build: add Nix flake and NixOS module for reproducible builds
- flake.nix: devShell, frontend package, backend package, combined default - spatial-office.nix: standalone NixOS module for importing into n97 config - packages/frontend: React + @react-three/fiber + Zustand (Vite build) - packages/backend: Node.js + ws + Zod (WebSocket server, port 18790) - pnpm-workspace.yaml: monorepo workspace config nix build .#frontend — bundled static site nix build .#backend — runnable WebSocket server nix build — full spatial-office application nix develop — dev shell with Node.js 22 + pnpm
This commit is contained in:
parent
0d3879b02f
commit
bb06f2c48c
15 changed files with 1464 additions and 0 deletions
316
flake.nix
Normal file
316
flake.nix
Normal file
|
|
@ -0,0 +1,316 @@
|
|||
{
|
||||
description = "Spatial Office — isometric collaborative workspace for agents and humans";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
flake-utils.url = "github:numtide/flake-utils";
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, flake-utils }:
|
||||
flake-utils.lib.eachDefaultSystem (system:
|
||||
let
|
||||
pkgs = import nixpkgs { inherit system; };
|
||||
|
||||
# ── Node.js 22 toolchain ──────────────────────────────────────
|
||||
nodeToolchain = with pkgs; [
|
||||
nodejs_22
|
||||
corepack_22
|
||||
];
|
||||
|
||||
# ── Frontend package ──────────────────────────────────────────
|
||||
# React + @react-three/fiber + Zustand, built with Vite
|
||||
frontend = pkgs.buildNpmPackage {
|
||||
name = "spatial-office-frontend";
|
||||
version = "0.1.0";
|
||||
|
||||
src = ./packages/frontend;
|
||||
|
||||
npmDepsHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
|
||||
|
||||
nativeBuildInputs = with pkgs; [
|
||||
nodejs_22
|
||||
corepack_22
|
||||
];
|
||||
|
||||
buildPhase = ''
|
||||
runHook preBuild
|
||||
corepack pnpm run build
|
||||
runHook postBuild
|
||||
'';
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
mkdir -p $out
|
||||
cp -r dist/* $out/
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
meta = with pkgs.lib; {
|
||||
description = "Spatial Office frontend — React + Three.js isometric workspace";
|
||||
license = licenses.mit;
|
||||
};
|
||||
};
|
||||
|
||||
# ── Backend package ───────────────────────────────────────────
|
||||
# Node.js + ws + Zod, WebSocket server on port 18790
|
||||
backend = pkgs.buildNpmPackage {
|
||||
name = "spatial-office-backend";
|
||||
version = "0.1.0";
|
||||
|
||||
src = ./packages/backend;
|
||||
|
||||
npmDepsHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
|
||||
|
||||
nativeBuildInputs = with pkgs; [
|
||||
nodejs_22
|
||||
corepack_22
|
||||
];
|
||||
|
||||
buildPhase = ''
|
||||
runHook preBuild
|
||||
corepack pnpm run build
|
||||
runHook postBuild
|
||||
'';
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
mkdir -p $out/lib $out/bin
|
||||
|
||||
# Copy built JS output
|
||||
cp -r dist/* $out/lib/
|
||||
|
||||
# Copy node_modules for runtime deps (ws, zod, etc.)
|
||||
cp -r node_modules $out/lib/
|
||||
|
||||
# Wrapper script
|
||||
cat > $out/bin/spatial-office-backend << 'WRAPPER'
|
||||
#!${pkgs.bash}/bin/bash
|
||||
exec ${pkgs.nodejs_22}/bin/node "$out/lib/index.js" "$@"
|
||||
WRAPPER
|
||||
chmod +x $out/bin/spatial-office-backend
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
meta = with pkgs.lib; {
|
||||
description = "Spatial Office backend — Node.js WebSocket server with OpenClaw bridge";
|
||||
license = licenses.mit;
|
||||
mainProgram = "spatial-office-backend";
|
||||
};
|
||||
};
|
||||
|
||||
# ── Combined package (symlink forest of frontend + backend) ────
|
||||
spatial-office = pkgs.buildEnv {
|
||||
name = "spatial-office";
|
||||
version = "0.1.0";
|
||||
paths = [ frontend backend ];
|
||||
meta = with pkgs.lib; {
|
||||
description = "Spatial Office — full application (frontend + backend)";
|
||||
license = licenses.mit;
|
||||
};
|
||||
};
|
||||
|
||||
in
|
||||
{
|
||||
packages = {
|
||||
inherit frontend backend;
|
||||
default = spatial-office;
|
||||
};
|
||||
|
||||
devShells = {
|
||||
default = pkgs.mkShell {
|
||||
name = "spatial-office-dev";
|
||||
buildInputs = nodeToolchain ++ (with pkgs; [ ]);
|
||||
|
||||
shellHook = ''
|
||||
echo ""
|
||||
echo "🏢 Spatial Office dev shell"
|
||||
echo " pnpm install — install workspace dependencies"
|
||||
echo " pnpm dev — start frontend + backend in dev mode"
|
||||
echo " pnpm build — production build"
|
||||
echo " nix build — full Nix build"
|
||||
echo ""
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# ── NixOS module ───────────────────────────────────────────────
|
||||
nixosModules = {
|
||||
spatial-office = { config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.spatial-office;
|
||||
in
|
||||
{
|
||||
options.services.spatial-office = {
|
||||
enable = lib.mkEnableOption "Spatial Office service";
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 18790;
|
||||
description = "WebSocket server port";
|
||||
};
|
||||
|
||||
openclawTokenFile = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.path;
|
||||
default = null;
|
||||
description = "File containing the OpenClaw gateway shared token";
|
||||
};
|
||||
|
||||
frontendDir = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "${self.packages.${system}.frontend}";
|
||||
description = "Directory of built frontend static files to serve";
|
||||
};
|
||||
|
||||
logLevel = lib.mkOption {
|
||||
type = lib.types.enum [ "debug" "info" "warn" "error" ];
|
||||
default = "info";
|
||||
description = "Log level for the spatial-office backend";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services.spatial-office = {
|
||||
description = "Spatial Office Backend";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
wants = [ "network.target" ];
|
||||
requires = [ ];
|
||||
|
||||
environment = {
|
||||
PORT = toString cfg.port;
|
||||
SPATIAL_OFFICE_FRONTEND_DIR = cfg.frontendDir;
|
||||
LOG_LEVEL = cfg.logLevel;
|
||||
NODE_ENV = "production";
|
||||
OPENCLAW_GATEWAY_URL = "ws://127.0.0.1:18789";
|
||||
} // (lib.optionalAttrs (cfg.openclawTokenFile != null) {
|
||||
OPENCLAW_TOKEN_FILE = cfg.openclawTokenFile;
|
||||
});
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = "${self.packages.${system}.backend}/bin/spatial-office-backend";
|
||||
Restart = "always";
|
||||
RestartSec = 5;
|
||||
User = "spatial-office";
|
||||
Group = "spatial-office";
|
||||
NoNewPrivileges = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ReadWritePaths = [ ];
|
||||
PrivateTmp = true;
|
||||
PrivateDevices = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectControlGroups = true;
|
||||
MemoryDenyWriteExecute = false; # Node.js needs W^X disabled
|
||||
RestrictRealtime = true;
|
||||
SystemCallFilter = [ "@system-service" "~@privileged" ];
|
||||
};
|
||||
};
|
||||
|
||||
# Service user
|
||||
users.users.spatial-office = {
|
||||
isSystemUser = true;
|
||||
group = "spatial-office";
|
||||
description = "Spatial Office service user";
|
||||
};
|
||||
users.groups.spatial-office = { };
|
||||
|
||||
# ── Nginx reverse proxy to serve frontend static files ──
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts."n97" = lib.mkMerge [
|
||||
(lib.mkIf (config.services.nginx.virtualHosts ? "n97") { })
|
||||
{
|
||||
listen = lib.mkIf (config.services.nginx.virtualHosts ? "n97") [ ];
|
||||
}
|
||||
];
|
||||
virtualHosts."spatial-office" = {
|
||||
listen = [{
|
||||
addr = "0.0.0.0";
|
||||
port = cfg.port;
|
||||
}];
|
||||
root = cfg.frontendDir;
|
||||
locations."/" = {
|
||||
index = "index.html";
|
||||
tryFiles = "$uri $uri/ /index.html";
|
||||
};
|
||||
locations."/ws" = {
|
||||
proxyPass = "http://127.0.0.1:${toString (cfg.port + 1)}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Firewall — open the frontend port
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
};
|
||||
};
|
||||
|
||||
# ── Alias: spatial-office.nix module (just the systemd service, no nginx) ──
|
||||
spatial-office-service = { config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.spatial-office;
|
||||
in
|
||||
{
|
||||
options.services.spatial-office = {
|
||||
enable = lib.mkEnableOption "Spatial Office service";
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 18790;
|
||||
};
|
||||
openclawTokenFile = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.path;
|
||||
default = null;
|
||||
};
|
||||
frontendDir = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "${self.packages.${system}.frontend}";
|
||||
};
|
||||
logLevel = lib.mkOption {
|
||||
type = lib.types.enum [ "debug" "info" "warn" "error" ];
|
||||
default = "info";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services.spatial-office = {
|
||||
description = "Spatial Office Backend";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
|
||||
environment = {
|
||||
PORT = toString cfg.port;
|
||||
SPATIAL_OFFICE_FRONTEND_DIR = cfg.frontendDir;
|
||||
LOG_LEVEL = cfg.logLevel;
|
||||
NODE_ENV = "production";
|
||||
OPENCLAW_GATEWAY_URL = "ws://127.0.0.1:18789";
|
||||
} // (lib.optionalAttrs (cfg.openclawTokenFile != null) {
|
||||
OPENCLAW_TOKEN_FILE = cfg.openclawTokenFile;
|
||||
});
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = "${self.packages.${system}.backend}/bin/spatial-office-backend";
|
||||
Restart = "always";
|
||||
RestartSec = 5;
|
||||
User = "spatial-office";
|
||||
Group = "spatial-office";
|
||||
NoNewPrivileges = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
PrivateTmp = true;
|
||||
};
|
||||
};
|
||||
|
||||
users.users.spatial-office = {
|
||||
isSystemUser = true;
|
||||
group = "spatial-office";
|
||||
};
|
||||
users.groups.spatial-office = { };
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
);
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue