kyle/boxmaker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nix: a flake that builds every binary, the tool image and a dev shell

Browse Source 
Follows the owner's other projects (sift, tether): nixpkgs pinned to
nixos-26.05, x86_64-linux, the version from the commit. `packages.default`
builds all six binaries with rustPlatform (tests stay in `make gate`),
`packages.tools-image` is deploy/tools-image.nix, and `devShells.default`
has Rust 1.95.0, clippy, rustfmt, cargo-deny and make. No NixOS module
yet: that is M8 (P22).

Checked on straylight: `nix flake check` passes; `nix build` gives
brokerd, bxctl, gatewayd, inferproxy, loopd and toolkit, each printing
its usage; `nix build .#tools-image` and `nix develop` work.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kyle
2026-09-25 16:41:29 -07:00
co-authored by Claude Opus 5.5
parent 45f311ecfc
commit 41f8329afe
5 changed files with 119 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/dependencies.md
+12
View File
@@ -12,3 +12,15 @@ Every external crate has a row here. `scripts/check-dep-docs.sh` enforces it.
| `rustls` | 0.23.45 | `gatewayd` | TLS to Mattermost over the tailnet (M4a, owner's decision). `default-features = false` with `ring`, `std`, `tls12`. With its dependencies on Linux: `ring` (Apache-2.0 AND ISC; builds C and assembly), `rustls-webpki` and `untrusted` (ISC), `rustls-pki-types`, `subtle` (BSD-3-Clause), `zeroize`, `once_cell`, `getrandom`, `libc`, `cfg-if`. Apache-2.0 OR ISC OR MIT. |
| `rustls-native-certs` | 0.8.4 | `gatewayd` | The host's trusted certificates, so a CA installed on the host is trusted too; adds `openssl-probe`. Apache-2.0 OR ISC OR MIT. |
| `zeroize` | 1.9.0 | `gatewayd` | Wipes a secret's memory when it is dropped (`Secret`). Already a dependency of `rustls`. Apache-2.0 OR MIT. |
## Build inputs
`flake.nix` has one input, `nixpkgs`, pinned to `nixos-26.05` in `flake.lock`: the release the
owner's NixOS hosts run, so a host's config can use the flake with
`inputs.boxmaker.inputs.nixpkgs.follows = "nixpkgs"`. It has Rust 1.95.0, the workspace's
`rust-version`. Nix fetches it when building, never the harness when running, so it is not in
`docs/egress.md`.
- `nix build` builds every binary (`result/bin/`); the tests are not run there, only in `make gate`.
- `nix build .#tools-image` builds the tool containers' image (`deploy/tools-image.nix`).
- `nix develop` gives a shell with `cargo`, `rustc`, `clippy`, `rustfmt`, `cargo-deny` and `make`.