full ci-cd pipeline built on bun2nix

nix/module.nix

@@ -0,0 +1,115 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.leo-ed;
+in
+{
+  options.services.leo-ed = {
+    enable = lib.mkEnableOption "leo-ed typing app";
+
+    package = lib.mkOption {
+      type = lib.types.nullOr lib.types.package;
+      default = null;
+      description = "The leo-ed package to run, typically inputs.leo-ed.packages.${pkgs.system}.default.";
+    };
+
+    host = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      description = "Listen address for the Bun server.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 5174;
+      description = "Listen port for the Bun server.";
+    };
+
+    domain = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "typing.example.com";
+      description = "Public domain used for WebAuthn RP ID and cookie origin.";
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/leo-ed";
+      description = "Directory for the persistent SQLite database.";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "leo-ed";
+      description = "User account for the service.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "leo-ed";
+      description = "Group for the service.";
+    };
+
+    secureCookies = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Whether to mark auth cookies as Secure.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.package != null;
+        message = "services.leo-ed.package must be set, usually from this flake input.";
+      }
+      {
+        assertion = cfg.domain != null && cfg.domain != "";
+        message = "services.leo-ed.domain must be set.";
+      }
+      {
+        assertion = lib.hasPrefix "/" cfg.dataDir;
+        message = "services.leo-ed.dataDir must be an absolute path.";
+      }
+    ];
+
+    users.groups = lib.mkIf (cfg.group == "leo-ed") {
+      leo-ed = { };
+    };
+
+    users.users = lib.mkIf (cfg.user == "leo-ed") {
+      leo-ed = {
+        isSystemUser = true;
+        group = cfg.group;
+        home = toString cfg.dataDir;
+        createHome = false;
+      };
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${toString cfg.dataDir} 0750 ${cfg.user} ${cfg.group} -"
+    ];
+
+    systemd.services.leo-ed = {
+      description = "leo-ed typing app";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment = {
+        APP_ORIGIN = "https://${cfg.domain}";
+        HOST = cfg.host;
+        PORT = builtins.toString cfg.port;
+        SESSION_COOKIE_SECURE = lib.boolToString cfg.secureCookies;
+        SQLITE_PATH = "${cfg.dataDir}/leo-typing.db";
+      };
+
+      serviceConfig = {
+        ExecStart = lib.getExe cfg.package;
+        Group = cfg.group;
+        Restart = "on-failure";
+        User = cfg.user;
+        WorkingDirectory = cfg.dataDir;
+      };
+    };
+  };
+}

nix/package.nix

@@ -0,0 +1,54 @@
+{ lib
+, stdenvNoCC
+, bun
+, bun2nix
+, makeWrapper
+}:
+
+let
+  packageJson = lib.importJSON ../package.json;
+in
+stdenvNoCC.mkDerivation {
+  pname = "leo-ed";
+  version = packageJson.version;
+
+  src = lib.cleanSource ../.;
+  bunDeps = bun2nix.fetchBunDeps {
+    bunNix = ../bun.nix;
+  };
+
+  nativeBuildInputs = [
+    bun2nix.hook
+    bun
+    makeWrapper
+  ];
+
+  dontRunLifecycleScripts = true;
+  dontUseBunInstall = true;
+
+  buildPhase = ''
+    runHook preBuild
+    bun run build
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/leo-ed $out/bin
+    cp -r build/. $out/share/leo-ed/
+
+    makeWrapper ${lib.getExe bun} $out/bin/leo-ed \
+      --run "cd $out/share/leo-ed" \
+      --add-flags "$out/share/leo-ed/server.js"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Typing practice app with passkey auth";
+    homepage = "https://example.invalid";
+    mainProgram = "leo-ed";
+    platforms = lib.platforms.linux;
+  };
+}