Merge branch 'cache_nix_build'

Canonicalizing in the nix build was causing the image links to reference the nix build path. By switching to lexical normalization, the paths are being properly calculated.

.dockerignore

@@ -1,2 +1,5 @@
 **/.git
 **/.gitignore
+/.webhook_bridge
+/result
+**/Dockerfile

.gitignore

@@ -1 +1,2 @@
 output/
+/result

.webhook_bridge/pipeline-build-homepage-staging.yaml

@@ -2,10 +2,12 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build-homepage-staging
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
-    tasks: "1h0m0s"
+    tasks: "1h0m40s"
     finally: "0h30m0s"
   taskRunTemplate:
     serviceAccountName: build-bot
@@ -44,6 +46,51 @@ spec:
                 #!/usr/bin/env sh
                 set -euo pipefail
                 echo -n "$(date +%s)" | tee $(results.unix-time.path)
+      - name: report-pending
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+            - name: revision
+              value: df36b3853a5657fd883015cdbf07ad6466918acf
+            - name: pathInRepo
+              value: task/gitea-set-status/0.1/gitea-set-status.yaml
+        params:
+          - name: CONTEXT
+            value: "$(params.JOB_NAME)"
+          - name: REPO_FULL_NAME
+            value: "$(params.REPO_OWNER)/$(params.REPO_NAME)"
+          - name: GITEA_HOST_URL
+            value: code.fizz.buzz
+          - name: SHA
+            value: "$(tasks.fetch-repository.results.commit)"
+          - name: DESCRIPTION
+            value: "Build $(params.JOB_NAME) has started"
+          - name: STATE
+            value: pending
+          - name: TARGET_URL
+            value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
+      - name: fetch-repository
+        params:
+          - name: url
+            value: $(params.REPO_URL)
+          - name: revision
+            value: $(params.PULL_BASE_SHA)
+          - name: deleteExisting
+            value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -69,53 +116,6 @@ spec:
             workspace: git-source
         runAfter:
           - fetch-repository
-      - name: report-pending
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/gitea-set-status/0.1/gitea-set-status.yaml
-        runAfter:
-          - fetch-repository
-        params:
-          - name: CONTEXT
-            value: "$(params.JOB_NAME)"
-          - name: REPO_FULL_NAME
-            value: "$(params.REPO_OWNER)/$(params.REPO_NAME)"
-          - name: GITEA_HOST_URL
-            value: code.fizz.buzz
-          - name: SHA
-            value: "$(tasks.fetch-repository.results.commit)"
-          - name: DESCRIPTION
-            value: "Build $(params.JOB_NAME) has started"
-          - name: STATE
-            value: pending
-          - name: TARGET_URL
-            value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
-      - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
-        params:
-          - name: url
-            value: $(params.REPO_URL)
-          - name: revision
-            value: $(params.PULL_BASE_SHA)
-          - name: deleteExisting
-            value: "true"
       - name: build-image
         taskRef:
           resolver: git
@@ -123,35 +123,43 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
+              value: 9c6d3bc418dc2f54d73bdfa984bce3eb6c65fd60
             - name: pathInRepo
-              value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
+              value: task/buildah-rootless-daemonless/0.1/buildah-rootless-daemonless.yaml
         params:
           - name: OUTPUT
             value: >-
-              type=image,"name=$(params.image-name):latest,$(params.image-name):$(tasks.get-time.results.unix-time)",push=true,compression=zstd,compression-level=22,oci-mediatypes=true
+              $(params.image-name):$(tasks.get-time.results.unix-time)
           - name: CONTEXT
             value: $(params.path-to-image-context)
           - name: DOCKERFILE
             value: $(params.path-to-dockerfile)
           - name: EXTRA_ARGS
             value:
-              - "--opt"
-              - "target=$(params.target-name)"
-              - --import-cache
-              - "type=registry,ref=$(params.image-name):buildcache"
-              - --export-cache
-              - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
-              - --opt
-              - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-          - name: BUILDKITD_TOML
+              - "--target"
+              - "$(params.target-name)"
+              - --cache-from
+              - "$(params.image-name)-buildcache"
+              - --cache-to
+              - "$(params.image-name)-buildcache"
+              - --build-arg
+              - "SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)"
+              - --build-arg
+              - "NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
+          - name: REGISTRIES_CONF
             value: |
-              debug = true
-              [registry."docker.io"]
-                mirrors = ["dockerhub.dockerhub.svc.cluster.local"]
-              [registry."dockerhub.dockerhub.svc.cluster.local"]
-                http = true
-                insecure = true
+              unqualified-search-registries = ["docker.io"]
+
+              [[registry]]
+              location = "dockerhub.dockerhub.svc.cluster.local"
+              insecure = true
+
+              [[registry]]
+              location = "docker.io"
+
+              [[registry.mirror]]
+              location = "dockerhub.dockerhub.svc.cluster.local" # Replace with your mirror URL
+              insecure = true
         workspaces:
           - name: source
             workspace: git-source
@@ -225,7 +233,7 @@ spec:
     - name: git-source
       volumeClaimTemplate:
         spec:
-          storageClassName: "nfs-client"
+          storageClassName: "local-path"
           accessModes:
             - ReadWriteOnce
           resources:
@@ -243,4 +251,4 @@ spec:
     - name: path-to-image-context
       value: .
     - name: path-to-dockerfile
-      value: docker/server
+      value: docker/server/Dockerfile

.webhook_bridge/pipeline-build-homepage.yaml

@@ -2,10 +2,12 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build-homepage
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
-    tasks: "1h0m0s"
+    tasks: "1h0m40s"
     finally: "0h30m0s"
   taskRunTemplate:
     serviceAccountName: build-bot
@@ -68,6 +70,7 @@ spec:
               script: |
                 #!/usr/bin/env sh
                 set -euo pipefail
+                export GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new"
                 git fetch --tags
                 current_tag=$(git tag --points-at HEAD --list 'v*.*.*')
                 if [ -z "$current_tag" ]; then
@@ -91,8 +94,6 @@ spec:
               value: df36b3853a5657fd883015cdbf07ad6466918acf
             - name: pathInRepo
               value: task/gitea-set-status/0.1/gitea-set-status.yaml
-        runAfter:
-          - fetch-repository
         params:
           - name: CONTEXT
             value: "$(params.JOB_NAME)"
@@ -108,19 +109,9 @@ spec:
             value: pending
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
+        runAfter:
+          - fetch-repository
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -128,6 +119,18 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
       - name: build-image
         taskRef:
           resolver: git
@@ -135,35 +138,43 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
+              value: 9c6d3bc418dc2f54d73bdfa984bce3eb6c65fd60
             - name: pathInRepo
-              value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
+              value: task/buildah-rootless-daemonless/0.1/buildah-rootless-daemonless.yaml
         params:
           - name: OUTPUT
             value: >-
-              type=image,"name=$(params.image-name):latest,$(params.image-name):$(tasks.detect-tag.results.tag)",push=true,compression=zstd,compression-level=22,oci-mediatypes=true
+              $(params.image-name):$(tasks.detect-tag.results.tag)
           - name: CONTEXT
             value: $(params.path-to-image-context)
           - name: DOCKERFILE
             value: $(params.path-to-dockerfile)
           - name: EXTRA_ARGS
             value:
-              - "--opt"
-              - "target=$(params.target-name)"
-              - --import-cache
-              - "type=registry,ref=$(params.image-name):buildcache"
-              - --export-cache
-              - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
-              - --opt
-              - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-          - name: BUILDKITD_TOML
+              - "--target"
+              - "$(params.target-name)"
+              - --cache-from
+              - "$(params.image-name)-buildcache"
+              - --cache-to
+              - "$(params.image-name)-buildcache"
+              - --build-arg
+              - "SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)"
+              - --build-arg
+              - "NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
+          - name: REGISTRIES_CONF
             value: |
-              debug = true
-              [registry."docker.io"]
-                mirrors = ["dockerhub.dockerhub.svc.cluster.local"]
-              [registry."dockerhub.dockerhub.svc.cluster.local"]
-                http = true
-                insecure = true
+              unqualified-search-registries = ["docker.io"]
+
+              [[registry]]
+              location = "dockerhub.dockerhub.svc.cluster.local"
+              insecure = true
+
+              [[registry]]
+              location = "docker.io"
+
+              [[registry.mirror]]
+              location = "dockerhub.dockerhub.svc.cluster.local" # Replace with your mirror URL
+              insecure = true
         workspaces:
           - name: source
             workspace: git-source
@@ -237,7 +248,7 @@ spec:
     - name: git-source
       volumeClaimTemplate:
         spec:
-          storageClassName: "nfs-client"
+          storageClassName: "local-path"
           accessModes:
             - ReadWriteOnce
           resources:
@@ -255,4 +266,4 @@ spec:
     - name: path-to-image-context
       value: .
     - name: path-to-dockerfile
-      value: docker/server
+      value: docker/server/Dockerfile

.webhook_bridge/pipeline-semver.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: semver
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -74,7 +76,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/gitea-set-status/0.1/gitea-set-status.yaml
         params:
@@ -99,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/git-clone/0.9/git-clone.yaml
         workspaces:
@@ -124,7 +126,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/gitea-set-status/0.1/gitea-set-status.yaml
         params:
@@ -153,7 +155,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/gitea-set-status/0.1/gitea-set-status.yaml
         params:
@@ -177,7 +179,7 @@ spec:
     - name: git-source
       volumeClaimTemplate:
         spec:
-          storageClassName: "nfs-client"
+          storageClassName: "local-path"
           accessModes:
             - ReadWriteOnce
           resources:

docker/server/Dockerfile

@@ -1,69 +1,67 @@
 # syntax=docker/dockerfile:1
-ARG ALPINE_VERSION="3.20"
+#
+# Builder
+#
+ARG NIX_SUBSTITUTERS=https://cache.nixos.org
 
+FROM nixos/nix:2.31.3 AS builder
 
+ARG NIX_SUBSTITUTERS
+RUN tee -a /etc/nix/nix.conf <<EOF
+extra-experimental-features = nix-command flakes
+filter-syscalls = false
+substituters = $NIX_SUBSTITUTERS
+EOF
 
-FROM scratch AS private
-ADD git@code.fizz.buzz:talexander/homepage_private.git /homepage_private
+RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
 
+COPY flake.nix flake.lock /tmp/build
+WORKDIR /tmp/build
 
+RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build --no-link '.#dependencies'
 
-FROM scratch AS explorer
-ADD https://code.fizz.buzz/talexander/organic_ast_explorer.git /organic_ast_explorer
+COPY . /tmp/build
 
+RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build '.#docker_env'
 
+# Export the built closure to a folder
+RUN mkdir /tmp/nix-store-closure
+RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure
 
-FROM scratch AS organic
-ADD git@code.fizz.buzz:talexander/organic.git /organic
+# Create a folder which will be copied to /tmp in the final image
+RUN install -d -o root -g root -m 0777 will_be_tmp
 
+# Create a folder which will be copied to /nginx in the final image
+RUN install -d -o 1000 -g 1000 -m 0755 will_be_slash_nginx
 
+#
+# Runner
+#
 
-FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS organic-build
-RUN apk add --no-cache musl-dev make bash
-RUN rustup target add wasm32-unknown-unknown
-RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked cargo install wasm-bindgen-cli
-COPY --link --from=organic /organic /organic
-WORKDIR /organic
-RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked make wasm
+FROM scratch
 
+WORKDIR /app
 
+ENV PATH="$PATH:/app/bin"
 
-FROM node:lts-alpine$ALPINE_VERSION AS explorer-build
-COPY --link --from=explorer /organic_ast_explorer /organic_ast_explorer
-COPY --link --from=organic-build /organic /organic
-WORKDIR /organic_ast_explorer
-RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/npmcache,sharing=locked npm set cache /npmcache && npm install
-RUN npm run release
+COPY --chmod=0644 --chown=0:0 <<EOF /etc/group
+root:x:0:root
+web:x:1000:web
+EOF
 
+COPY --chmod=0644 --chown=0:0 <<EOF /etc/passwd
+root:x:0:0:root:/root:/bin/sh
+web:x:1000:1000::/home/web:/bin/sh
+EOF
 
+ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+ENV NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt
 
+COPY --from=builder /tmp/nix-store-closure /nix/store
+COPY --from=builder /tmp/build/result /app
+COPY --from=builder /tmp/build/will_be_tmp /tmp
+COPY --from=builder /tmp/build/will_be_slash_nginx /nginx
 
-FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS natter-build
-RUN apk add --no-cache musl-dev
-ADD git@code.fizz.buzz:talexander/natter.git /natter
-WORKDIR /natter
-RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked CARGO_TARGET_DIR=/target cargo build --profile release-lto
-
-
-
-FROM alpine:$ALPINE_VERSION AS natter
-COPY --link --from=natter-build /target/release-lto/natter /usr/bin/
-COPY --link . /source
-COPY --link --from=private /homepage_private/static /source/static/
-COPY --link --from=explorer-build /organic_ast_explorer/dist /source/static/organic/ast_explorer/
-RUN --network=none --mount=type=tmpfs,target=/tmp natter build --config /source/natter.toml
-
-
-
-
-FROM alpine:$ALPINE_VERSION AS server
-
-RUN apk add --no-cache bash nginx
-RUN addgroup web && adduser -D -G web web && install -d -D -o web -g web -m 700 /srv/http/public
-RUN ln -sf /dev/stdout /var/log/nginx/access.log && ln -sf /dev/stderr /var/log/nginx/error.log
-
-COPY --chown=web:web docker/server/nginx.conf /srv/http
-COPY --chown=web:web docker/server/headers.include /srv/http
-COPY --from=natter --chown=web:web /source/output/ /srv/http/public/
-
-ENTRYPOINT ["/usr/sbin/nginx", "-c", "/srv/http/nginx.conf", "-e", "stderr", "-g", "daemon off;"]
+EXPOSE 8080
+CMD ["/app/nginx", "-c", "/app/nginx.conf", "-e", "stderr", "-g", "daemon off;"]

docker/server/nginx.conf

@@ -4,7 +4,8 @@ worker_processes 4;
 # Speed up regular expressions.
 pcre_jit on;
 
-error_log stderr debug;
+error_log /dev/stderr debug;
+pid /nginx/nginx.pid;
 
 events {
     # Connections per worker process.
@@ -12,7 +13,9 @@ events {
 }
 
 http {
-    include /etc/nginx/mime.types;
+    access_log /dev/stdout;
+
+    include @mime_types@;
     default_type application/octet-stream;
 
     types {
@@ -24,11 +27,11 @@ http {
     sendfile on;
     tcp_nopush on;
 
-    include headers.include;
+    include @headers_include@;
 
     server {
         listen 8080;
-        root /srv/http/public;
+        root @web_root@;
 
         location / {
             try_files $uri $uri/ =404;
@@ -47,24 +50,24 @@ http {
         }
 
         location /.well-known/ {
-            alias /srv/http/public/well-known/;
+            alias @web_root@/well-known/;
             default_type text/plain;
         }
 
         location /.well-known/openpgpkey/hu/ {
-            alias /srv/http/public/well-known/openpgpkey/fizz.buzz/hu/;
+            alias @web_root@/well-known/openpgpkey/fizz.buzz/hu/;
             default_type        "application/octet-stream";
             add_header          Access-Control-Allow-Origin * always;
         }
 
         location /.well-known/openpgpkey/policy {
-            alias /srv/http/public/well-known/openpgpkey/fizz.buzz/policy;
+            alias @web_root@/well-known/openpgpkey/fizz.buzz/policy;
             default_type        "application/octet-stream";
             add_header          Access-Control-Allow-Origin * always;
         }
 
         location ~ /\.well-known/(?<path>openpgpkey/[^/]+/hu/.*) {
-            alias /srv/http/public/well-known/$path;
+            alias @web_root@/well-known/$path;
             default_type        "application/octet-stream";
             add_header          Access-Control-Allow-Origin * always;
         }

flake.lock

@@ -0,0 +1,136 @@
+{
+  "nodes": {
+    "natter": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1792617478,
+        "narHash": "sha256-ctFfFI7qlZxv6s8nznps7KYp/QQ1zzbMKCgLtl7YYRA=",
+        "ref": "refs/heads/main",
+        "rev": "1c369e4b25caf4dd9a962340a770fbd6e543820a",
+        "revCount": 331,
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/natter.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/natter.git"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1780749050,
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "organic": {
+      "inputs": {
+        "nixpkgs": [
+          "organic_ast_explorer",
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay_2"
+      },
+      "locked": {
+        "lastModified": 1784327891,
+        "narHash": "sha256-kGmXbmpkkiD2FtX7vKNdbL6/p/fvQ9OT2iS/ve55V5I=",
+        "ref": "refs/heads/main",
+        "rev": "336b5d3d5444ad847cd5fbf1490055e733911b57",
+        "revCount": 2010,
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/organic.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/organic.git"
+      }
+    },
+    "organic_ast_explorer": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "organic": "organic"
+      },
+      "locked": {
+        "lastModified": 1784331571,
+        "narHash": "sha256-0AeEsziAEjL/lgrlTu7RvOoylV1hSozo04rfc3Y7q6M=",
+        "ref": "refs/heads/main",
+        "rev": "55b239a3fe0b7a3b70f392be36b9efd49848be03",
+        "revCount": 75,
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/organic_ast_explorer.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/organic_ast_explorer.git"
+      }
+    },
+    "root": {
+      "inputs": {
+        "natter": "natter",
+        "nixpkgs": "nixpkgs",
+        "organic_ast_explorer": "organic_ast_explorer"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "natter",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781407245,
+        "narHash": "sha256-VzJq4MmD0uyNDAceudSe1hHqcQMe9Tau0U4S+5iRGh0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "d5f483210eb016d66102eef22baa128b3b3233fc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
+      "inputs": {
+        "nixpkgs": [
+          "organic_ast_explorer",
+          "organic",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781407245,
+        "narHash": "sha256-VzJq4MmD0uyNDAceudSe1hHqcQMe9Tau0U4S+5iRGh0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "d5f483210eb016d66102eef22baa128b3b3233fc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,122 @@
+{
+  description = "Fizz.buzz homepage";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    natter = {
+      url = "git+https://code.fizz.buzz/talexander/natter.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    organic_ast_explorer = {
+      url = "git+https://code.fizz.buzz/talexander/organic_ast_explorer.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      natter,
+      organic_ast_explorer,
+    }:
+    let
+      forAllSystems =
+        func:
+        builtins.listToAttrs (
+          map (system: {
+            name = system;
+            value = func system;
+          }) nixpkgs.lib.systems.flakeExposed
+        );
+    in
+    {
+      devShells = forAllSystems (
+        system:
+        let
+          overlays = [
+            natter.overlays.default
+            organic_ast_explorer.overlays.default
+          ];
+          pkgs = import nixpkgs {
+            inherit system overlays;
+          };
+        in
+        {
+          default = pkgs.mkShell {
+            nativeBuildInputs = [
+            ];
+            buildInputs = with pkgs; [
+              pkgs.natter.release
+            ];
+          };
+        }
+      );
+      packages = forAllSystems (
+        system:
+        let
+          overlays = [
+            natter.overlays.default
+            organic_ast_explorer.overlays.default
+          ];
+          pkgs = import nixpkgs {
+            inherit system overlays;
+          };
+          appliedOverlay = self.overlays.default pkgs pkgs;
+          nginx_conf = pkgs.replaceVars "${./docker/server/nginx.conf}" {
+            web_root = appliedOverlay.homepage.release;
+            mime_types = "${pkgs.nginx}/conf/mime.types";
+            headers_include = "${./docker/server/headers.include}";
+          };
+        in
+        rec {
+          default = release;
+          inherit (appliedOverlay.homepage)
+            release
+            ;
+          dependencies = pkgs.symlinkJoin {
+            # This is to enable the docker image to install all the dependencies, cache that layer, and then build the final site after the org source files have been loaded. Without this, every update to the blog posts would result in recompiling everything.
+            name = "homepage-dependencies";
+            paths = appliedOverlay.homepage.dependencies;
+          };
+          docker_env = pkgs.stdenv.mkDerivation {
+            pname = "homepage-docker-env";
+            version = "0.0.0";
+
+            dontUnpack = true;
+
+            installPhase = ''
+              mkdir -p $out
+              cp ${nginx_conf} $out/nginx.conf
+              ln -sf ${pkgs.nginx}/bin/nginx $out/nginx
+            '';
+          };
+        }
+      );
+      overlays.default = final: prev: {
+        homepage = final.lib.makeScope final.newScope (
+          homepageScope:
+          let
+            homepage_private = fetchGit {
+              url = "git@code.fizz.buzz:talexander/homepage_private.git";
+              ref = "main";
+              rev = "89ba9628bf3e596345bc83f59cef5a2943584894";
+            };
+            natter' = (natter.overlays.default final final).natter.release;
+            organic_ast_explorer' =
+              (organic_ast_explorer.overlays.default final final).organic_ast_explorer.release;
+            dependencies = {
+              natter = natter';
+              organic_ast_explorer = organic_ast_explorer';
+              inherit homepage_private;
+            };
+            release = homepageScope.callPackage ./nix/package.nix dependencies;
+          in
+          {
+            inherit release;
+            dependencies = (builtins.attrValues dependencies);
+          }
+        );
+      };
+    };
+}

nix/package.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  pkgs,
+  natter,
+  organic_ast_explorer,
+  homepage_private,
+}:
+let
+
+in
+pkgs.stdenv.mkDerivation rec {
+  pname = "homepage";
+  version = "0.0.0";
+
+  src = lib.cleanSource ../.;
+
+  configurePhase = "";
+
+  buildPhase = ''
+    mkdir -p static/organic/ast_explorer
+    cp ${organic_ast_explorer}/* static/organic/ast_explorer/
+    cp -r ${homepage_private}/static/* static/
+
+    ${natter}/bin/natter build --config natter.toml
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    mv output/* $out/
+  '';
+}

pages/about_me/index.org

@@ -0,0 +1,14 @@
+#+OPTIONS: html-postamble:nil
+#+date: <2023-12-23 Sat>
+#+author: Tom Alexander
+#+email:
+#+language: en
+#+select_tags: export
+#+exclude_tags: noexport
+
+Links:
+- My personal repos: [[https://code.fizz.buzz/talexander][code.fizz.buzz]]
+- LinkedIn: https://www.linkedin.com/in/tom-alexander-b6a18216/
+- GitHub: https://github.com/tomalexander
+- Resume: https://fizz.buzz/tom_alexander_resume.pdf
+- PGP Key: https://fizz.buzz/pgp.asc

posts/2025/02/16/install-sm64ex-steam-deck/index.org

@@ -249,7 +249,7 @@ This will compile sm64ex and install it. But there's two problems we can immedia
 
 We will be solving these by creating a ~.desktop~ file, introducing nixGL, and writing a wrapper script that makes sm64ex launch from within steam gaming mode properly.
 * Adding nixGL
-If we were running NixOS, graphical programs would work out-of-the-box. Unfortunately on other Linux Distributions, we need to wrap our graphical programs so they know where to find the graphics drivers. To perform this wrapping, we will use [[https://github.com/nix-community/nixGL][nixGL]]. To install nixGL we need to add it as an input in our ~flake.nix~, apply its overlay, and add it as an ~extraSpecialArgs~ to have it automatically passed into each module:
+If we were running NixOS, graphical programs would work out-of-the-box. Unfortunately on other Linux distributions, we need to wrap our graphical programs so they know where to find the graphics drivers. To perform this wrapping, we will use [[https://github.com/nix-community/nixGL][nixGL]]. To install nixGL we need to add it as an input in our ~flake.nix~, apply its overlay, and add it as an ~extraSpecialArgs~ to have it automatically passed into each module:
 
 #+begin_src nix
   {

posts/2025/02/21/why-i-use-nixos/index.org

@@ -0,0 +1,19 @@
+#+OPTIONS: html-postamble:nil
+#+title: Why I use NixOS
+#+date: <2025-02-21 Fri>
+#+author: Tom Alexander
+#+email:
+#+language: en
+#+select_tags: export
+#+exclude_tags: noexport
+#+natter_publish: unlisted
+
+This is just a list of situations in which classic Linux distributions have failed me, whereas NixOS would not.
+
+* Package version conflicts
+
+** gsutil on Arch Linux [2025-02-21 Fri]
+[[./files/20250221_gsutil.png]]
+
+** NodeJS on Arch Linux [2025-02-21 Fri]
+[[./files/20250221_nodejs.png]]