malice

{

  description = "Malice: a hosted Matrix client backed by macltok";

  inputs = {

    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";

    fenix = {

      url = "github:nix-community/fenix";

      inputs.nixpkgs.follows = "nixpkgs";

    };

  };

  outputs =

    { self, nixpkgs, fenix }:

    let

      systems = [

        "x86_64-linux"

        "aarch64-linux"

      ];

      forAllSystems = nixpkgs.lib.genAttrs systems;

      workerLock = builtins.fromTOML (builtins.readFile ./crates/malice-worker/Cargo.lock);

      lockedVersion =

        name: (nixpkgs.lib.findFirst (p: p.name == name) null workerLock.package).version;

      # wasm-bindgen-test-runner refuses a module built by any other wasm-bindgen version

      wasmBindgenCli =

        pkgs:

        pkgs.buildWasmBindgenCli rec {

          src = pkgs.fetchCrate {

            pname = "wasm-bindgen-cli";

            version = lockedVersion "wasm-bindgen";

            hash = "sha256-a7lcXJnnZkYReja+iUO7NqqrWyv3toxnUgQb8s4IS5s=";

          };

          cargoDeps = pkgs.rustPlatform.fetchCargoVendor {

            inherit src;

            inherit (src) pname version;

            hash = "sha256-R1Tas33Ursy8kqsxguAkG0ZhNed2n5uFTAhw1l2qlLY=";

          };

        };

      wasmToolchain =

        system:

        let

          toolchains = fenix.packages.${system};

        in

        toolchains.combine [

          toolchains.stable.cargo

          toolchains.stable.clippy

          toolchains.stable.rustc

          toolchains.stable.rustfmt

          toolchains.stable.rust-src

          toolchains.targets.wasm32-unknown-unknown.stable.rust-std

        ];

    in

    {

      packages = forAllSystems (

        system:

        let

          pkgs = nixpkgs.legacyPackages.${system};

          wasmPlatform = pkgs.makeRustPlatform {

            cargo = wasmToolchain system;

            rustc = wasmToolchain system;

          };

          web = pkgs.buildNpmPackage {

            pname = "malice-web";

            version = "0.1.0";

            src = ./web;

            npmDepsHash = "sha256-Q00XwHH/+kfZTAPBKUlkx3hAtYvSpDw2opj22nGTIMY=";

            installPhase = ''

              runHook preInstall

              mkdir -p $out/share/malice

              cp -R dist/. $out/share/malice/

              runHook postInstall

            '';

          };

          backend = pkgs.rustPlatform.buildRustPackage {

            pname = "malice-server";

            version = "0.1.0";

            src = ./.;

            cargoLock.lockFile = ./Cargo.lock;

            nativeBuildInputs = [ pkgs.pkg-config ];

            buildInputs = [ pkgs.sqlite ];

            # preBuild = "export NIX_BUILD_CORES=2";

            preCheck = ''

              cargo build --release --bin malice --target ${pkgs.stdenv.hostPlatform.rust.rustcTarget} --offline --locked

            '';

            SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";

          };

          server = pkgs.symlinkJoin {

            name = "malice";

            paths = [

              backend

              web

            ];

            nativeBuildInputs = [ pkgs.makeWrapper ];

            postBuild = ''

              wrapProgram $out/bin/malice --set MALICE_WEB_DIR ${web}/share/malice

            '';

          };

          # the wasm-bindgen `--target web` glue for malice-worker's `Host`, consumed by

          # web/src/worker/pkg (gitignored, worker-web's TS imports it as ./pkg/malice_worker.js)

          workerWasm = wasmPlatform.buildRustPackage {

            pname = "malice-worker-wasm";

            version = "0.1.0";

            src = self;

            cargoRoot = "crates/malice-worker";

            cargoLock.lockFile = ./crates/malice-worker/Cargo.lock;

            nativeBuildInputs = [ (wasmBindgenCli pkgs) ];

            buildPhase = ''

              runHook preBuild

              cd crates/malice-worker

              cargo build --offline --frozen --release --lib --target wasm32-unknown-unknown

              mkdir -p $out

              wasm-bindgen --target web --out-dir $out --out-name malice_worker \

                target/wasm32-unknown-unknown/release/malice_worker.wasm

              runHook postBuild

            '';

            doCheck = false;

            installPhase = "true";

          };

          web-device = pkgs.buildNpmPackage {

            pname = "malice-web-device";

            version = "0.1.0";

            src = ./web;

            npmDepsHash = "sha256-Q00XwHH/+kfZTAPBKUlkx3hAtYvSpDw2opj22nGTIMY=";

            postPatch = ''

              mkdir -p src/worker/pkg

              cp -R ${workerWasm}/. src/worker/pkg/

            '';

            npmBuildScript = "build:device";

            installPhase = ''

              runHook preInstall

              mkdir -p $out/share/malice

              cp -R dist-device/. $out/share/malice/

              runHook postInstall

            '';

          };

          local = pkgs.symlinkJoin {

            name = "malice-local";

            paths = [

              backend

              web-device

            ];

            nativeBuildInputs = [ pkgs.makeWrapper ];

            postBuild = ''

              wrapProgram $out/bin/malice \

                --set MALICE_WEB_DIR ${web-device}/share/malice \

                --set MALICE_STATIC_ONLY 1

            '';

          };

        in

        {

          inherit web server web-device local;

          default = server;

        }

      );

      devShells = forAllSystems (

        system:

        let

          pkgs = nixpkgs.legacyPackages.${system};

        in

        {

          default = pkgs.mkShell {

            packages = [

              (wasmToolchain system)

              (wasmBindgenCli pkgs)

              pkgs.rust-analyzer

              pkgs.nodejs_22

              pkgs.pkg-config

              pkgs.sqlite

              pkgs.firefox

              pkgs.geckodriver

              pkgs.matrix-continuwuity

              pkgs.nushell

            ];

            # fenix's rustc links through its bundled rust-lld, which skips nix's ld-wrapper and so

            # the store rpaths, leaving the native server unable to find libsqlite3 at run time

            "CARGO_TARGET_${nixpkgs.lib.toUpper (builtins.replaceStrings [ "-" ] [ "_" ] pkgs.stdenv.hostPlatform.config)}_RUSTFLAGS" =

              "-C linker-features=-lld";

          };

        }

      );

      nixosModules.malice = import ./nix/module.nix { inherit self; };

      nixosModules.default = self.nixosModules.malice;

      checks = forAllSystems (

        system:

        let

          pkgs = nixpkgs.legacyPackages.${system};

          wasmPlatform = pkgs.makeRustPlatform {

            cargo = wasmToolchain system;

            rustc = wasmToolchain system;

          };

          # continuwuity refuses to start without /etc/resolv.conf, which the build sandbox lacks, or with

          # stdenv's deliberately bogus SSL_CERT_FILE. no exec, run.nu launches through a shell that exits at

          # once and would trip --die-with-parent, so this shell stays as the parent run.nu kills

          sandboxedHomeserver = pkgs.writeShellScriptBin "conduwuit" ''

            export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt

            ${pkgs.lib.getExe pkgs.bubblewrap} --die-with-parent --dev-bind / / --tmpfs /etc \

              --ro-bind ${pkgs.writeText "resolv.conf" "nameserver 127.0.0.1\n"} /etc/resolv.conf \

              ${pkgs.lib.getExe' pkgs.matrix-continuwuity "conduwuit"} "$@"

          '';

        in

        {

          default = self.packages.${system}.default;

          worker-wasm = self.packages.${system}.web-device;

          worker-browser = wasmPlatform.buildRustPackage {

            pname = "malice-worker-browser-check";

            version = "0.1.0";

            src = self;

            cargoRoot = "crates/malice-worker";

            cargoLock.lockFile = ./crates/malice-worker/Cargo.lock;

            nativeBuildInputs = [

              (wasmBindgenCli pkgs)

              pkgs.firefox

              pkgs.geckodriver

              sandboxedHomeserver

              pkgs.nushell

            ];

            buildPhase = ''

              runHook preBuild

              export HOME=$TMPDIR

              nu --no-config-file crates/malice-worker/run.nu

              runHook postBuild

            '';

            doCheck = false;

            installPhase = "touch $out";

          };

        }

      );

    };

}