Merge branch 'nix'

.dockerignore

@@ -1,2 +1,5 @@
 **/.git
 **/.gitignore
+/.webhook_bridge
+/result
+**/Dockerfile

.gitignore

@@ -1 +1,2 @@
 output/
+/result

.webhook_bridge/pipeline-build-homepage-staging.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build-homepage-staging
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -44,6 +46,51 @@ spec:
                 #!/usr/bin/env sh
                 set -euo pipefail
                 echo -n "$(date +%s)" | tee $(results.unix-time.path)
+      - name: report-pending
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+            - name: revision
+              value: f914437a46978b95f325f68d791dcf1a35738f60
+            - name: pathInRepo
+              value: task/gitea-set-status/0.1/gitea-set-status.yaml
+        params:
+          - name: CONTEXT
+            value: "$(params.JOB_NAME)"
+          - name: REPO_FULL_NAME
+            value: "$(params.REPO_OWNER)/$(params.REPO_NAME)"
+          - name: GITEA_HOST_URL
+            value: code.fizz.buzz
+          - name: SHA
+            value: "$(tasks.fetch-repository.results.commit)"
+          - name: DESCRIPTION
+            value: "Build $(params.JOB_NAME) has started"
+          - name: STATE
+            value: pending
+          - name: TARGET_URL
+            value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
+      - name: fetch-repository
+        params:
+          - name: url
+            value: $(params.REPO_URL)
+          - name: revision
+            value: $(params.PULL_BASE_SHA)
+          - name: deleteExisting
+            value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -69,53 +116,6 @@ spec:
             workspace: git-source
         runAfter:
           - fetch-repository
-      - name: report-pending
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/gitea-set-status/0.1/gitea-set-status.yaml
-        runAfter:
-          - fetch-repository
-        params:
-          - name: CONTEXT
-            value: "$(params.JOB_NAME)"
-          - name: REPO_FULL_NAME
-            value: "$(params.REPO_OWNER)/$(params.REPO_NAME)"
-          - name: GITEA_HOST_URL
-            value: code.fizz.buzz
-          - name: SHA
-            value: "$(tasks.fetch-repository.results.commit)"
-          - name: DESCRIPTION
-            value: "Build $(params.JOB_NAME) has started"
-          - name: STATE
-            value: pending
-          - name: TARGET_URL
-            value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
-      - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
-        params:
-          - name: url
-            value: $(params.REPO_URL)
-          - name: revision
-            value: $(params.PULL_BASE_SHA)
-          - name: deleteExisting
-            value: "true"
       - name: build-image
         taskRef:
           resolver: git
@@ -123,7 +123,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -144,6 +144,8 @@ spec:
               - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
               - --opt
               - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
+              - --opt
+              - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
           - name: BUILDKITD_TOML
             value: |
               debug = true
@@ -171,7 +173,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/gitea-set-status/0.1/gitea-set-status.yaml
         params:
@@ -200,7 +202,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/gitea-set-status/0.1/gitea-set-status.yaml
         params:

.webhook_bridge/pipeline-build-homepage.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build-homepage
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -88,7 +90,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/gitea-set-status/0.1/gitea-set-status.yaml
         runAfter:
@@ -115,7 +117,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/git-clone/0.9/git-clone.yaml
         workspaces:
@@ -135,7 +137,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -156,6 +158,8 @@ spec:
               - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
               - --opt
               - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
+              - --opt
+              - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
           - name: BUILDKITD_TOML
             value: |
               debug = true
@@ -183,7 +187,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/gitea-set-status/0.1/gitea-set-status.yaml
         params:
@@ -212,7 +216,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/gitea-set-status/0.1/gitea-set-status.yaml
         params:

.webhook_bridge/pipeline-semver.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: semver
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -74,7 +76,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/gitea-set-status/0.1/gitea-set-status.yaml
         params:
@@ -99,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/git-clone/0.9/git-clone.yaml
         workspaces:
@@ -124,7 +126,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/gitea-set-status/0.1/gitea-set-status.yaml
         params:
@@ -153,7 +155,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/gitea-set-status/0.1/gitea-set-status.yaml
         params:

docker/server/Dockerfile

@@ -1,69 +1,63 @@
 # syntax=docker/dockerfile:1
-ARG ALPINE_VERSION="3.20"
+#
+# Builder
+#
+ARG NIX_SUBSTITUTERS=https://cache.nixos.org
 
+FROM nixos/nix:2.31.3 AS builder
 
+ARG NIX_SUBSTITUTERS
+RUN tee -a /etc/nix/nix.conf <<EOF
+extra-experimental-features = nix-command flakes
+filter-syscalls = false
+substituters = $NIX_SUBSTITUTERS
+EOF
 
-FROM scratch AS private
+RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
-ADD git@code.fizz.buzz:talexander/homepage_private.git /homepage_private
 
+COPY . /tmp/build
+WORKDIR /tmp/build
 
+RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build '.#docker_env'
 
-FROM scratch AS explorer
+# Export the built closure to a folder
-ADD https://code.fizz.buzz/talexander/organic_ast_explorer.git /organic_ast_explorer
+RUN mkdir /tmp/nix-store-closure
+RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure
 
+# Create a folder which will be copied to /tmp in the final image
+RUN install -d -o root -g root -m 0777 will_be_tmp
 
+# Create a folder which will be copied to /nginx in the final image
+RUN install -d -o 1000 -g 1000 -m 0755 will_be_slash_nginx
 
-FROM scratch AS organic
+#
-ADD git@code.fizz.buzz:talexander/organic.git /organic
+# Runner
+#
 
+FROM scratch
 
+WORKDIR /app
 
-FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS organic-build
+ENV PATH="$PATH:/app/bin"
-RUN apk add --no-cache musl-dev make bash
-RUN rustup target add wasm32-unknown-unknown
-RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked cargo install wasm-bindgen-cli
-COPY --link --from=organic /organic /organic
-WORKDIR /organic
-RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked make wasm
 
+COPY --chmod=0644 --chown=0:0 <<EOF /etc/group
+root:x:0:root
+web:x:1000:web
+EOF
 
+COPY --chmod=0644 --chown=0:0 <<EOF /etc/passwd
+root:x:0:0:root:/root:/bin/sh
+web:x:1000:1000::/home/web:/bin/sh
+EOF
 
-FROM node:lts-alpine$ALPINE_VERSION AS explorer-build
+ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
-COPY --link --from=explorer /organic_ast_explorer /organic_ast_explorer
+ENV NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
-COPY --link --from=organic-build /organic /organic
+COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt
-WORKDIR /organic_ast_explorer
-RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/npmcache,sharing=locked npm set cache /npmcache && npm install
-RUN npm run release
 
+COPY --from=builder /tmp/nix-store-closure /nix/store
+COPY --from=builder /tmp/build/result /app
+COPY --from=builder /tmp/build/will_be_tmp /tmp
+COPY --from=builder /tmp/build/will_be_slash_nginx /nginx
 
-
+EXPOSE 8080
-
+CMD ["/app/nginx", "-c", "/app/nginx.conf", "-e", "stderr", "-g", "daemon off;"]
-FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS natter-build
-RUN apk add --no-cache musl-dev
-ADD git@code.fizz.buzz:talexander/natter.git /natter
-WORKDIR /natter
-RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked CARGO_TARGET_DIR=/target cargo build --profile release-lto
-
-
-
-FROM alpine:$ALPINE_VERSION AS natter
-COPY --link --from=natter-build /target/release-lto/natter /usr/bin/
-COPY --link . /source
-COPY --link --from=private /homepage_private/static /source/static/
-COPY --link --from=explorer-build /organic_ast_explorer/dist /source/static/organic/ast_explorer/
-RUN --network=none --mount=type=tmpfs,target=/tmp natter build --config /source/natter.toml
-
-
-
-
-FROM alpine:$ALPINE_VERSION AS server
-
-RUN apk add --no-cache bash nginx
-RUN addgroup web && adduser -D -G web web && install -d -D -o web -g web -m 700 /srv/http/public
-RUN ln -sf /dev/stdout /var/log/nginx/access.log && ln -sf /dev/stderr /var/log/nginx/error.log
-
-COPY --chown=web:web docker/server/nginx.conf /srv/http
-COPY --chown=web:web docker/server/headers.include /srv/http
-COPY --from=natter --chown=web:web /source/output/ /srv/http/public/
-
-ENTRYPOINT ["/usr/sbin/nginx", "-c", "/srv/http/nginx.conf", "-e", "stderr", "-g", "daemon off;"]

docker/server/nginx.conf

@@ -4,7 +4,8 @@ worker_processes 4;
 # Speed up regular expressions.
 pcre_jit on;
 
-error_log stderr debug;
+error_log /dev/stderr debug;
+pid /nginx/nginx.pid;
 
 events {
     # Connections per worker process.
@@ -12,7 +13,9 @@ events {
 }
 
 http {
-    include /etc/nginx/mime.types;
+    access_log /dev/stdout;
+
+    include @mime_types@;
     default_type application/octet-stream;
 
     types {
@@ -24,11 +27,11 @@ http {
     sendfile on;
     tcp_nopush on;
 
-    include headers.include;
+    include @headers_include@;
 
     server {
         listen 8080;
-        root /srv/http/public;
+        root @web_root@;
 
         location / {
             try_files $uri $uri/ =404;
@@ -47,24 +50,24 @@ http {
         }
 
         location /.well-known/ {
-            alias /srv/http/public/well-known/;
+            alias @web_root@/well-known/;
             default_type text/plain;
         }
 
         location /.well-known/openpgpkey/hu/ {
-            alias /srv/http/public/well-known/openpgpkey/fizz.buzz/hu/;
+            alias @web_root@/well-known/openpgpkey/fizz.buzz/hu/;
             default_type        "application/octet-stream";
             add_header          Access-Control-Allow-Origin * always;
         }
 
         location /.well-known/openpgpkey/policy {
-            alias /srv/http/public/well-known/openpgpkey/fizz.buzz/policy;
+            alias @web_root@/well-known/openpgpkey/fizz.buzz/policy;
             default_type        "application/octet-stream";
             add_header          Access-Control-Allow-Origin * always;
         }
 
         location ~ /\.well-known/(?<path>openpgpkey/[^/]+/hu/.*) {
-            alias /srv/http/public/well-known/$path;
+            alias @web_root@/well-known/$path;
             default_type        "application/octet-stream";
             add_header          Access-Control-Allow-Origin * always;
         }

flake.lock

@@ -0,0 +1,136 @@
+{
+  "nodes": {
+    "natter": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1784333070,
+        "narHash": "sha256-3WkxaHOS13vFBtQFBmGIPScQZDNLk5bqCAY9qBJASl0=",
+        "ref": "refs/heads/main",
+        "rev": "faf279292ad20783775d909b96815f7ca2843b85",
+        "revCount": 327,
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/natter.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/natter.git"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1780749050,
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "organic": {
+      "inputs": {
+        "nixpkgs": [
+          "organic_ast_explorer",
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay_2"
+      },
+      "locked": {
+        "lastModified": 1784327891,
+        "narHash": "sha256-kGmXbmpkkiD2FtX7vKNdbL6/p/fvQ9OT2iS/ve55V5I=",
+        "ref": "refs/heads/main",
+        "rev": "336b5d3d5444ad847cd5fbf1490055e733911b57",
+        "revCount": 2010,
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/organic.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/organic.git"
+      }
+    },
+    "organic_ast_explorer": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "organic": "organic"
+      },
+      "locked": {
+        "lastModified": 1784331571,
+        "narHash": "sha256-0AeEsziAEjL/lgrlTu7RvOoylV1hSozo04rfc3Y7q6M=",
+        "ref": "refs/heads/main",
+        "rev": "55b239a3fe0b7a3b70f392be36b9efd49848be03",
+        "revCount": 75,
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/organic_ast_explorer.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/organic_ast_explorer.git"
+      }
+    },
+    "root": {
+      "inputs": {
+        "natter": "natter",
+        "nixpkgs": "nixpkgs",
+        "organic_ast_explorer": "organic_ast_explorer"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "natter",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781407245,
+        "narHash": "sha256-VzJq4MmD0uyNDAceudSe1hHqcQMe9Tau0U4S+5iRGh0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "d5f483210eb016d66102eef22baa128b3b3233fc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
+      "inputs": {
+        "nixpkgs": [
+          "organic_ast_explorer",
+          "organic",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781407245,
+        "narHash": "sha256-VzJq4MmD0uyNDAceudSe1hHqcQMe9Tau0U4S+5iRGh0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "d5f483210eb016d66102eef22baa128b3b3233fc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,115 @@
+{
+  description = "Fizz.buzz homepage";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    natter = {
+      url = "git+https://code.fizz.buzz/talexander/natter.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    organic_ast_explorer = {
+      url = "git+https://code.fizz.buzz/talexander/organic_ast_explorer.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      natter,
+      organic_ast_explorer,
+    }:
+    let
+      forAllSystems =
+        func:
+        builtins.listToAttrs (
+          map (system: {
+            name = system;
+            value = func system;
+          }) nixpkgs.lib.systems.flakeExposed
+        );
+    in
+    {
+      devShells = forAllSystems (
+        system:
+        let
+          overlays = [
+            natter.overlays.default
+            organic_ast_explorer.overlays.default
+          ];
+          pkgs = import nixpkgs {
+            inherit system overlays;
+          };
+        in
+        {
+          default = pkgs.mkShell {
+            nativeBuildInputs = [
+            ];
+            buildInputs = with pkgs; [
+              pkgs.natter.release
+            ];
+          };
+        }
+      );
+      packages = forAllSystems (
+        system:
+        let
+          overlays = [
+            natter.overlays.default
+            organic_ast_explorer.overlays.default
+          ];
+          pkgs = import nixpkgs {
+            inherit system overlays;
+          };
+          appliedOverlay = self.overlays.default pkgs pkgs;
+          nginx_conf = pkgs.replaceVars "${./docker/server/nginx.conf}" {
+            web_root = appliedOverlay.homepage.release;
+            mime_types = "${pkgs.nginx}/conf/mime.types";
+            headers_include = "${./docker/server/headers.include}";
+          };
+        in
+        rec {
+          default = release;
+          inherit (appliedOverlay.homepage)
+            release
+            ;
+          docker_env = pkgs.stdenv.mkDerivation {
+            pname = "homepage-docker-env";
+            version = "0.0.0";
+
+            dontUnpack = true;
+
+            installPhase = ''
+              mkdir -p $out
+              cp ${nginx_conf} $out/nginx.conf
+              ln -sf ${pkgs.nginx}/bin/nginx $out/nginx
+            '';
+          };
+        }
+      );
+      overlays.default = final: prev: {
+        homepage = final.lib.makeScope final.newScope (
+          homepageScope:
+          let
+            homepage_private = fetchGit {
+              url = "git@code.fizz.buzz:talexander/homepage_private.git";
+              ref = "main";
+              rev = "89ba9628bf3e596345bc83f59cef5a2943584894";
+            };
+            natter' = (natter.overlays.default final final).natter.release;
+            organic_ast_explorer' =
+              (organic_ast_explorer.overlays.default final final).organic_ast_explorer.release;
+            release = homepageScope.callPackage ./nix/package.nix {
+              natter = natter';
+              organic_ast_explorer = organic_ast_explorer';
+              inherit homepage_private;
+            };
+          in
+          {
+            inherit release;
+          }
+        );
+      };
+    };
+}

nix/package.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  pkgs,
+  natter,
+  organic_ast_explorer,
+  homepage_private,
+}:
+let
+
+in
+pkgs.stdenv.mkDerivation rec {
+  pname = "homepage";
+  version = "0.0.0";
+
+  src = lib.cleanSource ../.;
+
+  configurePhase = "";
+
+  buildPhase = ''
+    mkdir -p static/organic/ast_explorer
+    cp ${organic_ast_explorer}/* static/organic/ast_explorer/
+    cp -r ${homepage_private}/static/* static/
+
+    ${natter}/bin/natter build --config natter.toml
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    mv output/* $out/
+  '';
+}

static/png_svg.html

@@ -1,8 +0,0 @@
-<html>
-  <body>
-    <svg style="width:18px; height:18px; fill: #7e7e7e;">
-      <path d="M10.1784 2.06433C10.53 1.71277 11.1009 1.71277 11.4525 2.06433L15.9525 6.56433C16.3041 6.91589 16.3041 7.48683 15.9525 7.83839C15.6009 8.18996 15.03 8.18996 14.6784 7.83839L14.3831 7.54308L11.6212 10.7662C11.9559 11.8912 11.8687 13.1287 11.3203 14.2312L11.2809 14.31C11.1516 14.5687 10.9069 14.7487 10.62 14.7965C10.3331 14.8443 10.0434 14.7487 9.83812 14.5434L3.47343 8.17589C3.26812 7.97058 3.17531 7.68089 3.22031 7.39402C3.26531 7.10714 3.44812 6.86246 3.70687 6.73308L3.78562 6.69371C4.88531 6.14246 6.12281 6.05527 7.25062 6.39277L10.4737 3.63089L10.1784 3.33558C9.82687 2.98402 9.82687 2.41308 10.1784 2.06152V2.06433ZM2.07844 14.6643L5.0625 11.6775L6.33656 12.9515L3.34968 15.9356C2.99812 16.2871 2.42719 16.2871 2.07562 15.9356C1.72406 15.584 1.72406 15.0131 2.07562 14.6615L2.07844 14.6643Z" />
-    </svg>
-    <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABIAAAASCAYAAABWzo5XAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAD5SURBVHgBvZThEYIwDIXT4gC4gSPoBjqCG+gEngsgZQFHcAU3YAU2kA3sAoCvUE4KofQXucsdTdsvLyFAtLalaRr79gUFQuq6/uKxkFKesNbjMzIQZC4W8D2AOacuCJQkycNA7JKFiQUlcdM0T/iF2XbKFKOLu6qqbn12IURMfyXkg22GUUBeuHykMGt7BjfJtNOjKIruJhgAUVmWHaBmCzWlCUx6hI22mTbTxKD4rZQ6j+OSAbV1zygrAboycRbU1czDNDeME5Cd4NyWpj3K5kE9hLo3oW12p0yUVSyCBhBn0HqYaTJczYGEPbwD6EOejzLYln4Tq9kPB4t8gxYYsgwAAAAASUVORK5CYII=" />
-  </body>
-</html>