[nix] migrate to flake.nix

This simplifies the multitude of nix files that we have into 1 single flake.

.envrc

-use nix
+#use nix
+use flake

.gitlab-ci.yml

@@ -14,19 +14,19 @@ variables:
   #- apt-get install make xz-utils
 
 stages:
-  - deps
+  # - deps
   - compile
   - test
 
-deps:
-  stage: deps
-  cache:
-    paths:
-      - /nix/store
-      #- node_modules/
-      #- ${CI_PROJECT_DIR}/bun.lockb
-  script:
-    - nix-shell shell.nix --run 'bun install --skip-builds'
+# deps:
+#   stage: deps
+#   cache:
+#     paths:
+#       - /nix/store
+#       #- node_modules/
+#       #- ${CI_PROJECT_DIR}/bun.lockb
+#   script:
+#     - nix-shell shell.nix --run 'bun install --skip-builds'
 
 compile:
   stage: compile
@@ -38,8 +38,10 @@ compile:
       #- .spago/
       #- ${CI_PROJECT_DIR}/bun.lockb
   script:
-    - nix-shell shell.nix --run fix-bun
-    - nix-shell shell.nix --run compile
+    - nix run .#fix-bun
+    #- nix-shell shell.nix --run fix-bun
+    - nix run .#compile
+    #- nix-shell shell.nix --run compile
 
 test:
   stage: test
@@ -53,6 +55,8 @@ test:
       #- .spago/
       #- ${CI_PROJECT_DIR}/bun.lockb
   script:
-    - nix-shell shell.nix --run fix-bun
-    - nix-shell shell.nix --run test-ps
+    - nix run .#fix-bun
+    #- nix-shell shell.nix --run fix-bun
+    - nix run .#test-ps
+    #- nix-shell shell.nix --run test-ps
 

README.md

@@ -53,10 +53,14 @@ nix-env (Nix) 2.11.0
 ```
 
 To build the frontend just execute the install script at the root at the project:
-```
+```shell
 ./install
 ```
 
+```shell
+nix -L develop
+```
+
 **Local instance is ready!** (Example: http://localhost:8000/)
 
 

flake.lock

+{
+  "nodes": {
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1715008058,
+        "narHash": "sha256-Tdlna0uGWvQzGwc/7kL1ICx/fqJaBfFJAmrkKP+cZS4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "860e65d27036476edfb85dd847d982277880b143",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "rev": "860e65d27036476edfb85dd847d982277880b143",
+        "type": "indirect"
+      }
+    },
+    "purescript-overlay": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "slimlock": "slimlock"
+      },
+      "locked": {
+        "lastModified": 1713366964,
+        "narHash": "sha256-s1WUptOTTAQ3aW6JlIpDgWofoQF5vp7q8ItbTeSxLL4=",
+        "owner": "thomashoneyman",
+        "repo": "purescript-overlay",
+        "rev": "235afffdb751d83c7775b334e5be944848fc24ad",
+        "type": "github"
+      },
+      "original": {
+        "owner": "thomashoneyman",
+        "repo": "purescript-overlay",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs",
+        "purescript-overlay": "purescript-overlay"
+      }
+    },
+    "slimlock": {
+      "inputs": {
+        "nixpkgs": [
+          "purescript-overlay",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1688756706,
+        "narHash": "sha256-xzkkMv3neJJJ89zo3o2ojp7nFeaZc2G0fYwNXNJRFlo=",
+        "owner": "thomashoneyman",
+        "repo": "slimlock",
+        "rev": "cf72723f59e2340d24881fd7bf61cb113b4c407c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "thomashoneyman",
+        "repo": "slimlock",
+        "type": "github"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

+{
+  description = "Gargantext PureScript fronetnd";
+
+  inputs.flake-utils.url = "github:numtide/flake-utils";
+
+  # bun-1.1
+  inputs.nixpkgs.url = "nixpkgs/860e65d27036476edfb85dd847d982277880b143";
+
+  # bun-1.0
+  #inputs.nixpkgs.url = "nixpkgs/23.11";
+
+  inputs.purescript-overlay = {
+    url = "github:thomashoneyman/purescript-overlay";
+    inputs.nixpkgs.follows = "nixpkgs";
+  };
+  
+  outputs = { self, nixpkgs, flake-utils, purescript-overlay }:
+    flake-utils.lib.eachDefaultSystem (system:
+      #let pkgs = nixpkgs.legacyPackages.${system};
+      let
+        pkgs = import nixpkgs {
+          inherit system;
+          overlays = [ purescript-overlay.overlays.default ];
+        };
+
+        dependencies = with pkgs; [
+          purescript
+          spago-unstable
+          bun
+          sqlite
+          nodejs
+        ];
+    
+      serve = pkgs.writeShellScriptBin "serve" ''
+        #!/usr/bin/env bash
+        set -e
+    
+        #yarn server
+        bun run server
+    
+      '';
+    
+      build-watch = pkgs.writeShellScriptBin "build-watch" ''
+        #!/usr/bin/env bash
+        set -e
+    
+        echo "Build watch"
+        bun spago build -w --then browserify
+      '';
+    
+      build-zephyr = pkgs.writeShellScriptBin "build-zephyr" ''
+        #!/usr/bin/env bash
+        set -e
+    
+        bun spago build --purs-args '--codegen corefn,js'
+        zephyr -f Main.main
+        browserify-zephyr
+      '';
+    
+      minify-bundle = pkgs.writeShellScriptBin "minify-bundle" ''
+        #!/usr/bin/env bash
+        set -e
+    
+        bun run minify
+      '';
+    
+      in
+        {
+          packages = {
+            # sometimes bun is broken because of better-sqlite3
+            fix-bun = pkgs.writeShellApplication {
+              name = "fix-bun";
+              runtimeInputs = dependencies;
+              text = ''
+              #!${pkgs.stdenv.shell}
+              set -e
+
+              cd ./node_modules/better-sqlite3
+              ${pkgs.bun}/bin/bun install
+              '';
+            };
+            compile = pkgs.writeShellApplication {
+              name = "compile";
+              runtimeInputs = dependencies;
+              text = ''
+              #!${pkgs.stdenv.shell}
+              set -e
+
+              echo "Installing JS Dependencies"
+              #yarn
+              ${pkgs.bun}/bin/bun install
+              ${pkgs.bun}/bin/bun install --dev
+          
+              echo "Compiling"
+              ${pkgs.bun}/bin/bun run build
+              '';
+            };
+            build = pkgs.writeShellApplication {
+              name = "build";
+              runtimeInputs = dependencies;
+              text = ''
+              #!${pkgs.stdenv.shell}
+              set -e
+
+              ${self.packages.${system}.compile}/bin/compile
+
+              echo "Bundling"
+              ${pkgs.bun}/bin/bun run bundle              
+              '';
+            };
+            test-ps = pkgs.writeShellApplication {
+              name = "test-ps";
+              runtimeInputs = dependencies;
+              text = ''
+              #!${pkgs.stdenv.shell}
+              set -e
+          
+              ${self.packages.${system}.compile}/bin/compile
+          
+              echo "Testing"
+              ${pkgs.bun}/bin/bun run test
+            '';
+            };    
+            repl = pkgs.writeShellApplication {
+              name = "repl";
+              runtimeInputs = dependencies;
+              text = ''
+              #!${pkgs.stdenv.shell}
+          
+              ${pkgs.bun}/bin/bun run repl
+            '';
+            };
+            
+            build-css = pkgs.writeShellApplication {
+              name = "build-css";
+              runtimeInputs = dependencies;
+              text = ''
+              #!${pkgs.stdenv.shell}
+              set -e
+          
+              #yarn css
+              ${pkgs.bun}/bin/bun run css
+            '';
+            };
+          };
+          
+          devShells.default = pkgs.mkShell {
+            name = "purescript-gargantext";
+            #inputsFrom = builtins.attrValues self.packages.${system};
+            buildInputs = with pkgs; (dependencies ++ [
+              # scripts
+              self.packages.${system}.build
+              self.packages.${system}.compile
+              self.packages.${system}.fix-bun
+              self.packages.${system}.test-ps
+              self.packages.${system}.repl
+              
+              self.packages.${system}.build-css
+              build-watch
+              build-zephyr
+              minify-bundle
+              serve
+            ]);
+          };
+        }
+    );
+}

install

@@ -3,8 +3,11 @@
 # To get infos
 # nix-shell -p nix-info --run "nix-info -m"
 
-nix-channel --update
-nix-env -iA nixpkgs.nix nixpkgs.cacert
-nix-shell --show-trace --option build-fallback true --run 'bun install'
-nix-shell --show-trace --option build-fallback true --run fix-bun
-nix-shell --show-trace --option build-fallback true --run build
+# nix-channel --update
+# nix-env -iA nixpkgs.nix nixpkgs.cacert
+# nix-shell --show-trace --option build-fallback true --run 'bun install'
+# nix-shell --show-trace --option build-fallback true --run fix-bun
+# nix-shell --show-trace --option build-fallback true --run build
+nix run .#fix-bun
+#nix run .#install
+nix run .#build

nix/unused/nodejs-patches/bypass-darwin-xcrun-node16.patch

+Avoids needing xcrun or xcodebuild in PATH for native package builds
+
+diff --git a/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py b/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
+index a75d8ee..476440d 100644
+--- a/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
++++ b/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
+@@ -522,7 +522,13 @@ class XcodeSettings:
+         # Since the CLT has no SDK paths anyway, returning None is the
+         # most sensible route and should still do the right thing.
+         try:
+-            return GetStdoutQuiet(["xcrun", "--sdk", sdk, infoitem])
++            #return GetStdoutQuiet(["xcrun", "--sdk", sdk, infoitem])
++            return {
++                "--show-sdk-platform-path": "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform",
++                "--show-sdk-path": "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.15.sdk",
++                "--show-sdk-build-version": "19A547",
++                "--show-sdk-version": "10.15"
++            }[infoitem]
+         except GypError:
+             pass
+ 
+@@ -1499,7 +1505,8 @@ def XcodeVersion():
+     version = ""
+     build = ""
+     try:
+-        version_list = GetStdoutQuiet(["xcodebuild", "-version"]).splitlines()
++        #version_list = GetStdoutQuiet(["xcodebuild", "-version"]).splitlines()
++        version_list = []
+         # In some circumstances xcodebuild exits 0 but doesn't return
+         # the right results; for example, a user on 10.7 or 10.8 with
+         # a bogus path set via xcode-select
+@@ -1510,7 +1517,8 @@ def XcodeVersion():
+         version = version_list[0].split()[-1]  # Last word on first line
+         build = version_list[-1].split()[-1]  # Last word on last line
+     except GypError:  # Xcode not installed so look for XCode Command Line Tools
+-        version = CLTVersion()  # macOS Catalina returns 11.0.0.0.1.1567737322
++        #version = CLTVersion()  # macOS Catalina returns 11.0.0.0.1.1567737322
++        version = "11.0.0.0.1.1567737322"
+         if not version:
+             raise GypError("No Xcode or CLT version detected!")
+     # Be careful to convert "4.2.3" to "0423" and "11.0.0" to "1100":

nix/unused/nodejs-patches/disable-darwin-v8-system-instrumentation-node19.patch

+Disable v8 system instrumentation on Darwin
+
+On Darwin, the v8 system instrumentation requires the header "os/signpost.h"
+which is available since apple_sdk 11+. See: https://github.com/nodejs/node/issues/39584
+
+--- old/tools/v8_gypfiles/features.gypi
++++ new/tools/v8_gypfiles/features.gypi
+@@ -62,7 +62,7 @@
+       }, {
+         'is_component_build': 0,
+       }],
+-      ['OS == "win" or OS == "mac"', {
++      ['OS == "win"', {
+         # Sets -DENABLE_SYSTEM_INSTRUMENTATION. Enables OS-dependent event tracing
+         'v8_enable_system_instrumentation': 1,
+       }, {

nix/unused/nodejs-patches/node-npm-build-npm-package-logic.patch

+This patch is based off of npm tag v9.1.5.
+
+This introduces fixes for 4 issues:
+
+1. When node-gyp is included as a dependency in a project, any scripts that run it will not use the copy included in Node. This is problematic because we patch node-gyp to work without xcbuild on Darwin, leading to these packages failing to build with a sandbox on Darwin.
+2. When a Git dependency contains install scripts, it has to be built just like any other package. Thus, we need to patch shebangs appropriately, just like in npmConfigHook.
+3. We get useless warnings that clog up logs when using a v1 lockfile, so we silence them.
+4. npm looks at a hidden lockfile to determine if files have binaries to link into `node_modules/.bin`. When using a v1 lockfile offline, this lockfile does not contain enough info, leading to binaries for packages such as Webpack not being available to scripts. We used to work around this by making npm ignore the hidden lockfile by creating a file, but now we just disable the code path entirely.
+
+To update:
+1. Run `git diff` from an npm checkout
+2. Run `fix-npm-patch-paths.sh`
+3. Include/update this frontmatter, please!
+
+diff --git a/deps/npm/node_modules/@npmcli/run-script/lib/set-path.js b/deps/npm/node_modules/@npmcli/run-script/lib/set-path.js
+index c59c270d9..98785192f 100644
+--- a/deps/npm/node_modules/@npmcli/run-script/lib/set-path.js
++++ b/deps/npm/node_modules/@npmcli/run-script/lib/set-path.js
+@@ -12,7 +12,10 @@ const setPATH = (projectPath, binPaths, env) => {
+     .reduce((set, p) => set.concat(p.filter(concatted => !set.includes(concatted))), [])
+     .join(delimiter)
+ 
+-  const pathArr = []
++  // Ensure when using buildNpmPackage hooks that Node.js'
++  // bundled copy of node-gyp is used, instead of any copy
++  // pulled in as a dependency.
++  const pathArr = process.env['NIX_NODEJS_BUILDNPMPACKAGE'] ? [nodeGypPath, PATH] : [];
+   if (binPaths) {
+     pathArr.push(...binPaths)
+   }
+@@ -26,7 +29,8 @@ const setPATH = (projectPath, binPaths, env) => {
+     pp = p
+     p = dirname(p)
+   } while (p !== pp)
+-  pathArr.push(nodeGypPath, PATH)
++  if (!process.env['NIX_NODEJS_BUILDNPMPACKAGE']) { pathArr.push(nodeGypPath, PATH) }
++
+ 
+   const pathVal = pathArr.join(delimiter)
+ 
+diff --git a/deps/npm/node_modules/pacote/lib/git.js b/deps/npm/node_modules/pacote/lib/git.js
+index 1fa8b1f96..a026bb50d 100644
+--- a/deps/npm/node_modules/pacote/lib/git.js
++++ b/deps/npm/node_modules/pacote/lib/git.js
+@@ -188,6 +188,24 @@ class GitFetcher extends Fetcher {
+       }
+       noPrepare.push(this.resolved)
+ 
++      if (process.env['NIX_NODEJS_BUILDNPMPACKAGE']) {
++        const spawn = require('@npmcli/promise-spawn')
++
++        const npmWithNixFlags = (args, cmd) => spawn('bash', ['-c', 'npm ' + args + ` $npm${cmd}Flags "$\{npm${cmd}FlagsArray[@]}" $npmFlags "$\{npmFlagsArray[@]}"`], { cwd: dir, env: { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') } }, { message: `\`npm ${args}\` failed` })
++        const patchShebangs = () => spawn('bash', ['-c', 'source $stdenv/setup; patchShebangs node_modules'], { cwd: dir })
++
++        // the DirFetcher will do its own preparation to run the prepare scripts
++        // All we have to do is put the deps in place so that it can succeed.
++        //
++        // We ignore this.npmConfig to maintain an environment that's as close
++        // to the rest of the build as possible.
++        return spawn('bash', ['-c', '$prefetchNpmDeps --fixup-lockfile package-lock.json'], { cwd: dir })
++        .then(() => npmWithNixFlags('ci --ignore-scripts', 'Install'))
++        .then(patchShebangs)
++        .then(() => npmWithNixFlags('rebuild', 'Rebuild'))
++        .then(patchShebangs)
++      }
++
+       // the DirFetcher will do its own preparation to run the prepare scripts
+       // All we have to do is put the deps in place so that it can succeed.
+       return npm(
+diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
+index 2ea66ac33..25e671318 100644
+--- a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
++++ b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
+@@ -740,7 +740,7 @@ This is a one-time fix-up, please be patient...
+           node.package = { ...mani, _id: `${mani.name}@${mani.version}` }
+         } catch (er) {
+           const warning = `Could not fetch metadata for ${name}@${id}`
+-          log.warn(heading, warning, er)
++          if (!process.env['NIX_NODEJS_BUILDNPMPACKAGE']) { log.warn(heading, warning, er) }
+         }
+         this.finishTracker(t)
+       })
+diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-actual.js b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-actual.js
+index 6c3f917c6..ec21d2cc4 100644
+--- a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-actual.js
++++ b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-actual.js
+@@ -147,7 +147,7 @@ module.exports = cls => class ActualLoader extends cls {
+       this[_actualTree].assertRootOverrides()
+ 
+       // if forceActual is set, don't even try the hidden lockfile
+-      if (!forceActual) {
++      if (!forceActual && !process.env['NIX_NODEJS_BUILDNPMPACKAGE']) {
+         // Note: hidden lockfile will be rejected if it's not the latest thing
+         // in the folder, or if any of the entries in the hidden lockfile are
+         // missing.

nix/unused/nodejs-patches/revert-arm64-pointer-auth.patch

+Fixes cross compilation to aarch64-linux by reverting
+https://github.com/nodejs/node/pull/43200
+
+--- old/configure.py
++++ new/configure.py
+@@ -1236,7 +1236,6 @@
+ 
+   # Enable branch protection for arm64
+   if target_arch == 'arm64':
+-    o['cflags']+=['-msign-return-address=all']
+     o['variables']['arm_fpu'] = options.arm_fpu or 'neon'
+ 
+   if options.node_snapshot_main is not None:

nix/unused/nodejs-v20.nix

+{ callPackage, openssl, python3, enableNpm ? true, nodejs, path }:
+
+let
+  buildNodejs = callPackage "${path}/pkgs/development/web/nodejs/nodejs.nix" {
+    inherit openssl;
+    python = python3;
+  };
+
+in
+buildNodejs {
+  inherit enableNpm;
+  version = "20.3.1";
+  sha256 = "sha256-EqgtswZpeVm0OJs1Gl+XhImGsTE/mQGw4LPYz08/mZE=";
+  patches = [
+    ./nodejs-patches/revert-arm64-pointer-auth.patch
+    ./nodejs-patches/disable-darwin-v8-system-instrumentation-node19.patch
+    ./nodejs-patches/bypass-darwin-xcrun-node16.patch
+    ./nodejs-patches/node-npm-build-npm-package-logic.patch
+  ];
+}

shell.nix → nix/unused/shell.nix

@@ -101,7 +101,7 @@ let
     echo "Testing"
     bun run test
   '';
-
+  
   # TODO: Remove this when nixpkgs is updated to newer version (23.05
   # has nodejs 20.2.1 and we need >= 20.3.1 for crypto to work)
   #nodejs_20_3_1 = pkgs.callPackage ./nix/nodejs-v20.nix {};