pirats/flake.nix

{
  description = "Rats with Gats Remote Play Web App";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
  };

  outputs = { self, nixpkgs, ... }:
    let
      # Systems to support
      supportedSystems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
      
      # Helper to generate an attrset for all supported systems
      forAllSystems = f: nixpkgs.lib.genAttrs supportedSystems (system: f system);
    in
    {
      packages = forAllSystems (system:
        let
          pkgs = nixpkgs.legacyPackages.${system};
          python = pkgs.python3;
          
          # Build the Svelte frontend
          frontend = pkgs.buildNpmPackage {
            pname = "pirats-frontend";
            version = "0.1.0";
            src = ./frontend;
            npmDepsHash = "sha256-ekYBi0oUjtnsfdig2B0yrmT7KbSc9IB1DVbTCRwYI24=";
            installPhase = ''
              mkdir -p $out
              cp -r dist $out/
            '';
          };
          
        in
        {
          default = python.pkgs.buildPythonApplication {
            pname = "pirats";
            version = "0.1.0";
            src = ./.;
            format = "pyproject";

            nativeBuildInputs = with python.pkgs; [
              setuptools
              wheel
            ];

            propagatedBuildInputs = with python.pkgs; [
              fastapi
              sqlmodel
              uvicorn
              python-multipart
              httpx
            ];

            nativeCheckInputs = with python.pkgs; [
              pytestCheckHook
            ];
            
            preBuild = ''
              mkdir -p src/pirats/static
              cp -r ${frontend}/dist/* src/pirats/static/
            '';

            pythonImportsCheck = [ "pirats" ];
          };
          pirats = self.packages.${system}.default;
        }
      );

      devShells = forAllSystems (system:
        let
          pkgs = nixpkgs.legacyPackages.${system};
        in
        {
          default = pkgs.mkShell {
            inputsFrom = [ self.packages.${system}.default ];
            packages = with pkgs; [
              pkgs.python3.pkgs.pytest
              pkgs.nodejs
            ];
          };
        }
      );

      # NixOS Module to run the application as a service
      nixosModules.default = { config, lib, pkgs, ... }:
        let
          cfg = config.services.pirats;
        in
        {
          options.services.pirats = {
            enable = lib.mkEnableOption "Rats with Gats remote play service";
            package = lib.mkOption {
              type = lib.types.package;
              default = self.packages.${pkgs.system}.default;
              description = "The pirats package to use.";
            };
            host = lib.mkOption {
              type = lib.types.str;
              default = "127.0.0.1";
              description = "The host address to bind to.";
            };
            port = lib.mkOption {
              type = lib.types.port;
              default = 8000;
              description = "The port to listen on.";
            };
            databasePath = lib.mkOption {
              type = lib.types.str;
              default = "/var/lib/pirats/rats_with_gats.db";
              description = "Path to the SQLite database file.";
            };
            openFirewall = lib.mkOption {
              type = lib.types.bool;
              default = false;
              description = "Open ports in the firewall for the service.";
            };
          };

          config = lib.mkIf cfg.enable {
            networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ];

            systemd.services.pirats = {
              description = "Rats with Gats Web Application";
              after = [ "network.target" ];
              wantedBy = [ "multi-user.target" ];

              environment = {
                DATABASE_URL = "sqlite:///${cfg.databasePath}";
              };

              serviceConfig = {
                ExecStart = "${cfg.package}/bin/pirats --host ${cfg.host} --port ${toString cfg.port}";
                Restart = "always";
                
                # Sandboxing and security
                DynamicUser = true;
                StateDirectory = "pirats";
                WorkingDirectory = "/var/lib/pirats";
                
                ProtectSystem = "strict";
                ProtectHome = true;
                PrivateTmp = true;
                PrivateDevices = true;
              };
            };
          };
        };
    };
}