Oleks
430 lines
17 KiB
Nix
430 lines
17 KiB
Nix
{
|
||
description = "oleks's personal Flake hub – a place to publish custom packages and overlays";
|
||
|
||
inputs = {
|
||
fleet-pins.url = "git+https://git.oleks.space/oleks/fleet-pins?ref=main";
|
||
nixpkgs.follows = "fleet-pins/nixpkgs-projects";
|
||
flake-utils.url = "github:numtide/flake-utils";
|
||
|
||
# Shared per-archetype parity publish-app builders (cluster#104, emmett#44).
|
||
# flake-hub is an ATTIC-CLOSURE repo: it builds package closures and warms
|
||
# the Attic cache with them — there is NO registry artifact.
|
||
# mkAtticClosurePublish makes that archetype explicit to pipeline-doctor.
|
||
parity.url = "git+https://git.oleks.space/oleks/parity-lib";
|
||
|
||
# Hyprspace source; no flake.nix in the repo so we consume it as raw src.
|
||
# Pin tracks the last v0.52-compatible commit of Hyprspace.
|
||
hyprspace = {
|
||
url = "github:KZDKM/Hyprspace/0467be86b18cfc324fab04afbd40fe9ef80f7fa9";
|
||
flake = false;
|
||
};
|
||
|
||
# Google Antigravity packaging. Upstream auto-updates daily; we re-expose
|
||
# the overlay and build into our attic cache so emmett pulls from there.
|
||
antigravity-nix = {
|
||
url = "github:jacopone/antigravity-nix";
|
||
inputs.nixpkgs.follows = "nixpkgs";
|
||
};
|
||
|
||
# nix-deps: "see the real cost of installing packages on NixOS".
|
||
# Re-exposed through our overlay so CI builds it into attic.
|
||
nix-deps = {
|
||
url = "github:manelinux/nix-deps";
|
||
inputs.nixpkgs.follows = "nixpkgs";
|
||
};
|
||
|
||
# stalewood — find/reap merged git worktrees. Ships its own flake;
|
||
# re-expose its package (mirrors the nix-deps pattern).
|
||
stalewood = {
|
||
url = "github:retif/stalewood";
|
||
inputs.nixpkgs.follows = "nixpkgs";
|
||
};
|
||
|
||
# woodpecker-peek — tray app for Woodpecker CI (on git.oleks.space).
|
||
# Re-exposed so flake-hub CI warms attic and emmett pulls cached.
|
||
woodpecker-peek = {
|
||
url = "git+https://git.oleks.space/oleks/woodpecker-peek?ref=main";
|
||
inputs.nixpkgs.follows = "nixpkgs";
|
||
};
|
||
|
||
# mcp-chrome — Chrome MCP server + extension (English-localized fork of
|
||
# hangwin/mcp-chrome). Re-exposes the from-source wasm-simd worker (proven
|
||
# green, ~22 s) and the full chrome-mcp-extension build. The extension
|
||
# target is KNOWN-BROKEN under nix-daemon at this pin (see oleks/mcp-chrome
|
||
# issue #1 close comment); expect attic to miss it until that's resolved.
|
||
mcp-chrome = {
|
||
url = "git+https://git.oleks.space/oleks/mcp-chrome?ref=main";
|
||
inputs.nixpkgs.follows = "nixpkgs";
|
||
};
|
||
};
|
||
|
||
outputs =
|
||
{
|
||
self,
|
||
nixpkgs,
|
||
fleet-pins,
|
||
flake-utils,
|
||
parity,
|
||
hyprspace,
|
||
antigravity-nix,
|
||
nix-deps,
|
||
stalewood,
|
||
woodpecker-peek,
|
||
mcp-chrome,
|
||
...
|
||
}:
|
||
let
|
||
# Systems that have native builders
|
||
buildSystems = [
|
||
"x86_64-linux"
|
||
"aarch64-linux"
|
||
];
|
||
|
||
# Cross-compilation targets from x86_64-linux
|
||
crossTargets = {
|
||
"s390x-linux" = "s390x-linux";
|
||
};
|
||
|
||
mkPackages =
|
||
pkgs:
|
||
let
|
||
sys = pkgs.stdenv.hostPlatform.system;
|
||
# Antigravity ships a Google-provided x86_64/aarch64 Linux binary.
|
||
# Skip it for cross targets (e.g. s390x) where it can't run anyway.
|
||
supportsAntigravity = sys == "x86_64-linux" || sys == "aarch64-linux";
|
||
xontribs = import ./packages/xontribs.nix {
|
||
inherit (pkgs) python3Packages fetchurl;
|
||
};
|
||
in
|
||
{
|
||
hello-world = pkgs.callPackage ./packages/hello-world.nix { };
|
||
geesefs = pkgs.callPackage ./packages/geesefs.nix { };
|
||
metamcp = pkgs.callPackage ./packages/metamcp.nix { };
|
||
xonsh = pkgs.callPackage ./packages/xonsh.nix {
|
||
xonsh-unwrapped = import ./packages/xonsh-unwrapped.nix {
|
||
inherit (pkgs) lib python3Packages fetchFromGitHub;
|
||
};
|
||
};
|
||
}
|
||
# Native-only packages — skip on s390x cross (gitea's pnpm step and
|
||
# cgo+sqlite link don't cross-compile cleanly).
|
||
// nixpkgs.lib.optionalAttrs (sys == "x86_64-linux" || sys == "aarch64-linux") {
|
||
gitea-local-fork =
|
||
let
|
||
# Our fork's go.mod requires Go 1.26.3; nixpkgs at this pin has
|
||
# only 1.26.0 (and unstable has 1.26.2). Bump the package's src.
|
||
go = pkgs.go_1_26.overrideAttrs (_: rec {
|
||
version = "1.26.3";
|
||
src = pkgs.fetchurl {
|
||
url = "https://go.dev/dl/go${version}.src.tar.gz";
|
||
hash = "sha256-HGRoddCqh5kTMYTtV895/yS97+jIggRwYCqdPW2Rkrg=";
|
||
};
|
||
});
|
||
in
|
||
pkgs.callPackage ./packages/gitea-local-fork.nix {
|
||
buildGoModule = pkgs.buildGoModule.override { inherit go; };
|
||
};
|
||
}
|
||
# Xontribs: pass into `programs.xonsh.extraPackages` or
|
||
# `pkgs.xonsh.override { extraPackages = ps: [...]; }`.
|
||
// xontribs
|
||
# Antigravity: re-expose jacopone/antigravity-nix's outputs so emmett
|
||
# consumes a single flake-hub input and our CI builds into attic.
|
||
// nixpkgs.lib.optionalAttrs supportsAntigravity {
|
||
inherit (antigravity-nix.packages.${sys})
|
||
google-antigravity
|
||
google-antigravity-no-fhs
|
||
google-antigravity-ide
|
||
google-antigravity-ide-no-fhs
|
||
google-antigravity-cli
|
||
;
|
||
# nix-deps' flake only outputs eachDefaultSystem (no s390x), so
|
||
# gate it on the same native x86_64/aarch64 condition.
|
||
nix-deps = nix-deps.packages.${sys}.default;
|
||
# stalewood — re-exposed from its own flake. No s390x output,
|
||
# so it rides the same native-only gate.
|
||
stalewood = stalewood.packages.${sys}.default;
|
||
# woodpecker-peek — same pattern; consumers (emmett) read the
|
||
# attic-cached binary via flake-hub's overlay, then set
|
||
# services.woodpecker-peek.package = pkgs.woodpecker-peek;.
|
||
woodpecker-peek = woodpecker-peek.packages.${sys}.default;
|
||
# mcp-chrome — Rust→wasm worker (proven green) plus the full
|
||
# chrome-mcp-extension build. The latter is KNOWN-BROKEN under
|
||
# nix-daemon at this pin; flake-hub CI will miss the cache on it
|
||
# until upstream resolves that. wasm-simd alone is what consumers
|
||
# actually pull cached today (commits 9534234, b276465 in
|
||
# oleks/mcp-chrome sync the built wasm back into the tree).
|
||
mcp-chrome-wasm-simd = mcp-chrome.packages.${sys}.wasm-simd;
|
||
mcp-chrome-extension = mcp-chrome.packages.${sys}.chrome-mcp-extension;
|
||
};
|
||
|
||
# Overlay providing Hyprspace. Requires `pkgs.hyprland` to be present
|
||
# (consumer applies the Hyprland flake's overlay first). Kept out of
|
||
# `mkPackages` because standalone `nix build .#hyprspace` has no
|
||
# Hyprland in scope.
|
||
hyprspaceOverlay = final: _prev: {
|
||
hyprspace = final.callPackage ./packages/hyprspace.nix {
|
||
src = hyprspace;
|
||
};
|
||
};
|
||
|
||
# Rustc bootstrap: symlink_file panics with "File exists" during
|
||
# s390x cross-compilation. Multiple call sites use t!(symlink_file(...)).
|
||
# Patch the symlink_file method body to remove an existing dest first.
|
||
# Exported as overlays.s390xRustcSymlink so nixos-ci consumes this single
|
||
# definition (and the patch travels with it) instead of duplicating it.
|
||
s390xRustcSymlinkOverlay =
|
||
final: prev:
|
||
let
|
||
patchedRustcUnwrapped = prev.rustc-unwrapped.overrideAttrs (old: {
|
||
patches = (old.patches or [ ]) ++ [
|
||
./patches/rustc-symlink-file-eexist.patch
|
||
];
|
||
});
|
||
in
|
||
{
|
||
rustc-unwrapped = patchedRustcUnwrapped;
|
||
rustc = prev.rustc.override {
|
||
rustc-unwrapped = patchedRustcUnwrapped;
|
||
};
|
||
};
|
||
|
||
# Overlays needed for s390x cross-compilation of attic-client
|
||
s390xOverlays = [
|
||
# OpenSSL s390x assembly uses z10 instructions (cijne) that the
|
||
# nix-bootstrapped assembler doesn't recognize
|
||
(final: prev: {
|
||
openssl = prev.openssl.overrideAttrs (old: {
|
||
configureFlags = (old.configureFlags or [ ]) ++ [ "no-asm" ];
|
||
});
|
||
})
|
||
# musl doesn't support s390x long double (IBM double-double format:
|
||
# LDBL_MANT_DIG=106, sizeof=16). Make musl appear unavailable so
|
||
# busybox-sandbox-shell uses glibc static instead.
|
||
(final: prev: {
|
||
busybox-sandbox-shell = prev.busybox-sandbox-shell.override {
|
||
musl = prev.musl // {
|
||
meta = prev.musl.meta // {
|
||
platforms = [ ];
|
||
};
|
||
};
|
||
};
|
||
})
|
||
# libarchive tests fail in k8s pod sandboxes
|
||
(final: prev: {
|
||
libarchive = prev.libarchive.overrideAttrs (_: {
|
||
doCheck = false;
|
||
});
|
||
})
|
||
# nix 2.28 is a direct dependency of attic-client — disable tests
|
||
# and fix missing RPATH for boost/zstd/libarchive
|
||
(final: prev: {
|
||
nixVersions = prev.nixVersions // {
|
||
nix_2_28 = prev.nixVersions.nix_2_28.overrideAttrs (old: {
|
||
doCheck = false;
|
||
doInstallCheck = false;
|
||
nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ final.patchelf ];
|
||
postFixup = (old.postFixup or "") + ''
|
||
for rpath in ${final.boost}/lib ${final.zstd.out}/lib ${final.libarchive.out}/lib; do
|
||
patchelf --add-rpath "$rpath" $out/bin/nix
|
||
for lib in $out/lib/lib*.so; do
|
||
[ -f "$lib" ] && patchelf --add-rpath "$rpath" "$lib"
|
||
done
|
||
done
|
||
'';
|
||
});
|
||
};
|
||
})
|
||
# LLVM test failures in CI pod environment — override libllvm
|
||
# (not llvm) so it propagates through rustc bootstrap chain
|
||
(final: prev: {
|
||
llvmPackages = prev.llvmPackages // {
|
||
libllvm = prev.llvmPackages.libllvm.overrideAttrs (old: {
|
||
doCheck = false;
|
||
doInstallCheck = false;
|
||
nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ prev.gitMinimal ];
|
||
});
|
||
};
|
||
})
|
||
# Rustc symlink_file "File exists" fix (defined + exported above).
|
||
s390xRustcSymlinkOverlay
|
||
];
|
||
|
||
# Native builds
|
||
native = flake-utils.lib.eachSystem buildSystems (
|
||
system:
|
||
let
|
||
pkgs = import nixpkgs { inherit system; };
|
||
packages = mkPackages pkgs;
|
||
in
|
||
{
|
||
packages = packages // {
|
||
default = packages.hello-world;
|
||
};
|
||
|
||
formatter = pkgs.nixfmt-rfc-style;
|
||
|
||
devShells.default = pkgs.mkShell {
|
||
name = "oleks-hub-shell";
|
||
buildInputs = [ self.packages.${system}.default ];
|
||
nativeBuildInputs = with pkgs; [
|
||
nix
|
||
fmt
|
||
];
|
||
shellHook = ''
|
||
echo "Welcome to the oleks Flake hub development shell."
|
||
'';
|
||
};
|
||
}
|
||
);
|
||
|
||
# Cross-compiled builds (built from x86_64-linux)
|
||
cross = builtins.listToAttrs (
|
||
builtins.map (
|
||
target:
|
||
let
|
||
targetOverlays =
|
||
{
|
||
"s390x-linux" = s390xOverlays;
|
||
}
|
||
.${target} or [ ];
|
||
pkgs = import nixpkgs {
|
||
system = "x86_64-linux";
|
||
crossSystem.config =
|
||
nixpkgs.lib.systems.examples.${
|
||
{
|
||
"s390x-linux" = "s390x";
|
||
}
|
||
.${target}
|
||
}.config;
|
||
overlays = targetOverlays;
|
||
};
|
||
packages = mkPackages pkgs;
|
||
crossOnlyPackages =
|
||
{
|
||
"s390x-linux" = {
|
||
inherit (pkgs)
|
||
attic-client
|
||
rustc
|
||
cargo
|
||
rustfmt
|
||
sccache
|
||
mold
|
||
;
|
||
nix = pkgs.nixVersions.nix_2_28;
|
||
};
|
||
}
|
||
.${target} or { };
|
||
in
|
||
{
|
||
name = target;
|
||
value =
|
||
packages
|
||
// crossOnlyPackages
|
||
// {
|
||
default = packages.hello-world;
|
||
};
|
||
}
|
||
) (builtins.attrNames crossTargets)
|
||
);
|
||
in
|
||
native
|
||
// {
|
||
packages = (native.packages or { }) // cross;
|
||
overlays = {
|
||
default = final: _prev: mkPackages final;
|
||
gcc15-fixes = import ./overlays/gcc15-fixes.nix;
|
||
hyprspace = hyprspaceOverlay;
|
||
# Single home for the s390x rustc symlink_file patch overlay so
|
||
# consumers (nixos-ci) don't re-declare it + the patch file.
|
||
s390xRustcSymlink = s390xRustcSymlinkOverlay;
|
||
};
|
||
|
||
# `nix run .#<app>` — local-parity entrypoints (emmett#44, cluster#192,
|
||
# ATTIC-CLOSURE archetype, cluster#104). The stage/publish/push-staged
|
||
# apps come straight from parity-lib's mkAtticClosurePublish, so CI and a
|
||
# local run share one audited implementation and cannot drift. There is NO
|
||
# registry artifact — these apps build the package closures and warm the
|
||
# Attic cache with them.
|
||
#
|
||
# TWO HALVES (emmett#44): STAGE `nix build`s every package in the arch's
|
||
# list into the local /nix store (cluster-independent, runs on emmett);
|
||
# PUBLISH additionally `attic push`es each closure to the cache that lives
|
||
# next to the cluster. Local runs DRY-RUN (stage + show the pushes) unless
|
||
# `--publish`/PUBLISH=1.
|
||
#
|
||
# nix run .#stage-x86_64-linux stage amd64 closures, no publish
|
||
# nix run .#publish stage amd64 then push if PUBLISH=1
|
||
# nix run .#publish -- --publish actually push to attic
|
||
# nix run .#push-staged replay already-staged amd64 paths
|
||
#
|
||
# arm64 leg: aarch64-linux cannot be built on emmett (linux/amd64) and the
|
||
# native packages have no cross path, so it MUST run on an aarch64 node
|
||
# (.woodpecker/arm64.yaml runs `PUBLISH=1 nix run .#publish-aarch64-linux`).
|
||
#
|
||
# The package set per arch mirrors flake-hub's CI warm list (was
|
||
# ci/publish.py packages_for): the always-on core plus arch-conditional
|
||
# extras. Cross-only/known-broken targets stay out (see comments).
|
||
apps =
|
||
let
|
||
# The Attic cache token lives at `pass infra/attic/ci_token` and the
|
||
# cache is reached via the armer hairpin endpoint — preserve both so
|
||
# the push is byte-for-byte the pre-parity behaviour.
|
||
atticEndpoint = "https://nix-cache-upload.oleks.space";
|
||
atticPass = "infra/attic/ci_token";
|
||
|
||
# Package names to warm into Attic for a given native arch.
|
||
# Native arches only (amd64/arm64); mcp-chrome-extension stays OUT
|
||
# (known-broken under nix-daemon at this pin, see oleks/mcp-chrome #1).
|
||
packageNamesFor =
|
||
arch:
|
||
[
|
||
"hello-world"
|
||
"geesefs"
|
||
"xonsh"
|
||
]
|
||
++ nixpkgs.lib.optionals (arch == "x86_64-linux" || arch == "aarch64-linux") [
|
||
"woodpecker-peek"
|
||
"mcp-chrome-wasm-simd"
|
||
"gitea-local-fork"
|
||
"google-antigravity"
|
||
"google-antigravity-no-fhs"
|
||
"google-antigravity-ide"
|
||
"google-antigravity-ide-no-fhs"
|
||
"google-antigravity-cli"
|
||
];
|
||
|
||
drvsFor = arch: map (n: self.packages.${arch}.${n}) (packageNamesFor arch);
|
||
|
||
buildersFor = arch: parity.lib.mkParityBuilders (import nixpkgs { system = arch; });
|
||
|
||
atticAppsFor =
|
||
arch:
|
||
(buildersFor arch).mkAtticClosurePublish {
|
||
drvs = drvsFor arch;
|
||
inherit arch;
|
||
endpoint = atticEndpoint;
|
||
passEntry = atticPass;
|
||
};
|
||
|
||
amd64Apps = atticAppsFor "x86_64-linux";
|
||
arm64Apps = atticAppsFor "aarch64-linux";
|
||
in
|
||
nixpkgs.lib.genAttrs buildSystems (system:
|
||
# amd64 is the emmett-buildable arch: expose its stage/publish/
|
||
# push-staged plus the top-level `publish`. Also surface the arm64
|
||
# stage/publish under their arch-suffixed names for the node-bound
|
||
# CI leg (.woodpecker/arm64.yaml).
|
||
{
|
||
inherit (amd64Apps)
|
||
"stage-x86_64-linux"
|
||
"publish-x86_64-linux"
|
||
"publish"
|
||
"push-staged"
|
||
;
|
||
"stage-aarch64-linux" = arm64Apps."stage-aarch64-linux";
|
||
"publish-aarch64-linux" = arm64Apps."publish-aarch64-linux";
|
||
});
|
||
};
|
||
}
|