flake.nix

{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
    devshell-tools.url = "github:eikek/devshell-tools";
  };

  outputs = inputs @ {
    self,
    nixpkgs,
    flake-utils,
    devshell-tools,
  }:
    {
      nixosConfigurations = let
        services = {
          services.dev-postgres = {
            enable = true;
            databases = ["renku_test"];
            init-script = ./.devcontainer/generate_ulid_func.sql;
            pgweb = {
              enable = true;
              database = "renku";
            };
          };
          services.dev-spicedb = {
            enable = true;
          };
          services.openapi-docs = {
            enable = true;
            openapi-spec = "http://localhost:8000/api/data/spec.json";
          };
        };
      in {
        rdsdev-vm = devshell-tools.lib.mkVm {
          system = flake-utils.lib.system.x86_64-linux;
          modules = [
            {
              virtualisation.memorySize = 2048;
              networking.hostName = "rdsdev";
            }
            services
          ];
        };
        rsdevcnt = devshell-tools.lib.mkContainer {
          system = flake-utils.lib.system.x86_64-linux;
          modules = [
            services
          ];
        };
      };
    }
    // flake-utils.lib.eachDefaultSystem (system: let
      pkgs = nixpkgs.legacyPackages.${system};
      devshellToolsPkgs = devshell-tools.packages.${system};

      devSettings = {
        CORS_ALLOW_ALL_ORIGINS = "true";
        DB_USER = "dev";
        DB_NAME = "renku";
        DB_PASSWORD = "dev";
        PGPASSWORD = "dev";
        AUTHZ_DB_KEY = "dev";
        AUTHZ_DB_NO_TLS_CONNECTION = "true";
        AUTHZ_DB_GRPC_PORT = "50051";
        ALEMBIC_CONFIG = "./components/renku_data_services/migrations/alembic.ini";
        NB_SERVER_OPTIONS__DEFAULTS_PATH = "server_defaults.json";
        NB_SERVER_OPTIONS__UI_CHOICES_PATH = "server_options.json";

        LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib";
        POETRY_VIRTUALENVS_PREFER_ACTIVE_PYTHON = "true";
        POETRY_VIRTUALENVS_OPTIONS_SYSTEM_SITE_PACKAGES = "true";
        POETRY_INSTALLER_NO_BINARY = "ruff";
      };

      commonPackages = with pkgs; [
        redis
        postgresql
        jq
        devshellToolsPkgs.openapi-docs
        spicedb
        cargo
        rustc
        spicedb-zed
        ruff
        ruff-lsp
        poetry
        python312
        pyright
        rclone
      ];
    in {
      formatter = pkgs.alejandra;

      devShells = rec {
        default = vm;
        vm = pkgs.mkShell (devSettings
          // {
            buildInputs =
              commonPackages
              ++ (builtins.attrValues devshell-tools.legacyPackages.${system}.vm-scripts);

            DEV_VM = "rdsdev-vm";
            VM_SSH_PORT = "10022";

            DB_HOST = "localhost";
            DB_PORT = "15432";
            AUTHZ_DB_HOST = "localhost";
          });

        cnt = let
          # authzed-py doesn't allow to connect via non-localhost, so this must
          # be run (in the background) to forward localhost:50051 to the container
          forward-auth = pkgs.writeShellScriptBin "authzed-forward-localhost" ''
            ${pkgs.socat}/bin/socat TCP-LISTEN:50051,fork TCP:rsdevcnt:50051
          '';
        in
          pkgs.mkShell (
            devSettings
            // {
              buildInputs =
                commonPackages
                ++ [forward-auth]
                ++ (builtins.attrValues devshell-tools.legacyPackages.${system}.cnt-scripts);

              DEV_CONTAINER = "rsdevcnt";

              DB_HOST = "rsdevcnt";
              DB_PORT = "5432";
              AUTHZ_DB_HOST = "localhost";
            }
          );
      };
    });
}