1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

{ depot, pkgs, ... }:

# webchat — minimal E2EE Matrix chat webapp.
#
# Unlike most Go programs in this tree, webchat uses pkgs.buildGoModule rather
# than depot.nix.buildGo.program. Two reasons, both hard blockers:
#
#  1. buildGo.program shells out to `go tool compile` directly and has no way to
#     pass build tags, but webchat *requires* `-tags "fts5 goolm"` (see main.go).
#  2. The dependency closure is 30 modules / 117 packages (gomuks' hicli pulls in
#     mautrix-go, goldmark, chroma, modernc sqlite). Hand-vendoring that into
#     go-deps.nix the way source-forge does would be a huge, brittle artifact.
#
# CGO_ENABLED=0 is deliberate and load-bearing: with the goolm tag the whole
# closure — including SQLite (modernc) and olm — is pure Go, so this builds
# statically with no libolm/libstdc++ on the target.

pkgs.buildGoModule {
  pname = "webchat";
  version = "0";

  # Explicit allowlist rather than `./.`, so stray local files (test databases,
  # scratch binaries, ./tmp) can never end up in the store path and cause
  # spurious rebuilds. exactSource also errors out if a listed file goes
  # missing, so this list cannot silently rot.
  src = depot.users.Profpatsch.exactSource ./. [
    ./go.mod
    ./go.sum
    ./main.go
    ./media.go
    ./serve.go
    ./templates.go
    ./timeline.go
  ];

  vendorHash = "sha256-iKXt+teXLTQ2tVWJ/8jt7N8q4geFnLPhg6/OvCkGtTE=";

  tags = [
    # pkg/hicli/nofts.go refuses to compile without an FTS5 tag; migration 21
    # creates an fts5 virtual table for message search.
    "fts5"
    # Selects mautrix's pure-Go olm implementation; without it, crypto/libolm
    # (cgo, -lolm -lstdc++) gets pulled in and the CGO-free build fails.
    "goolm"
  ];

  env.CGO_ENABLED = 0;

  # Note: go.mod lists github.com/mattn/go-sqlite3 as an indirect dependency
  # even though it is never compiled into the binary. `go mod vendor` (which
  # buildGoModule runs) resolves imports across *all* build constraints, and
  # pkg/hicli/dberror_cgo.go imports it under `//go:build cgo`. It needs to be
  # in go.sum to vendor; with CGO_ENABLED=0 it contributes no code.

  # The Go workspace at the repo root lists modules that don't exist on disk,
  # and would shadow this module's own go.mod anyway.
  env.GOWORK = "off";

  meta = {
    description = "Minimal end-to-end-encrypted Matrix chat webapp";
    longDescription = ''
      A single Go binary that reuses gomuks' pkg/hicli for Matrix sync and E2EE
      and serves a small HTML/SSE frontend on top. Intended to be bound to a
      tailscale address, which is the only trust boundary (no auth layer).

      Note on licensing: gomuks as a whole is AGPL-3.0, but pkg/hicli/** is
      MPL-2.0 and that is the only part webchat imports.
    '';
    mainProgram = "webchat";
  };
}