p0: skeleton, dialer-Control URL guard, flake, Makefile

Go service with /healthz, SSRF guard (parse + resolve-all + Control), exhaustive tests, NixOS module, and Makefile as source of truth for build flags. nix flake check runs make test lint.
2026-09-22 21:26:13 -07:00
parent 7d4f090a12
commit 2607d56e4c
14 changed files with 1490 additions and 1 deletions
@@ -0,0 +1,112 @@
+{
+  description = "sift: LLM-oriented fetch and search";
+
+  inputs.nixpkgs.url = "nixpkgs/nixos-26.05";
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      systems = [ "x86_64-linux" ];
+      forAllSystems = nixpkgs.lib.genAttrs systems;
+      version =
+        if self ? shortRev then
+          self.shortRev
+        else if self ? dirtyShortRev then
+          self.dirtyShortRev
+        else
+          "dev";
+      # Keep in lockstep with Makefile LDFLAGS / -trimpath.
+      ldflags = [
+        "-s"
+        "-w"
+        "-X"
+        "main.version=${version}"
+      ];
+    in
+    {
+      packages = forAllSystems (
+        system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+          sift = pkgs.buildGoModule {
+            pname = "sift";
+            inherit version;
+            src = ./.;
+            vendorHash = null;
+            env.CGO_ENABLED = "0";
+            ldflags = ldflags;
+            subPackages = [ "cmd/sift" ];
+            # buildGoModule already passes -trimpath.
+            meta = {
+              description = "LLM-oriented fetch and search";
+              mainProgram = "sift";
+            };
+          };
+        in
+        {
+          inherit sift;
+          default = sift;
+        }
+      );
+
+      nixosModules.sift =
+        { pkgs, ... }:
+        {
+          imports = [ ./nix/module.nix ];
+          services.sift.package = nixpkgs.lib.mkDefault self.packages.${pkgs.stdenv.hostPlatform.system}.sift;
+        };
+      nixosModules.default = self.nixosModules.sift;
+
+      checks = forAllSystems (
+        system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+          src = ./.;
+        in
+        {
+          test = pkgs.stdenv.mkDerivation {
+            name = "sift-make-test-lint";
+            inherit src;
+            nativeBuildInputs = [
+              pkgs.go
+              pkgs.gcc
+              pkgs.gnumake
+              pkgs.git
+            ];
+            dontConfigure = true;
+            buildPhase = ''
+              export HOME=$TMPDIR
+              export GOCACHE=$TMPDIR/go-cache
+              export GOPATH=$TMPDIR/go
+              export GO111MODULE=on
+              # race detector needs cgo; build stays CGO_ENABLED=0 in packages.sift
+              export CGO_ENABLED=1
+              make test lint
+            '';
+            installPhase = ''
+              mkdir -p $out
+              echo ok > $out/ok
+            '';
+          };
+        }
+      );
+
+      devShells = forAllSystems (
+        system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+        in
+        {
+          default = pkgs.mkShell {
+            nativeBuildInputs = [
+              pkgs.go
+              pkgs.gopls
+              pkgs.go-tools
+              pkgs.gnumake
+              pkgs.git
+            ];
+          };
+        }
+      );
+    };
+}