malice

{

  description = "Malice: a hosted Matrix client backed by macltok";

  inputs = {

    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";

    fenix = {

      url = "github:nix-community/fenix";

      inputs.nixpkgs.follows = "nixpkgs";

    };

  };

  outputs =

    {

      self,

      nixpkgs,

      fenix,

    }:

    let

      systems = [

        "x86_64-linux"

        "aarch64-linux"

      ];

      forAllSystems = nixpkgs.lib.genAttrs systems;

      cleanSrc =

        root:

        nixpkgs.lib.cleanSourceWith {

          src = root;

          filter =

            path: type:

            nixpkgs.lib.cleanSourceFilter path type

            && !(

              type == "directory"

              && builtins.elem (baseNameOf path) [

                "target"

                "node_modules"

                "dist"

                "dist-device"

              ]

            );

        };

      workerLock = builtins.fromTOML (builtins.readFile ./crates/malice-worker/Cargo.lock);

      lockedVersion = name: (nixpkgs.lib.findFirst (p: p.name == name) null workerLock.package).version;

      # wasm-bindgen-test-runner refuses a module built by any other wasm-bindgen version

      wasmBindgenCli =

        pkgs:

        pkgs.buildWasmBindgenCli rec {

          src = pkgs.fetchCrate {

            pname = "wasm-bindgen-cli";

            version = lockedVersion "wasm-bindgen";

            hash = "sha256-a7lcXJnnZkYReja+iUO7NqqrWyv3toxnUgQb8s4IS5s=";

          };

          cargoDeps = pkgs.rustPlatform.fetchCargoVendor {

            inherit src;

            inherit (src) pname version;

            hash = "sha256-R1Tas33Ursy8kqsxguAkG0ZhNed2n5uFTAhw1l2qlLY=";

          };

        };

      wasmToolchain =

        system:

        let

          toolchains = fenix.packages.${system};

        in

        toolchains.combine [

          toolchains.stable.cargo

          toolchains.stable.clippy

          toolchains.stable.rustc

          toolchains.stable.rustfmt

          toolchains.stable.rust-src

          toolchains.targets.wasm32-unknown-unknown.stable.rust-std

        ];

      webNodeModules =

        pkgs:

        pkgs.importNpmLock.buildNodeModules {

          npmRoot = ./web;

          nodejs = pkgs.nodejs_22;

        };

      buildWeb =

        pkgs:

        {

          pname,

          task,

          outDir,

          postPatch ? "",

        }:

        pkgs.stdenvNoCC.mkDerivation {

          inherit pname postPatch;

          version = "0.1.0";

          src = cleanSrc ./web;

          npmDeps = webNodeModules pkgs;

          disallowedReferences = [

            (webNodeModules pkgs)

            pkgs.nodejs_22

          ];

          nativeBuildInputs = [

            pkgs.nodejs_22

            pkgs.importNpmLock.hooks.linkNodeModulesHook

            pkgs.brotli

          ];

          buildPhase = ''

            runHook preBuild

            export HOME=$TMPDIR

            npm run ${task}

            runHook postBuild

          '';

          installPhase = ''

            runHook preInstall

            mkdir -p $out/share/malice

            cp -R ${outDir}/. $out/share/malice/

            find $out/share/malice -type f \( -name '*.wasm' -o -name '*.js' -o -name '*.css' -o -name '*.html' -o -name '*.svg' -o -name '*.json' -o -name '*.webmanifest' \) -size +1k \

              -exec brotli --best --keep {} \; -exec gzip -9 --keep {} \;

            runHook postInstall

          '';

        };

    in

    {

      packages = forAllSystems (

        system:

        let

          pkgs = nixpkgs.legacyPackages.${system};

          wasmPlatform = pkgs.makeRustPlatform {

            cargo = wasmToolchain system;

            rustc = wasmToolchain system;

          };

          web = buildWeb pkgs {

            pname = "malice-web";

            task = "build";

            outDir = "dist";

          };

          backend = pkgs.rustPlatform.buildRustPackage {

            pname = "malice-server";

            version = "0.1.0";

            src = cleanSrc ./.;

            cargoLock = {

              lockFile = ./Cargo.lock;

              allowBuiltinFetchGit = true;

            };

            nativeBuildInputs = [ pkgs.pkg-config ];

            buildInputs = [ pkgs.sqlite ];

            cargoBuildFlags = [

              "-p"

              "malice"

            ];

            cargoTestFlags = [

              "-p"

              "malice"

            ];

            # preBuild = "export NIX_BUILD_CORES=2";

            preCheck = ''

              cargo build --release --bin malice --target ${pkgs.stdenv.hostPlatform.rust.rustcTarget} --offline --locked

            '';

            SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";

          };

          staticServer = pkgs.rustPlatform.buildRustPackage {

            pname = "malice-static";

            version = "0.1.0";

            src = cleanSrc ./.;

            cargoLock = {

              lockFile = ./Cargo.lock;

              allowBuiltinFetchGit = true;

            };

            cargoBuildFlags = [

              "-p"

              "malice-static"

            ];

            cargoTestFlags = [

              "-p"

              "malice-static"

            ];

            SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";

            meta.mainProgram = "malice-static";

          };

          server = pkgs.symlinkJoin {

            name = "malice";

            paths = [

              backend

              web

            ];

            nativeBuildInputs = [ pkgs.makeWrapper ];

            postBuild = ''

              wrapProgram $out/bin/malice --set MALICE_WEB_DIR ${web}/share/malice

            '';

          };

          # the wasm-bindgen `--target web` glue for malice-worker's `Host`, consumed by

          # web/src/worker/pkg (gitignored, worker-web's TS imports it as ./pkg/malice_worker.js)

          workerWasm = wasmPlatform.buildRustPackage {

            pname = "malice-worker-wasm";

            version = "0.1.0";

            src = cleanSrc ./.;

            cargoRoot = "crates/malice-worker";

            cargoLock = {

              lockFile = ./crates/malice-worker/Cargo.lock;

              allowBuiltinFetchGit = true;

            };

            nativeBuildInputs = [

              (wasmBindgenCli pkgs)

              pkgs.removeReferencesTo

            ];

            buildPhase = ''

              runHook preBuild

              cd crates/malice-worker

              cargo build --offline --frozen --release --lib --target wasm32-unknown-unknown

              mkdir -p $out

              wasm-bindgen --target web --out-dir $out --out-name malice_worker \

                target/wasm32-unknown-unknown/release/malice_worker.wasm

              remove-references-to -t ${wasmToolchain system} $out/*.wasm

              runHook postBuild

            '';

            doCheck = false;

            installPhase = "true";

            disallowedReferences = [ (wasmToolchain system) ];

          };

          web-device = buildWeb pkgs {

            pname = "malice-web-device";

            task = "build:device";

            outDir = "dist-device";

            postPatch = ''

              mkdir -p src/worker/pkg

              cp -R ${workerWasm}/. src/worker/pkg/

            '';

          };

          local = pkgs.symlinkJoin {

            name = "malice-local";

            paths = [

              staticServer

              web-device

            ];

            nativeBuildInputs = [ pkgs.makeWrapper ];

            postBuild = ''

              wrapProgram $out/bin/malice-static \

                --set MALICE_WEB_DIR ${web-device}/share/malice

            '';

          };

        in

        {

          inherit

            web

            server

            web-device

            local

            ;

          default = server;

        }

      );

      devShells = forAllSystems (

        system:

        let

          pkgs = nixpkgs.legacyPackages.${system};

        in

        {

          default = pkgs.mkShell {

            packages = [

              (wasmToolchain system)

              (wasmBindgenCli pkgs)

              pkgs.rust-analyzer

              pkgs.nodejs_22

              pkgs.importNpmLock.hooks.linkNodeModulesHook

              pkgs.pkg-config

              pkgs.sqlite

              pkgs.firefox

              pkgs.geckodriver

              pkgs.chromium

              pkgs.matrix-continuwuity

              pkgs.nushell

            ];

            CHROMIUM_PATH = nixpkgs.lib.getExe pkgs.chromium;

            npmDeps = webNodeModules pkgs;

            # the hook's own npmRoot would be a store path, so link into the checkout's web/ instead

            shellHook = ''

              npmRoot="$(git rev-parse --show-toplevel 2>/dev/null || pwd)/web" linkNodeModulesHook

            '';

            # fenix's rustc links through its bundled rust-lld, which skips nix's ld-wrapper and so

            # the store rpaths, leaving the native server unable to find libsqlite3 at run time

            "CARGO_TARGET_${

              nixpkgs.lib.toUpper (builtins.replaceStrings [ "-" ] [ "_" ] pkgs.stdenv.hostPlatform.config)

            }_RUSTFLAGS" =

              "-C linker-features=-lld";

          };

        }

      );

      nixosModules.malice = import ./nix/module.nix { inherit self; };

      nixosModules.default = self.nixosModules.malice;

      checks = forAllSystems (

        system:

        let

          pkgs = nixpkgs.legacyPackages.${system};

          wasmPlatform = pkgs.makeRustPlatform {

            cargo = wasmToolchain system;

            rustc = wasmToolchain system;

          };

          # continuwuity refuses to start without /etc/resolv.conf, which the build sandbox lacks, or with

          # stdenv's deliberately bogus SSL_CERT_FILE. no exec, run.nu launches through a shell that exits at

          # once and would trip --die-with-parent, so this shell stays as the parent run.nu kills

          sandboxedHomeserver = pkgs.writeShellScriptBin "conduwuit" ''

            export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt

            ${pkgs.lib.getExe pkgs.bubblewrap} --die-with-parent --dev-bind / / --tmpfs /etc \

              --ro-bind ${pkgs.writeText "resolv.conf" "nameserver 127.0.0.1\n"} /etc/resolv.conf \

              ${pkgs.lib.getExe' pkgs.matrix-continuwuity "conduwuit"} "$@"

          '';

        in

        {

          default = self.packages.${system}.default;

          worker-wasm = self.packages.${system}.web-device;

          web = pkgs.stdenvNoCC.mkDerivation {

            pname = "malice-web-check";

            version = "0.1.0";

            src = cleanSrc ./web;

            npmDeps = webNodeModules pkgs;

            nativeBuildInputs = [

              pkgs.nodejs_22

              pkgs.importNpmLock.hooks.linkNodeModulesHook

            ];

            buildPhase = ''

              runHook preBuild

              export HOME=$TMPDIR

              npm run check

              npm test

              runHook postBuild

            '';

            installPhase = "touch $out";

          };

          worker-browser = wasmPlatform.buildRustPackage {

            pname = "malice-worker-browser-check";

            version = "0.1.0";

            src = cleanSrc ./.;

            cargoRoot = "crates/malice-worker";

            cargoLock = {

              lockFile = ./crates/malice-worker/Cargo.lock;

              allowBuiltinFetchGit = true;

            };

            nativeBuildInputs = [

              (wasmBindgenCli pkgs)

              pkgs.firefox

              pkgs.geckodriver

              sandboxedHomeserver

              pkgs.nushell

            ];

            buildPhase = ''

              runHook preBuild

              export HOME=$TMPDIR

              nu --no-config-file crates/malice-worker/run.nu

              runHook postBuild

            '';

            doCheck = false;

            installPhase = "touch $out";

          };

        }

      );

    };

}