build(nix): updated nix hashes

update

.dockerignore

@@ -1,14 +0,0 @@
-.env
-/docker-compose.*
-/result*
-/.direnv/
-/build/
-
-# Client
-/client/node_modules/
-/client/.svelte-kit/
-
-# Server
-/server/client/
-/server/tmp/
-/server/build/

.gitea/workflows/check.yaml

@@ -5,7 +5,6 @@ on:
     branches:
       - main
   pull_request:
-    types: [opened, reopened, edited, auto_merge_enabled]
 
 jobs:
   check:
@@ -15,19 +14,52 @@ jobs:
       contains(github.event.head_commit.message, 'bump:') == false &&
       contains(github.event.head_commit.message, 'Merge pull request') == false
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Install Nix
+      - name: Install nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
 
-      - name: Use Cachix
+      - name: Use cachix
         uses: cachix/cachix-action@v16
         with:
           name: trevstack
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
-      - name: Check
-        run: nix flake check
+      - run: nix flake check --accept-flake-config
+
+  push:
+    name: push
+    runs-on: ubuntu-latest
+    needs: check
+    if: ${{ github.event_name != 'pull_request' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: "0"
+
+      # https://github.com/actions/checkout/issues/13
+      - name: Push to Production
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git push origin main:production
+
+  update:
+    name: update
+    runs-on: ubuntu-latest
+    if: ${{ contains(github.event.head_commit.message, 'Merge pull request') }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: "0"
+
+      # https://github.com/actions/checkout/issues/13
+      - name: Push to Production
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git push origin main:production

.gitea/workflows/release.yaml

@@ -9,43 +9,31 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@v31
+      - uses: actions/checkout@v4
+      - uses: ./.actions/init
         with:
-          nix_path: nixpkgs=channel:nixos-unstable
+          token: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
-      - name: Use Cachix
-        uses: cachix/cachix-action@v16
-        with:
-          name: trevstack
-          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
-
-      - name: Check
-        run: nix flake check
+      - run: nix flake check
 
   release:
     runs-on: ubuntu-latest
     needs: check
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Install Nix
+      - name: Install nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
 
-      - name: Use Cachix
+      - name: Use cachix
         uses: cachix/cachix-action@v16
         with:
           name: trevstack
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
-      - name: Build
-        run: >
+      - run: >
           nix build
           .#trevstack-linux-amd64
           .#trevstack-linux-arm64
@@ -54,46 +42,85 @@ jobs:
           .#trevstack-darwin-amd64
           .#trevstack-darwin-arm64
 
-      - name: Release
-        uses: akkuman/gitea-release-action@v1
+      - uses: akkuman/gitea-release-action@v1
         with:
           files: |-
             result*/bin/*
 
-  # https://docs.docker.com/build/ci/github-actions/manage-tags-labels/
   package:
     runs-on: ubuntu-latest
-    needs: release # Wait for binary cache to propagate
+    needs: release
     steps:
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
+      - uses: actions/checkout@v4
+
+      - name: Install nix
+        uses: cachix/install-nix-action@v31
         with:
-          # list of Docker images to use as base name for tags
-          images: |
-            ${{ github.repository }}
-            ghcr.io/${{ github.repository }}
-          # generate Docker tags based on the following events/attributes
-          tags: |
-            type=ref,event=branch
-            type=semver,pattern={{version}}
+          nix_path: nixpkgs=channel:nixos-unstable
 
-      - name: Login to Gitea Container Registry
-        uses: docker/login-action@v3
+      - name: Use cachix
+        uses: cachix/cachix-action@v16
         with:
-          registry: ${{ vars.URL }}
-          username: ${{ vars.USERNAME }}
-          password: ${{ secrets.PASSWORD }}
+          name: trevstack
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - uses: docker/login-action@v3
         with:
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          registry: ${{ github.server_url }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.PAT }}
+
+      - name: Build & load images
+        run: |
+          nix build .#trevstack-linux-amd64-image && ./result | docker load
+          nix build .#trevstack-linux-arm64-image && ./result | docker load
+          nix build .#trevstack-linux-arm-image && ./result | docker load
+
+      - name: Set env
+        shell: bash
+        run: |
+          REGISTRY=$(basename ${{ github.server_url }})
+
+          NR=${{ github.repository }}
+          NAMESPACE="${NR%%/*}"
+          REPOSITORY="${NR##*/}"
+
+          TAG=${{ github.ref_name }}
+          VERSION=${TAG#v}
+
+          echo "REGISTRY=${REGISTRY}" >> $GITHUB_ENV
+          echo "NAMESPACE=${NAMESPACE}" >> $GITHUB_ENV
+          echo "REPOSITORY=${REPOSITORY}" >> $GITHUB_ENV
+          echo "VERSION=${VERSION}" >> $GITHUB_ENV
+
+      - name: Push images
+        shell: bash
+        run: |
+          docker image tag $REPOSITORY:$VERSION-amd64 $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64
+          docker push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64
+
+          docker image tag $REPOSITORY:$VERSION-arm64 $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64
+          docker push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64
+
+          docker image tag $REPOSITORY:$VERSION-arm $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+          docker push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+
+      - name: Push manifest
+        shell: bash
+        run: |
+          docker manifest create $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 --arch amd64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 --arch arm64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm --arch arm
+          docker manifest push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION
+
+          docker manifest create $REGISTRY/$NAMESPACE/$REPOSITORY:latest \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:latest $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 --arch amd64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:latest $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 --arch arm64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:latest $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm --arch arm

.gitea/workflows/update.yaml

@@ -9,31 +9,53 @@ jobs:
   update:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Install Nix
+      - name: Install nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
 
-      - name: Use Cachix
+      - name: Use cachix
         uses: cachix/cachix-action@v16
         with:
           name: trevstack
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
       # https://github.com/actions/checkout/issues/13
-      - name: Set Git Config
+      - name: Set git config
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B update
 
-      - name: Update
-        run: nix run .#update
+      - run: nix run .#update
 
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7
-        with:
-          title: update
-          body: automatic update
+      - name: Create pull request
+        env:
+          PAT: ${{ secrets.PAT }}
+        run: |
+          git push origin update --force
+
+          URL="${{ gitea.server_url }}"
+          REPO_OWNER_SLASH_NAME="${{ gitea.repository }}"
+
+          PRS=$(curl -s -X GET -H "Authorization: token $PAT" \
+            -H "Content-Type: application/json" \
+            "$URL/api/v1/repos/$REPO_OWNER_SLASH_NAME/pulls?state=open")
+          PR_UPDATE=$(echo "$PRS" | jq -cr '.[] | select( .title | contains("update") )')
+
+          if [ -z "$PR_UPDATE" ]; then
+            echo "Creating pull request"
+
+            PR_CREATE=$(curl -s -X POST -H "Authorization: token $PAT" \
+              -H "Content-Type: application/json" \
+              -d '{"title":"update","body":"automatic update","head":"update","base":"main"}' \
+              "$URL/api/v1/repos/$REPO_OWNER_SLASH_NAME/pulls")
+            PR_NUMBER=$(echo "$PR_CREATE" | jq -r '.number')
+
+            curl -s -X POST -H "Authorization: token $PAT" \
+              -H "Content-Type: application/json" \
+              -d '{"Do":"merge","merge_when_checks_succeed":true,"delete_branch_after_merge":true}' \
+              "$URL/api/v1/repos/$REPO_OWNER_SLASH_NAME/pulls/$PR_NUMBER/merge"
+          fi

.github/workflows/check.yaml

@@ -5,7 +5,6 @@ on:
     branches:
       - main
   pull_request:
-    types: [opened, reopened, edited, auto_merge_enabled]
 
 jobs:
   check:
@@ -15,19 +14,52 @@ jobs:
       contains(github.event.head_commit.message, 'bump:') == false &&
       contains(github.event.head_commit.message, 'Merge pull request') == false
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Install Nix
+      - name: Install nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
 
-      - name: Use Cachix
+      - name: Use cachix
         uses: cachix/cachix-action@v16
         with:
           name: trevstack
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
-      - name: Check
-        run: nix flake check
+      - run: nix flake check --accept-flake-config
+
+  push:
+    name: push
+    runs-on: ubuntu-latest
+    needs: check
+    if: ${{ github.event_name != 'pull_request' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: "0"
+
+      # https://github.com/actions/checkout/issues/13
+      - name: Push to Production
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git push origin main:production
+
+  update:
+    name: update
+    runs-on: ubuntu-latest
+    if: ${{ contains(github.event.head_commit.message, 'Merge pull request') }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: "0"
+
+      # https://github.com/actions/checkout/issues/13
+      - name: Push to Production
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git push origin main:production

.github/workflows/release.yaml

@@ -13,43 +13,31 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Install Nix
+      - name: Install nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
 
-      - name: Use Cachix
+      - name: Use cachix
         uses: cachix/cachix-action@v16
         with:
           name: trevstack
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
-      - name: Check
-        run: nix flake check
+      - run: nix flake check
 
   release:
     runs-on: ubuntu-latest
     needs: check
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@v31
+      - uses: actions/checkout@v4
+      - uses: ./.actions/init
         with:
-          nix_path: nixpkgs=channel:nixos-unstable
+          token: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
-      - name: Use Cachix
-        uses: cachix/cachix-action@v16
-        with:
-          name: trevstack
-          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
-
-      - name: Build
-        run: >
+      - run: >
           nix build
           .#trevstack-linux-amd64
           .#trevstack-linux-arm64
@@ -58,53 +46,86 @@ jobs:
           .#trevstack-darwin-amd64
           .#trevstack-darwin-arm64
 
-      - name: Release
-        uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@v2
         with:
           generate_release_notes: true
           files: |-
             result*/bin/*
 
-  # https://docs.docker.com/build/ci/github-actions/manage-tags-labels/
   package:
     runs-on: ubuntu-latest
-    needs: release # Wait for binary cache to propagate
+    needs: release
     steps:
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          # list of Docker images to use as base name for tags
-          images: |
-            ${{ github.repository }}
-            ghcr.io/${{ github.repository }}
-          # generate Docker tags based on the following events/attributes
-          tags: |
-            type=ref,event=branch
-            type=semver,pattern={{version}}
+      - uses: actions/checkout@v4
 
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+      - name: Install nix
+        uses: cachix/install-nix-action@v31
         with:
-          username: ${{ vars.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          nix_path: nixpkgs=channel:nixos-unstable
 
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+      - name: Use cachix
+        uses: cachix/cachix-action@v16
+        with:
+          name: trevstack
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
+      - uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Build & load images
+        run: |
+          nix build .#trevstack-linux-amd64-image && ./result | docker load
+          nix build .#trevstack-linux-arm64-image && ./result | docker load
+          nix build .#trevstack-linux-arm-image && ./result | docker load
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Set env
+        shell: bash
+        run: |
+          REGISTRY=$(basename ${{ github.server_url }})
 
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          NR=${{ github.repository }}
+          NAMESPACE="${NR%%/*}"
+          REPOSITORY="${NR##*/}"
+
+          TAG=${{ github.ref_name }}
+          VERSION=${TAG#v}
+
+          echo "REGISTRY=${REGISTRY}" >> $GITHUB_ENV
+          echo "NAMESPACE=${NAMESPACE}" >> $GITHUB_ENV
+          echo "REPOSITORY=${REPOSITORY}" >> $GITHUB_ENV
+          echo "VERSION=${VERSION}" >> $GITHUB_ENV
+
+      - name: Push images
+        shell: bash
+        run: |
+          docker image tag $REPOSITORY:$VERSION-amd64 $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64
+          docker push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64
+
+          docker image tag $REPOSITORY:$VERSION-arm64 $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64
+          docker push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64
+
+          docker image tag $REPOSITORY:$VERSION-arm $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+          docker push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+
+      - name: Push manifest
+        shell: bash
+        run: |
+          docker manifest create $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 --arch amd64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 --arch arm64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm --arch arm
+          docker manifest push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION
+
+          docker manifest create $REGISTRY/$NAMESPACE/$REPOSITORY:latest \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:latest $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 --arch amd64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:latest $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 --arch arm64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:latest $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm --arch arm

.github/workflows/update.yaml

@@ -13,36 +13,36 @@ jobs:
   update:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Install Nix
+      - name: Install nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
 
-      - name: Use Cachix
+      - name: Use cachix
         uses: cachix/cachix-action@v16
         with:
           name: trevstack
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
       # https://github.com/actions/checkout/issues/13
-      - name: Set Git Config
+      - name: Set git config
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
-      - name: Update
-        run: nix run .#update
+      - run: nix run .#update
 
-      - name: Create Pull Request
+      - name: Create pull request
+        id: cpr
         uses: peter-evans/create-pull-request@v7
         with:
+          branch: update
           title: update
           body: automatic update
 
-      - name: Enable Automerge
-        run: gh pr merge --merge --auto "1"
+      - name: Enable automerge
+        run: gh pr merge --merge --auto "${{ steps.cpr.outputs.pull-request-number }}"
         env:
           GH_TOKEN: ${{ secrets.PAT }}

.scripts/bump.sh

@@ -19,7 +19,9 @@ echo "${version} -> ${next_version}"
 echo "bumping openapi"
 cd "${git_root}"
 sed -i -e "s/${version}/${next_version}/g" openapi.yaml
+sed -i -e "s/${version}/${next_version}/g" client/static/openapi/openapi.yaml
 git add openapi.yaml
+git add client/static/openapi/openapi.yaml
 
 echo "bumping client"
 cd "${git_root}/client"

.scripts/update.sh

@@ -5,13 +5,14 @@ updated=false
 
 echo "updating nix flake"
 cd "${git_root}"
-nix flake update
+nix flake update --accept-flake-config
 if ! git diff --exit-code flake.lock; then
     git add flake.lock
     git commit -m "build(nix): updated nix dependencies"
 fi
 
 echo "updating protobuf deps"
+cd "${git_root}/proto"
 buf dep update
 if ! git diff --exit-code buf.lock; then
     git add buf.lock

.vscode/extensions.json

@@ -2,7 +2,7 @@
   "recommendations": [
     "golang.go",
     "dorzey.vscode-sqlfluff",
-    "zxh404.vscode-proto3",
+    "bufbuild.vscode-buf",
     "dbaeumer.vscode-eslint",
     "svelte.svelte-vscode",
     "esbenp.prettier-vscode"

.vscode/settings.json

@@ -18,8 +18,8 @@
   },
 
   // Proto
-  "[proto3]": {
-    "editor.defaultFormatter": "zxh404.vscode-proto3"
+  "[proto]": {
+    "editor.defaultFormatter": "bufbuild.vscode-buf"
   },
 
   // ESLint

Dockerfile

@@ -1,29 +0,0 @@
-# Nix builder
-FROM nixos/nix:latest AS builder
-
-# Copy our source and setup our working dir.
-COPY . /tmp/build
-WORKDIR /tmp/build
-
-# Build our Nix environment
-RUN nix \
-    --extra-experimental-features "nix-command flakes" \
-    --option filter-syscalls false \
-    --accept-flake-config \
-    build
-
-# Copy the Nix store closure into a directory. The Nix store closure is the
-# entire set of Nix store values that we need for our build.
-RUN mkdir /tmp/nix-store-closure
-RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure
-
-# Final image is based on scratch. We copy a bunch of Nix dependencies
-# but they're fully self-contained so we don't need Nix anymore.
-FROM scratch
-
-WORKDIR /app
-
-# Copy /nix/store
-COPY --from=builder /tmp/nix-store-closure /nix/store
-COPY --from=builder /tmp/build/result /app
-CMD ["/app/bin/trevstack"]

README.md

@@ -7,6 +7,7 @@ This is a CRUD app to use as a template for starting projects
 - **Communicate anywhere**. Define a [protocol buffer](https://protobuf.dev/), and [Connect](https://connectrpc.com/) generates type-safe code to facilitate communication between the server and any client (web, mobile, embedded, etc). The protocol buffers can contain annotations to validate fields on the client and server. For clients that cannot use Connect, an OpenAPI spec is also generated
 - **Build anywhere**. The dev environment, testing and building is all declared in a single [Nix](https://nixos.org/) flake. Every developer and server can use the same environment
 - **Deploy anywhere**. CI/CD is already set up using github actions. New versions are automatically released for every major platform, along with a docker image. The binaries created require zero run-time dependencies and are relatively small (this app is 26 MiB)
+- Can be entirely self-hosted
 - Authentication is rolled in, including API key, fingerprint & passkey
 - Automatic database migration on startup
 - Light & dark modes with the [catppuccin](https://catppuccin.com/palette/) color palette
@@ -27,7 +28,7 @@ URL=http://localhost:5173
 DATABASE_URL=sqlite:/home/trev/.config/trevstack/sqlite.db
 ```
 
-4. Run `treli`
+4. Run `treli` to start the server & client
 
 It's that simple. If you're feeling fancy, install [direnv](https://direnv.net/) and the dev environment will load automatically.
 
@@ -37,11 +38,52 @@ It's that simple. If you're feeling fancy, install [direnv](https://direnv.net/)
 
 - `nix run #bump [major | minor]`: bumps the current version up one. Defaults to "patch" (0.0.1 -> 0.0.2)
 
-- `buf lint` & `buf generate`: Lints and generates code from protocol buffers
+- `nix build [#trevstack-(GOOS)-(GOARCH)]`: builds the application. Defaults to building for your current platform, but can be built to many by specifying the GOOS and GOARCH values
 
-- `sqlc vet` & `sqlc generate`: Verifies and generates code from SQL files
+- `nix flake check`: runs all validations
 
-- `dbmate new` & `dbmate up`: Creates a new migration file and runs pending migrations
+- `buf lint proto` & `buf generate`: lints and generates code from protocol buffers
+
+- `sqlc vet` & `sqlc generate`: verifies and generates code from SQL files
+
+- `dbmate new` & `dbmate up`: creates a new migration file and runs pending migrations
+
+### Github Actions
+
+To use github actions for CI/CD, you'll need to create a fine-grained personal access token for the repository with the permissions:
+
+- Contents (read and write)
+- Pull requests (read and write)
+
+And change some settings for the repository:
+
+- General -> Allow auto-merge: true
+- Rules -> Rulesets -> New ruleset
+  - Branch targeting criteria: Default
+  - Branch rules
+    - Require status checks to pass -> Add checks -> "check"
+- Actions -> General -> Workflow permissions
+  - Read and write permissions: true
+  - Allow GitHub Actions to create and approve pull requests: true
+- Secrets and variables -> Actions -> Repository secrets
+  - PAT: (personal access token)
+
+### Gitea Actions
+
+To use gitea actions for CI/CD, you'll need to create an [API token](https://docs.gitea.com/development/api-usage) with the scopes:
+
+- write:repository
+- write:package
+
+And change some settings for the repository:
+
+- Repository -> Delete pull request branch after merge by default: true
+- Branches -> Add New Rule
+  - Protected Branch Name Pattern: main
+  - Enable Status Check: true
+  - Status check patterns: Check / check\*
+- Actions -> Secrets
+  - PAT: (API token)
 
 ## Components
 

buf.gen.yaml

@@ -1,5 +1,8 @@
 version: v2
 clean: true
+inputs:
+  - directory: proto
+
 managed:
   enabled: true
   override:

buf.lock

@@ -1,6 +0,0 @@
-# Generated by buf. DO NOT EDIT.
-version: v2
-deps:
-  - name: buf.build/bufbuild/protovalidate
-    commit: 8976f5be98c146529b1cc15cd2012b60
-    digest: b5:5d513af91a439d9e78cacac0c9455c7cb885a8737d30405d0b91974fe05276d19c07a876a51a107213a3d01b83ecc912996cdad4cddf7231f91379079cf7488d

client/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "trevstack",
 	"private": true,
-	"version": "0.0.28",
+	"version": "0.0.47",
 	"type": "module",
 	"scripts": {
 		"dev": "vite dev",
@@ -17,35 +17,35 @@
 		"@bufbuild/protovalidate": "^0.1.1",
 		"@connectrpc/connect": "^2.0.2",
 		"@connectrpc/connect-web": "^2.0.2",
-		"@eslint/compat": "^1.2.9",
+		"@eslint/compat": "^1.3.0",
 		"@eslint/js": "^9.18.0",
-		"@ianvs/prettier-plugin-sort-imports": "^4.4.1",
+		"@ianvs/prettier-plugin-sort-imports": "^4.4.2",
 		"@lucide/svelte": "^0.479.0",
-		"@scalar/api-reference": "^1.28.33",
+		"@scalar/api-reference": "^1.31.11",
 		"@simplewebauthn/browser": "^13.1.0",
 		"@sveltejs/adapter-static": "^3.0.8",
-		"@sveltejs/kit": "^2.21.0",
-		"@sveltejs/vite-plugin-svelte": "^5.0.3",
-		"@tailwindcss/vite": "^4.1.6",
-		"bits-ui": "^1.4.8",
+		"@sveltejs/kit": "^2.21.5",
+		"@sveltejs/vite-plugin-svelte": "^5.1.0",
+		"@tailwindcss/vite": "^4.1.10",
+		"bits-ui": "^1.8.0",
 		"clsx": "^2.1.1",
-		"eslint": "^9.26.0",
+		"eslint": "^9.29.0",
 		"eslint-config-prettier": "^10.1.5",
-		"eslint-plugin-svelte": "^3.6.0",
-		"globals": "^16.1.0",
-		"mode-watcher": "^1.0.7",
+		"eslint-plugin-svelte": "^3.9.2",
+		"globals": "^16.2.0",
+		"mode-watcher": "^1.0.8",
 		"prettier": "^3.5.3",
-		"prettier-plugin-svelte": "^3.3.3",
-		"prettier-plugin-tailwindcss": "^0.6.11",
-		"svelte": "^5.28.6",
-		"svelte-check": "^4.1.7",
+		"prettier-plugin-svelte": "^3.4.0",
+		"prettier-plugin-tailwindcss": "^0.6.12",
+		"svelte": "^5.34.3",
+		"svelte-check": "^4.2.1",
 		"svelte-sonner": "^0.3.28",
-		"tailwind-merge": "^3.3.0",
+		"tailwind-merge": "^3.3.1",
 		"tailwind-variants": "^1.0.0",
 		"tailwindcss": "^4.0.13",
-		"tw-animate-css": "^1.2.9",
+		"tw-animate-css": "^1.3.4",
 		"typescript": "^5.8.3",
-		"typescript-eslint": "^8.32.1",
+		"typescript-eslint": "^8.34.1",
 		"vite": "^6.3.5"
 	}
 }

client/static/openapi/openapi.yaml

@@ -3,8 +3,8 @@ servers:
   - url: /grpc
 info:
   title: Trevstack API
-  version: 1.0.0
-  description: API for trevstack
+  version: 0.0.33
+  description: API for Trevstack
   contact:
     name: Trev
     email: spam@trev.xyz

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746904237,
-        "narHash": "sha256-3e+AVBczosP5dCLQmMoMEogM57gmZ2qrVSrmq9aResQ=",
+        "lastModified": 1749794982,
+        "narHash": "sha256-Kh9K4taXbVuaLC0IL+9HcfvxsSUx8dPB5s5weJcc9pc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d89fc19e405cb2d55ce7cc114356846a0ee5e956",
+        "rev": "ee930f9755f58096ac6e8ca94a1887e0534e2d81",
         "type": "github"
       },
       "original": {

flake.nix

@@ -21,7 +21,7 @@
     ...
   }: let
     pname = "trevstack";
-    version = "0.0.28";
+    version = "0.0.47";
 
     build-systems = [
       "x86_64-linux"
@@ -83,7 +83,10 @@
         packages = with pkgs; [
           treli.packages."${system}".default
           git
+
+          # Nix
           nix-update
+          alejandra
 
           # Server
           go
@@ -127,7 +130,7 @@
           pname = "check-client";
           inherit version;
           src = ./client;
-          npmDepsHash = "sha256-BuwxOJZU15lxKMfgrwD5F23ks8A6tWpFwK7KzjrdoRs=";
+          npmDepsHash = "sha256-2c1s0CFR3aWZPq/cO7dtF6ri+XEFdkmjAietktaC9Y0=";
           dontNpmInstall = true;
 
           buildPhase = ''
@@ -190,7 +193,7 @@
         client = pkgs.buildNpmPackage {
           inherit pname version;
           src = ./client;
-          npmDepsHash = "sha256-BuwxOJZU15lxKMfgrwD5F23ks8A6tWpFwK7KzjrdoRs=";
+          npmDepsHash = "sha256-2c1s0CFR3aWZPq/cO7dtF6ri+XEFdkmjAietktaC9Y0=";
 
           installPhase = ''
             cp -r build "$out"
@@ -208,11 +211,8 @@
             HOME=$PWD
           '';
         };
-      in
-        {
-          default = server;
-        }
-        // builtins.listToAttrs (builtins.map (x: {
+
+        binaries = builtins.listToAttrs (builtins.map (x: {
             name = "${pname}-${x.GOOS}-${x.GOARCH}";
             value = server.overrideAttrs {
               nativeBuildInputs =
@@ -235,7 +235,28 @@
               '';
             };
           })
-          host-systems)
+          host-systems);
+
+        images = builtins.listToAttrs (builtins.map (x: {
+            name = "${pname}-${x.GOOS}-${x.GOARCH}-image";
+            value = pkgs.dockerTools.streamLayeredImage {
+              name = "${pname}";
+              tag = "${version}-${x.GOARCH}";
+              created = "now";
+              architecture = "${x.GOARCH}";
+              contents = [binaries."${pname}-${x.GOOS}-${x.GOARCH}"];
+              config = {
+                Cmd = ["${binaries."${pname}-${x.GOOS}-${x.GOARCH}"}/bin/${pname}-${x.GOOS}-${x.GOARCH}-${version}"];
+              };
+            };
+          })
+          (builtins.filter (x: x.GOOS == "linux") host-systems));
+      in
+        {
+          default = server;
+        }
+        // binaries
+        // images
     );
   };
 }

openapi.yaml

@@ -3,7 +3,7 @@ servers:
   - url: /grpc
 info:
   title: Trevstack API
-  version: 0.0.28
+  version: 0.0.47
   description: API for Trevstack
   contact:
     name: Trev

proto/buf.lock

@@ -0,0 +1,6 @@
+# Generated by buf. DO NOT EDIT.
+version: v2
+deps:
+  - name: buf.build/bufbuild/protovalidate
+    commit: 9f2d3c737feb481a83375159c0733275
+    digest: b5:19d3b83f7df2d284ff5935f4622d7f27e7464a93c210edb536e92a52bcc69b2a18da1312e96b5461601eba7b3764d5e90321bd62e6966870e7dbc2e4dedd98d6

proto/buf.yaml

@@ -1,6 +1,6 @@
 # For details on buf.yaml configuration, visit https://buf.build/docs/configuration/v2/buf-yaml
 version: v2
 modules:
-  - path: proto
+  - path: .
 deps:
   - buf.build/bufbuild/protovalidate

server/cmd/trevstack/main.go

@@ -68,7 +68,7 @@ func main() {
 	// Serve gRPC Handlers
 	api := http.NewServeMux()
 	api.Handle(interceptors.WithCORS(user.NewAuthHandler(vi, sqlc, webAuthn, name, env.Key)))
-	api.Handle(interceptors.WithCORS(user.NewHandler(vi, sqlc, webAuthn, env.Key)))
+	api.Handle(interceptors.WithCORS(user.NewHandler(vi, sqlc, webAuthn, name, env.Key)))
 	api.Handle(interceptors.WithCORS(item.NewHandler(vi, sqlc, env.Key)))
 
 	// Serve web interface

server/internal/handlers/item/v1/item.go

@@ -12,8 +12,8 @@ import (
 	itemv1 "github.com/spotdemo4/trevstack/server/internal/connect/item/v1"
 	"github.com/spotdemo4/trevstack/server/internal/connect/item/v1/itemv1connect"
 	"github.com/spotdemo4/trevstack/server/internal/interceptors"
+	"github.com/spotdemo4/trevstack/server/internal/putil"
 	"github.com/spotdemo4/trevstack/server/internal/sqlc"
-	"github.com/spotdemo4/trevstack/server/internal/util"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
@@ -80,9 +80,9 @@ func (h *Handler) GetItems(ctx context.Context, req *connect.Request[itemv1.GetI
 	// Get items
 	items, err := h.db.GetItems(ctx, sqlc.GetItemsParams{
 		UserID: userid,
-		Name:   util.NullLike(req.Msg.Filter),
-		Start:  util.NullTimestamp(req.Msg.Start),
-		End:    util.NullTimestamp(req.Msg.End),
+		Name:   putil.NullLike(req.Msg.Filter),
+		Start:  putil.NullTimestamp(req.Msg.Start),
+		End:    putil.NullTimestamp(req.Msg.End),
 		Offset: int64(offset),
 		Limit:  int64(limit),
 	})
@@ -97,9 +97,9 @@ func (h *Handler) GetItems(ctx context.Context, req *connect.Request[itemv1.GetI
 	// Get items count
 	count, err := h.db.GetItemsCount(ctx, sqlc.GetItemsCountParams{
 		UserID: userid,
-		Name:   util.NullLike(req.Msg.Filter),
-		Start:  util.NullTimestamp(req.Msg.Start),
-		End:    util.NullTimestamp(req.Msg.End),
+		Name:   putil.NullLike(req.Msg.Filter),
+		Start:  putil.NullTimestamp(req.Msg.Start),
+		End:    putil.NullTimestamp(req.Msg.End),
 	})
 	if err != nil {
 		return nil, connect.NewError(connect.CodeInternal, err)
@@ -157,8 +157,8 @@ func (h *Handler) UpdateItem(ctx context.Context, req *connect.Request[itemv1.Up
 		// set
 		Name:        req.Msg.Name,
 		Description: req.Msg.Description,
-		Price:       util.NullFloat64(req.Msg.Price),
-		Quantity:    util.NullInt64(req.Msg.Quantity),
+		Price:       putil.NullFloat64(req.Msg.Price),
+		Quantity:    putil.NullInt64(req.Msg.Quantity),
 
 		// where
 		ID:     req.Msg.Id,

server/internal/handlers/user/v1/user.go

@@ -19,8 +19,8 @@ import (
 	userv1 "github.com/spotdemo4/trevstack/server/internal/connect/user/v1"
 	"github.com/spotdemo4/trevstack/server/internal/connect/user/v1/userv1connect"
 	"github.com/spotdemo4/trevstack/server/internal/interceptors"
+	"github.com/spotdemo4/trevstack/server/internal/putil"
 	"github.com/spotdemo4/trevstack/server/internal/sqlc"
-	"github.com/spotdemo4/trevstack/server/internal/util"
 	"golang.org/x/crypto/bcrypt"
 )
 
@@ -36,6 +36,7 @@ type Handler struct {
 	db       *sqlc.Queries
 	webAuthn *webauthn.WebAuthn
 	key      []byte
+	name     string
 
 	sessions *map[int64]*webauthn.SessionData
 	mu       sync.Mutex
@@ -95,7 +96,7 @@ func (h *Handler) UpdatePassword(ctx context.Context, req *connect.Request[userv
 
 	// Update password
 	err = h.db.UpdateUser(ctx, sqlc.UpdateUserParams{
-		Password: util.ToPointer(string(hash)),
+		Password: putil.ToPointer(string(hash)),
 		ID:       userid,
 	})
 	if err != nil {
@@ -132,7 +133,7 @@ func (h *Handler) GetAPIKey(ctx context.Context, req *connect.Request[userv1.Get
 
 	// Generate JWT
 	t := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.RegisteredClaims{
-		Issuer:  "trevstack",
+		Issuer:  h.name,
 		Subject: strconv.FormatInt(user.ID, 10),
 		IssuedAt: &jwt.NumericDate{
 			Time: time.Now(),
@@ -341,8 +342,8 @@ func transportsToString(transports []protocol.AuthenticatorTransport) string {
 	return s
 }
 
-func NewHandler(vi *validate.Interceptor, db *sqlc.Queries, webauth *webauthn.WebAuthn, key string) (string, http.Handler) {
-	interceptors := connect.WithInterceptors(interceptors.NewAuthInterceptor(key), vi)
+func NewHandler(vi *validate.Interceptor, db *sqlc.Queries, webauth *webauthn.WebAuthn, name string, key string) (string, http.Handler) {
+	interceptors := connect.WithInterceptors(vi, interceptors.NewAuthInterceptor(key))
 
 	sd := map[int64]*webauthn.SessionData{}
 	return userv1connect.NewUserServiceHandler(
@@ -350,6 +351,7 @@ func NewHandler(vi *validate.Interceptor, db *sqlc.Queries, webauth *webauthn.We
 			db:       db,
 			webAuthn: webauth,
 			key:      []byte(key),
+			name:     name,
 
 			sessions: &sd,
 			mu:       sync.Mutex{},

server/internal/putil/pointers.go

@@ -1,4 +1,4 @@
-package util
+package putil
 
 func DerefOrEmpty[T any](val *T) T {
 	if val == nil {

server/internal/putil/sql.go

@@ -1,4 +1,4 @@
-package util
+package putil
 
 import (
 	"fmt"