website/flake.nix

{
  description = "Jet Pham's personal website";
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    rust-overlay.url = "github:oxalica/rust-overlay";
    flake-utils.url = "github:numtide/flake-utils";
    agenix.url = "github:ryantm/agenix";
    agenix.inputs.nixpkgs.follows = "nixpkgs";
  };
  outputs =
    {
      self,
      nixpkgs,
      rust-overlay,
      flake-utils,
      agenix,
    }:
    (flake-utils.lib.eachDefaultSystem (
      system:
      let
        overlays = [ (import rust-overlay) ];
        pkgs = import nixpkgs { inherit system overlays; };
        agenixPkg = agenix.packages.${system}.default;
        rustToolchain = pkgs.rust-bin.selectLatestNightlyWith (
          toolchain:
          toolchain.default.override {
            extensions = [ "rust-src" ];
            targets = [ "wasm32-unknown-unknown" ];
          }
        );

        # Stage 1: Build the WASM crate (FOD — network allowed, output content-addressed)
        cgol-wasm = pkgs.stdenv.mkDerivation {
          pname = "cgol-wasm";
          version = "0.1.0";
          src = ./cgol;

          nativeBuildInputs = [
            rustToolchain
            pkgs.wasm-pack
            pkgs.binaryen
            pkgs.cacert
          ];

          buildPhase = ''
            export HOME=$TMPDIR
            export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
            wasm-pack build --release --target web
            wasm-opt pkg/cgol_bg.wasm -o pkg/cgol_bg.wasm -O4 \
              --enable-bulk-memory --enable-nontrapping-float-to-int \
              --enable-sign-ext --low-memory-unused --converge
          '';

          installPhase = ''
            mkdir -p $out
            cp pkg/cgol_bg.wasm $out/
            cp pkg/cgol.js $out/
            cp pkg/cgol.d.ts $out/
            cp pkg/cgol_bg.wasm.d.ts $out/ 2>/dev/null || true
            cat > $out/package.json <<'EOF'
            {
              "name": "cgol",
              "type": "module",
              "version": "0.1.0",
              "files": ["cgol_bg.wasm", "cgol.js", "cgol.d.ts"],
              "main": "cgol.js",
              "types": "cgol.d.ts",
              "sideEffects": ["./snippets/*"]
            }
            EOF
          '';

          outputHashAlgo = "sha256";
          outputHashMode = "recursive";
          outputHash = "sha256-5Wiyqr9+3lAwelQAGe4VwTkFhEqhXytO0G6hdAIbil0=";
        };

        # Stage 2: Build the website with npm
        website = pkgs.buildNpmPackage {
          pname = "jet-website";
          version = "0.1.0";
          src = pkgs.lib.cleanSource ./.;
          npmDepsHash = "sha256-hAPfXGje+8pjMRZ5KZKcbu+TgZ9uy+dbYIFVrNQsItg=";

          # Inject the Nix-built WASM before npm install resolves file: dep
          postPatch = ''
            mkdir -p cgol/pkg
            cp -r ${cgol-wasm}/* cgol/pkg/
          '';

          installPhase = ''
            runHook preInstall
            mkdir -p $out
            cp -r dist/* $out/
            runHook postInstall
          '';
        };
        qa-api = pkgs.rustPlatform.buildRustPackage {
          pname = "jetpham-qa-api";
          version = "0.1.0";
          src = ./api;
          cargoHash = "sha256-PL5D3NtPFZcDIxf8f2EOT7fahKVgt/+7obJIdR17AUY=";
          nativeBuildInputs = [ pkgs.pkg-config ];
          buildInputs = [ pkgs.openssl ];
        };

      in
      {
        packages = {
          default = website;
          cgol-wasm = cgol-wasm;
          inherit qa-api;
        };
        devShells.default = pkgs.mkShell {
          buildInputs = with pkgs; [
            nodejs
            git
            curl
            openssl
            agenixPkg
            typescript-language-server
            pkg-config
            wasm-pack
            binaryen
            rustToolchain
          ];
        };
      }
    ))
    // {
      nixosModules.default = import ./module.nix self;
    };
}