {
|
group = lib.mkOption {
|
||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
default = "leo-ed";
|
default = "kotsukotsu";
|
||||||
description = "Group for the service.";
|
description = "Group for the service.";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -61,24 +61,24 @@ in
|
||||||
assertions = [
|
assertions = [
|
||||||
{
|
{
|
||||||
assertion = cfg.package != null;
|
assertion = cfg.package != null;
|
||||||
message = "services.leo-ed.package must be set, usually from this flake input.";
|
message = "services.kotsukotsu.package must be set, usually from this flake input.";
|
||||||
}
|
}
|
||||||
{
|
{
|
||||||
assertion = cfg.domain != null && cfg.domain != "";
|
assertion = cfg.domain != null && cfg.domain != "";
|
||||||
message = "services.leo-ed.domain must be set.";
|
message = "services.kotsukotsu.domain must be set.";
|
||||||
}
|
}
|
||||||
{
|
{
|
||||||
assertion = lib.hasPrefix "/" cfg.dataDir;
|
assertion = lib.hasPrefix "/" cfg.dataDir;
|
||||||
message = "services.leo-ed.dataDir must be an absolute path.";
|
message = "services.kotsukotsu.dataDir must be an absolute path.";
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
users.groups = lib.mkIf (cfg.group == "leo-ed") {
|
users.groups = lib.mkIf (cfg.group == "kotsukotsu") {
|
||||||
leo-ed = { };
|
kotsukotsu = { };
|
||||||
};
|
};
|
||||||
|
|
||||||
users.users = lib.mkIf (cfg.user == "leo-ed") {
|
users.users = lib.mkIf (cfg.user == "kotsukotsu") {
|
||||||
leo-ed = {
|
kotsukotsu = {
|
||||||
isSystemUser = true;
|
isSystemUser = true;
|
||||||
group = cfg.group;
|
group = cfg.group;
|
||||||
home = toString cfg.dataDir;
|
home = toString cfg.dataDir;
|
||||||
|
|
@ -90,8 +90,8 @@ in
|
||||||
"d ${toString cfg.dataDir} 0750 ${cfg.user} ${cfg.group} -"
|
"d ${toString cfg.dataDir} 0750 ${cfg.user} ${cfg.group} -"
|
||||||
];
|
];
|
||||||
|
|
||||||
systemd.services.leo-ed = {
|
systemd.services.kotsukotsu = {
|
||||||
description = "leo-ed typing app";
|
description = "kotsukotsu typing app";
|
||||||
after = [ "network.target" ];
|
after = [ "network.target" ];
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -9,7 +9,7 @@ let
|
||||||
packageJson = lib.importJSON ../package.json;
|
packageJson = lib.importJSON ../package.json;
|
||||||
in
|
in
|
||||||
stdenvNoCC.mkDerivation {
|
stdenvNoCC.mkDerivation {
|
||||||
pname = "leo-ed";
|
pname = "kotsukotsu";
|
||||||
version = packageJson.version;
|
version = packageJson.version;
|
||||||
|
|
||||||
src = lib.cleanSource ../.;
|
src = lib.cleanSource ../.;
|
||||||
|
|
@ -35,12 +35,12 @@ stdenvNoCC.mkDerivation {
|
||||||
installPhase = ''
|
installPhase = ''
|
||||||
runHook preInstall
|
runHook preInstall
|
||||||
|
|
||||||
mkdir -p $out/share/leo-ed $out/bin
|
mkdir -p $out/share/kotsukotsu $out/bin
|
||||||
cp -r build/. $out/share/leo-ed/
|
cp -r build/. $out/share/kotsukotsu/
|
||||||
|
|
||||||
makeWrapper ${lib.getExe bun} $out/bin/leo-ed \
|
makeWrapper ${lib.getExe bun} $out/bin/kotsukotsu \
|
||||||
--run "cd $out/share/leo-ed" \
|
--run "cd $out/share/kotsukotsu" \
|
||||||
--add-flags "$out/share/leo-ed/server.js"
|
--add-flags "$out/share/kotsukotsu/server.js"
|
||||||
|
|
||||||
runHook postInstall
|
runHook postInstall
|
||||||
'';
|
'';
|
||||||
|
|
@ -48,7 +48,7 @@ stdenvNoCC.mkDerivation {
|
||||||
meta = {
|
meta = {
|
||||||
description = "Typing practice app with passkey auth";
|
description = "Typing practice app with passkey auth";
|
||||||
homepage = "https://example.invalid";
|
homepage = "https://example.invalid";
|
||||||
mainProgram = "leo-ed";
|
mainProgram = "kotsukotsu";
|
||||||
platforms = lib.platforms.linux;
|
platforms = lib.platforms.linux;
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue