flake.nix

{
  description = "Intermesh";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
    flake-utils.url = "github:numtide/flake-utils/v1.0.0";
    crane.url = "github:ipetkov/crane/v0.23.0";
    rust-overlay.url = "github:oxalica/rust-overlay";
    rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = { self, nixpkgs, flake-utils, crane, rust-overlay }:
    flake-utils.lib.eachDefaultSystem (system:
      let
        pkgs = import nixpkgs {
          inherit system;
          overlays = [ (import rust-overlay) ];
        };

        rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;

        # Crane is a Nix library for building Rust projects with incremental
        # compilation. It splits builds into phases so dependencies are cached
        # separately from the code.
        craneLib = (crane.mkLib pkgs).overrideToolchain rustToolchain;

        # Minimal source for dependency compilation. Only includes files needed
        # to determine and build dependencies, not the actual source code. This
        # ensures cargoArtifacts only rebuilds when Cargo.lock or proto changes.
        # Note we include proto in these dependencies since they rarely change
        # and take a long time to build.
        depsSrc = pkgs.lib.fileset.toSource {
          root = ./.;
          fileset = pkgs.lib.fileset.unions [
            ./flake.nix
            ./flake.lock
            ./Cargo.toml
            ./Cargo.lock
            ./build.rs
            ./proto
            ./xtask
          ];
        };

        # Full source for building the actual binary.
        src = pkgs.lib.cleanSourceWith {
          src = ./.;
          filter = path: type:
            (craneLib.filterCargoSources path type) ||
            (builtins.match ".*\\.proto$" path != null) ||
            (builtins.match ".*\\.pest$" path != null);
        };

        # Build dependencies using only the minimal depsSrc.
        cargoArtifacts = craneLib.buildDepsOnly {
          src = depsSrc;
          strictDeps = true;
          doCheck = false;
        };

        # Build the final binary using full source but reusing cached deps.
        intermeshUnwrapped = craneLib.buildPackage {
          inherit src cargoArtifacts;
          strictDeps = true;
          doCheck = false;
          cargoExtraArgs = "--bin intermesh";
        };

        # Wrap intermesh so nftables is in PATH (required by the proxy).
        # TODO(ejj): interact with the kernel directly over netlink so we can
        # ship a static binary without this wrapper.
        intermesh = pkgs.runCommand "intermesh" {
          nativeBuildInputs = [ pkgs.makeWrapper ];
        } ''
          mkdir -p $out/bin
          makeWrapper ${intermeshUnwrapped}/bin/intermesh $out/bin/intermesh \
            --prefix PATH : ${pkgs.lib.makeBinPath [ pkgs.nftables ]}
        '';

        testTools = pkgs.buildEnv {
          name = "intermesh-test-tools";
          paths = [
            pkgs.bash
            (pkgs.writeShellScriptBin "sh" ''
              exec ${pkgs.bash}/bin/bash "$@"
            '')
            pkgs.caddy
            pkgs.coreutils
            pkgs.curl
            pkgs.dnsmasq
            pkgs.dnsutils
            pkgs.findutils
            pkgs.gawk
            pkgs.gnugrep
            pkgs.gnused
            pkgs.inetutils
            pkgs.iproute2
            pkgs.iputils
            pkgs.netcat-openbsd
            pkgs.nftables
            pkgs.procps
            pkgs.tcpdump
            pkgs.which
          ];
          ignoreCollisions = true;
        };
      in
      {
        packages.default = intermesh;
        packages.intermesh = intermesh;
        packages.test-tools = testTools;
        packages.deps = cargoArtifacts;

        # Development shell dependencies
        devShells.default = pkgs.mkShell {
          buildInputs = [
            rustToolchain

            pkgs.protobuf
            pkgs.cmake
            pkgs.ruby_3_3
            pkgs.util-linux
            pkgs.docker-client
            pkgs.incus

            pkgs.cargo-outdated
            pkgs.cargo-udeps
            pkgs.cargo-audit

            pkgs.pkg-config
          ];
        };
      }
    );
}