build(nix): updated nix hashes

update

.dockerignore

@@ -1,14 +0,0 @@
-.env
-/docker-compose.*
-/result*
-/.direnv/
-/build/
-
-# Client
-/client/node_modules/
-/client/.svelte-kit/
-
-# Server
-/server/client/
-/server/tmp/
-/server/build/

.gitea/workflows/check.yaml

@@ -5,29 +5,62 @@ on:
     branches:
       - main
   pull_request:
-    types: [opened, reopened, edited, auto_merge_enabled]
+    types: [opened, reopened, edited, auto_merge_enabled, synchronize]
 
 jobs:
   check:
     name: check
     runs-on: ubuntu-latest
     if: |
-      contains(gitea.event.head_commit.message, 'bump:') == false &&
-      contains(gitea.event.head_commit.message, 'Merge pull request') == false
+      contains(github.event.head_commit.message, 'bump:') == false &&
+      contains(github.event.head_commit.message, 'Merge pull request') == false
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Install Nix
+      - name: Install nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
 
-      - name: Use Cachix
+      - name: Use cachix
         uses: cachix/cachix-action@v16
         with:
           name: trevstack
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
-      - name: Check
-        run: nix flake check
+      - run: nix flake check --accept-flake-config
+
+  push:
+    name: push
+    runs-on: ubuntu-latest
+    needs: check
+    if: ${{ github.event_name != 'pull_request' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: "0"
+
+      # https://github.com/actions/checkout/issues/13
+      - name: Push to Production
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git push origin main:production
+
+  update:
+    name: update
+    runs-on: ubuntu-latest
+    if: ${{ contains(github.event.head_commit.message, 'Merge pull request') }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: "0"
+
+      # https://github.com/actions/checkout/issues/13
+      - name: Push to Production
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git push origin main:production

.gitea/workflows/release.yaml

@@ -9,43 +9,31 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@v31
+      - uses: actions/checkout@v4
+      - uses: ./.actions/init
         with:
-          nix_path: nixpkgs=channel:nixos-unstable
+          token: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
-      - name: Use Cachix
-        uses: cachix/cachix-action@v16
-        with:
-          name: trevstack
-          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
-
-      - name: Check
-        run: nix flake check
+      - run: nix flake check
 
   release:
     runs-on: ubuntu-latest
     needs: check
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Install Nix
+      - name: Install nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
 
-      - name: Use Cachix
+      - name: Use cachix
         uses: cachix/cachix-action@v16
         with:
           name: trevstack
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
-      - name: Build
-        run: >
+      - run: >
           nix build
           .#trevstack-linux-amd64
           .#trevstack-linux-arm64
@@ -54,45 +42,85 @@ jobs:
           .#trevstack-darwin-amd64
           .#trevstack-darwin-arm64
 
-      - name: Release
-        uses: akkuman/gitea-release-action@v1
+      - uses: akkuman/gitea-release-action@v1
         with:
           files: |-
             result*/bin/*
 
-  # https://docs.docker.com/build/ci/github-actions/manage-tags-labels/
   package:
     runs-on: ubuntu-latest
-    needs: release # Wait for binary cache to propagate
+    needs: release
     steps:
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          # list of Docker images to use as base name for tags
-          images: |
-            ${{ gitea.server_url }}/${{ gitea.repository }}
-          # generate Docker tags based on the following events/attributes
-          tags: |
-            type=ref,event=branch
-            type=semver,pattern={{version}}
+      - uses: actions/checkout@v4
 
-      - name: Login to Gitea Container Registry
-        uses: docker/login-action@v3
+      - name: Install nix
+        uses: cachix/install-nix-action@v31
         with:
-          registry: ${{ gitea.server_url }}
-          username: ${{ gitea.actor }}
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - name: Use cachix
+        uses: cachix/cachix-action@v16
+        with:
+          name: trevstack
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ${{ github.server_url }}
+          username: ${{ github.actor }}
           password: ${{ secrets.PAT }}
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Build & load images
+        run: |
+          nix build .#trevstack-linux-amd64-image && ./result | docker load
+          nix build .#trevstack-linux-arm64-image && ./result | docker load
+          nix build .#trevstack-linux-arm-image && ./result | docker load
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Set env
+        shell: bash
+        run: |
+          REGISTRY=$(basename ${{ github.server_url }})
 
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          NR=${{ github.repository }}
+          NAMESPACE="${NR%%/*}"
+          REPOSITORY="${NR##*/}"
+
+          TAG=${{ github.ref_name }}
+          VERSION=${TAG#v}
+
+          echo "REGISTRY=${REGISTRY}" >> $GITHUB_ENV
+          echo "NAMESPACE=${NAMESPACE}" >> $GITHUB_ENV
+          echo "REPOSITORY=${REPOSITORY}" >> $GITHUB_ENV
+          echo "VERSION=${VERSION}" >> $GITHUB_ENV
+
+      - name: Push images
+        shell: bash
+        run: |
+          docker image tag $REPOSITORY:$VERSION-amd64 $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64
+          docker push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64
+
+          docker image tag $REPOSITORY:$VERSION-arm64 $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64
+          docker push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64
+
+          docker image tag $REPOSITORY:$VERSION-arm $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+          docker push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+
+      - name: Push manifest
+        shell: bash
+        run: |
+          docker manifest create $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 --arch amd64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 --arch arm64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm --arch arm
+          docker manifest push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION
+
+          docker manifest create $REGISTRY/$NAMESPACE/$REPOSITORY:latest \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:latest $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 --arch amd64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:latest $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 --arch arm64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:latest $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm --arch arm

.gitea/workflows/update.yaml

@@ -9,54 +9,53 @@ jobs:
   update:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+      - uses: actions/checkout@v4
 
-      - name: Install Nix
+      - name: Install nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
 
-      - name: Use Cachix
+      - name: Use cachix
         uses: cachix/cachix-action@v16
         with:
           name: trevstack
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
       # https://github.com/actions/checkout/issues/13
-      - name: Set Git Config
+      - name: Set git config
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git checkout -B update
 
-      - name: Update
-        run: nix run .#update
+      - run: nix run .#update
 
-      - name: Create Pull Request
+      - name: Create pull request
         env:
           PAT: ${{ secrets.PAT }}
         run: |
+          git push origin update --force
+
           URL="${{ gitea.server_url }}"
           REPO_OWNER_SLASH_NAME="${{ gitea.repository }}"
 
-          if ! git ls-remote --exit-code origin update; then
-            git push origin update --force
+          PRS=$(curl -s -X GET -H "Authorization: token $PAT" \
+            -H "Content-Type: application/json" \
+            "$URL/api/v1/repos/$REPO_OWNER_SLASH_NAME/pulls?state=open")
+          PR_UPDATE=$(echo "$PRS" | jq -cr '.[] | select( .title | contains("update") )')
 
-            PR_RESPONSE=$(curl -s -X POST -H "Authorization: token $PAT" \
+          if [ -z "$PR_UPDATE" ]; then
+            echo "Creating pull request"
+
+            PR_CREATE=$(curl -s -X POST -H "Authorization: token $PAT" \
               -H "Content-Type: application/json" \
               -d '{"title":"update","body":"automatic update","head":"update","base":"main"}' \
-              "https://$URL/api/v1/repos/$REPO_OWNER_SLASH_NAME/pulls")
-            
-            PR_NUMBER=$(echo "$PR_RESPONSE" | jq -r '.number')
+              "$URL/api/v1/repos/$REPO_OWNER_SLASH_NAME/pulls")
+            PR_NUMBER=$(echo "$PR_CREATE" | jq -r '.number')
 
             curl -s -X POST -H "Authorization: token $PAT" \
               -H "Content-Type: application/json" \
               -d '{"Do":"merge","merge_when_checks_succeed":true,"delete_branch_after_merge":true}' \
-              "https://$URL/api/v1/repos/$REPO_OWNER_SLASH_NAME/pulls/$PR_NUMBER/merge"
-
-          else
-            git push origin update --force
+              "$URL/api/v1/repos/$REPO_OWNER_SLASH_NAME/pulls/$PR_NUMBER/merge"
           fi

.github/workflows/check.yaml

@@ -5,7 +5,7 @@ on:
     branches:
       - main
   pull_request:
-    types: [opened, reopened, edited, auto_merge_enabled]
+    types: [opened, reopened, edited, auto_merge_enabled, synchronize]
 
 jobs:
   check:
@@ -15,19 +15,52 @@ jobs:
       contains(github.event.head_commit.message, 'bump:') == false &&
       contains(github.event.head_commit.message, 'Merge pull request') == false
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Install Nix
+      - name: Install nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
 
-      - name: Use Cachix
+      - name: Use cachix
         uses: cachix/cachix-action@v16
         with:
           name: trevstack
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
-      - name: Check
-        run: nix flake check
+      - run: nix flake check --accept-flake-config
+
+  push:
+    name: push
+    runs-on: ubuntu-latest
+    needs: check
+    if: ${{ github.event_name != 'pull_request' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: "0"
+
+      # https://github.com/actions/checkout/issues/13
+      - name: Push to Production
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git push origin main:production
+
+  update:
+    name: update
+    runs-on: ubuntu-latest
+    if: ${{ contains(github.event.head_commit.message, 'Merge pull request') }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: "0"
+
+      # https://github.com/actions/checkout/issues/13
+      - name: Push to Production
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git push origin main:production

.github/workflows/release.yaml

@@ -13,43 +13,31 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Install Nix
+      - name: Install nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
 
-      - name: Use Cachix
+      - name: Use cachix
         uses: cachix/cachix-action@v16
         with:
           name: trevstack
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
-      - name: Check
-        run: nix flake check
+      - run: nix flake check
 
   release:
     runs-on: ubuntu-latest
     needs: check
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@v31
+      - uses: actions/checkout@v4
+      - uses: ./.actions/init
         with:
-          nix_path: nixpkgs=channel:nixos-unstable
+          token: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
-      - name: Use Cachix
-        uses: cachix/cachix-action@v16
-        with:
-          name: trevstack
-          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
-
-      - name: Build
-        run: >
+      - run: >
           nix build
           .#trevstack-linux-amd64
           .#trevstack-linux-arm64
@@ -58,46 +46,86 @@ jobs:
           .#trevstack-darwin-amd64
           .#trevstack-darwin-arm64
 
-      - name: Release
-        uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@v2
         with:
           generate_release_notes: true
           files: |-
             result*/bin/*
 
-  # https://docs.docker.com/build/ci/github-actions/manage-tags-labels/
   package:
     runs-on: ubuntu-latest
-    needs: release # Wait for binary cache to propagate
+    needs: release
     steps:
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          # list of Docker images to use as base name for tags
-          images: |
-            ghcr.io/${{ github.repository }}
-          # generate Docker tags based on the following events/attributes
-          tags: |
-            type=ref,event=branch
-            type=semver,pattern={{version}}
+      - uses: actions/checkout@v4
 
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+      - name: Install nix
+        uses: cachix/install-nix-action@v31
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - name: Use cachix
+        uses: cachix/cachix-action@v16
+        with:
+          name: trevstack
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
+      - uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Build & load images
+        run: |
+          nix build .#trevstack-linux-amd64-image && ./result | docker load
+          nix build .#trevstack-linux-arm64-image && ./result | docker load
+          nix build .#trevstack-linux-arm-image && ./result | docker load
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Set env
+        shell: bash
+        run: |
+          REGISTRY=$(basename ${{ github.server_url }})
 
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          NR=${{ github.repository }}
+          NAMESPACE="${NR%%/*}"
+          REPOSITORY="${NR##*/}"
+
+          TAG=${{ github.ref_name }}
+          VERSION=${TAG#v}
+
+          echo "REGISTRY=${REGISTRY}" >> $GITHUB_ENV
+          echo "NAMESPACE=${NAMESPACE}" >> $GITHUB_ENV
+          echo "REPOSITORY=${REPOSITORY}" >> $GITHUB_ENV
+          echo "VERSION=${VERSION}" >> $GITHUB_ENV
+
+      - name: Push images
+        shell: bash
+        run: |
+          docker image tag $REPOSITORY:$VERSION-amd64 $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64
+          docker push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64
+
+          docker image tag $REPOSITORY:$VERSION-arm64 $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64
+          docker push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64
+
+          docker image tag $REPOSITORY:$VERSION-arm $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+          docker push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+
+      - name: Push manifest
+        shell: bash
+        run: |
+          docker manifest create $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 --arch amd64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 --arch arm64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm --arch arm
+          docker manifest push $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION
+
+          docker manifest create $REGISTRY/$NAMESPACE/$REPOSITORY:latest \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 \
+            $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:latest $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-amd64 --arch amd64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:latest $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm64 --arch arm64
+          docker manifest annotate $REGISTRY/$NAMESPACE/$REPOSITORY:latest $REGISTRY/$NAMESPACE/$REPOSITORY:$VERSION-arm --arch arm

.github/workflows/update.yaml

@@ -13,30 +13,28 @@ jobs:
   update:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Install Nix
+      - name: Install nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
 
-      - name: Use Cachix
+      - name: Use cachix
         uses: cachix/cachix-action@v16
         with:
           name: trevstack
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
       # https://github.com/actions/checkout/issues/13
-      - name: Set Git Config
+      - name: Set git config
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
-      - name: Update
-        run: nix run .#update
+      - run: nix run .#update
 
-      - name: Create Pull Request
+      - name: Create pull request
         id: cpr
         uses: peter-evans/create-pull-request@v7
         with:
@@ -44,7 +42,7 @@ jobs:
           title: update
           body: automatic update
 
-      - name: Enable Automerge
+      - name: Enable automerge
         run: gh pr merge --merge --auto "${{ steps.cpr.outputs.pull-request-number }}"
         env:
           GH_TOKEN: ${{ secrets.PAT }}

.scripts/bump.sh

@@ -19,7 +19,9 @@ echo "${version} -> ${next_version}"
 echo "bumping openapi"
 cd "${git_root}"
 sed -i -e "s/${version}/${next_version}/g" openapi.yaml
+sed -i -e "s/${version}/${next_version}/g" client/static/openapi/openapi.yaml
 git add openapi.yaml
+git add client/static/openapi/openapi.yaml
 
 echo "bumping client"
 cd "${git_root}/client"

.scripts/update.sh

@@ -5,13 +5,14 @@ updated=false
 
 echo "updating nix flake"
 cd "${git_root}"
-nix flake update
+nix flake update --accept-flake-config
 if ! git diff --exit-code flake.lock; then
     git add flake.lock
     git commit -m "build(nix): updated nix dependencies"
 fi
 
 echo "updating protobuf deps"
+cd "${git_root}/proto"
 buf dep update
 if ! git diff --exit-code buf.lock; then
     git add buf.lock

Dockerfile

@@ -1,30 +0,0 @@
-# Nix builder
-FROM nixos/nix:latest AS builder
-
-# Copy our source and setup our working dir.
-COPY . /tmp/build
-WORKDIR /tmp/build
-
-# Build our Nix environment
-RUN nix \
-    --extra-experimental-features "nix-command flakes" \
-    --option filter-syscalls false \
-    --accept-flake-config \
-    build
-
-# Copy the Nix store closure into a directory. The Nix store closure is the
-# entire set of Nix store values that we need for our build.
-RUN mkdir /tmp/nix-store-closure
-RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure
-
-# Final image is based on scratch. We copy a bunch of Nix dependencies
-# but they're fully self-contained so we don't need Nix anymore.
-FROM scratch
-
-WORKDIR /app
-
-# Copy /nix/store
-COPY --from=builder /tmp/nix-store-closure /nix/store
-COPY --from=builder /tmp/build/result /app
-
-CMD ["/app/bin/trevstack"]

README.md

@@ -42,7 +42,7 @@ It's that simple. If you're feeling fancy, install [direnv](https://direnv.net/)
 
 - `nix flake check`: runs all validations
 
-- `buf lint` & `buf generate`: lints and generates code from protocol buffers
+- `buf lint proto` & `buf generate`: lints and generates code from protocol buffers
 
 - `sqlc vet` & `sqlc generate`: verifies and generates code from SQL files
 

buf.gen.yaml

@@ -1,5 +1,8 @@
 version: v2
 clean: true
+inputs:
+  - directory: proto
+
 managed:
   enabled: true
   override:

buf.lock

@@ -1,6 +0,0 @@
-# Generated by buf. DO NOT EDIT.
-version: v2
-deps:
-  - name: buf.build/bufbuild/protovalidate
-    commit: 8976f5be98c146529b1cc15cd2012b60
-    digest: b5:5d513af91a439d9e78cacac0c9455c7cb885a8737d30405d0b91974fe05276d19c07a876a51a107213a3d01b83ecc912996cdad4cddf7231f91379079cf7488d

client/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "trevstack",
 	"private": true,
-	"version": "0.0.33",
+	"version": "0.0.47",
 	"type": "module",
 	"scripts": {
 		"dev": "vite dev",
@@ -17,35 +17,35 @@
 		"@bufbuild/protovalidate": "^0.1.1",
 		"@connectrpc/connect": "^2.0.2",
 		"@connectrpc/connect-web": "^2.0.2",
-		"@eslint/compat": "^1.2.9",
+		"@eslint/compat": "^1.3.0",
 		"@eslint/js": "^9.18.0",
-		"@ianvs/prettier-plugin-sort-imports": "^4.4.1",
+		"@ianvs/prettier-plugin-sort-imports": "^4.4.2",
 		"@lucide/svelte": "^0.479.0",
-		"@scalar/api-reference": "^1.28.33",
+		"@scalar/api-reference": "^1.31.12",
 		"@simplewebauthn/browser": "^13.1.0",
 		"@sveltejs/adapter-static": "^3.0.8",
-		"@sveltejs/kit": "^2.21.0",
-		"@sveltejs/vite-plugin-svelte": "^5.0.3",
-		"@tailwindcss/vite": "^4.1.6",
-		"bits-ui": "^1.4.8",
+		"@sveltejs/kit": "^2.21.5",
+		"@sveltejs/vite-plugin-svelte": "^5.1.0",
+		"@tailwindcss/vite": "^4.1.10",
+		"bits-ui": "^1.8.0",
 		"clsx": "^2.1.1",
-		"eslint": "^9.26.0",
+		"eslint": "^9.29.0",
 		"eslint-config-prettier": "^10.1.5",
-		"eslint-plugin-svelte": "^3.6.0",
-		"globals": "^16.1.0",
-		"mode-watcher": "^1.0.7",
+		"eslint-plugin-svelte": "^3.9.2",
+		"globals": "^16.2.0",
+		"mode-watcher": "^1.0.8",
 		"prettier": "^3.5.3",
-		"prettier-plugin-svelte": "^3.3.3",
-		"prettier-plugin-tailwindcss": "^0.6.11",
-		"svelte": "^5.28.6",
-		"svelte-check": "^4.1.7",
+		"prettier-plugin-svelte": "^3.4.0",
+		"prettier-plugin-tailwindcss": "^0.6.12",
+		"svelte": "^5.34.3",
+		"svelte-check": "^4.2.1",
 		"svelte-sonner": "^0.3.28",
-		"tailwind-merge": "^3.3.0",
+		"tailwind-merge": "^3.3.1",
 		"tailwind-variants": "^1.0.0",
 		"tailwindcss": "^4.0.13",
-		"tw-animate-css": "^1.2.9",
+		"tw-animate-css": "^1.3.4",
 		"typescript": "^5.8.3",
-		"typescript-eslint": "^8.32.1",
+		"typescript-eslint": "^8.34.1",
 		"vite": "^6.3.5"
 	}
 }

client/static/openapi/openapi.yaml

@@ -3,8 +3,8 @@ servers:
   - url: /grpc
 info:
   title: Trevstack API
-  version: 1.0.0
-  description: API for trevstack
+  version: 0.0.33
+  description: API for Trevstack
   contact:
     name: Trev
     email: spam@trev.xyz

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746904237,
-        "narHash": "sha256-3e+AVBczosP5dCLQmMoMEogM57gmZ2qrVSrmq9aResQ=",
+        "lastModified": 1749794982,
+        "narHash": "sha256-Kh9K4taXbVuaLC0IL+9HcfvxsSUx8dPB5s5weJcc9pc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d89fc19e405cb2d55ce7cc114356846a0ee5e956",
+        "rev": "ee930f9755f58096ac6e8ca94a1887e0534e2d81",
         "type": "github"
       },
       "original": {

flake.nix

@@ -21,7 +21,7 @@
     ...
   }: let
     pname = "trevstack";
-    version = "0.0.33";
+    version = "0.0.47";
 
     build-systems = [
       "x86_64-linux"
@@ -83,7 +83,10 @@
         packages = with pkgs; [
           treli.packages."${system}".default
           git
+
+          # Nix
           nix-update
+          alejandra
 
           # Server
           go
@@ -127,7 +130,7 @@
           pname = "check-client";
           inherit version;
           src = ./client;
-          npmDepsHash = "sha256-D+z/ElaZx6FIl7ZSCB7zzjZ3MsOWx6OiZIzrrVnegac=";
+          npmDepsHash = "sha256-rzCBgnR70EHf0bofINyeCjXvjCY4c6alDIq+2g/aKy4=";
           dontNpmInstall = true;
 
           buildPhase = ''
@@ -145,6 +148,7 @@
             sqlfluff
           ];
         } ''
+          HOME=$PWD
           cd ${./server}
           revive -config revive.toml -set_exit_status ./...
           sqlfluff lint
@@ -190,7 +194,7 @@
         client = pkgs.buildNpmPackage {
           inherit pname version;
           src = ./client;
-          npmDepsHash = "sha256-D+z/ElaZx6FIl7ZSCB7zzjZ3MsOWx6OiZIzrrVnegac=";
+          npmDepsHash = "sha256-rzCBgnR70EHf0bofINyeCjXvjCY4c6alDIq+2g/aKy4=";
 
           installPhase = ''
             cp -r build "$out"
@@ -208,11 +212,8 @@
             HOME=$PWD
           '';
         };
-      in
-        {
-          default = server;
-        }
-        // builtins.listToAttrs (builtins.map (x: {
+
+        binaries = builtins.listToAttrs (builtins.map (x: {
             name = "${pname}-${x.GOOS}-${x.GOARCH}";
             value = server.overrideAttrs {
               nativeBuildInputs =
@@ -235,7 +236,28 @@
               '';
             };
           })
-          host-systems)
+          host-systems);
+
+        images = builtins.listToAttrs (builtins.map (x: {
+            name = "${pname}-${x.GOOS}-${x.GOARCH}-image";
+            value = pkgs.dockerTools.streamLayeredImage {
+              name = "${pname}";
+              tag = "${version}-${x.GOARCH}";
+              created = "now";
+              architecture = "${x.GOARCH}";
+              contents = [binaries."${pname}-${x.GOOS}-${x.GOARCH}"];
+              config = {
+                Cmd = ["${binaries."${pname}-${x.GOOS}-${x.GOARCH}"}/bin/${pname}-${x.GOOS}-${x.GOARCH}-${version}"];
+              };
+            };
+          })
+          (builtins.filter (x: x.GOOS == "linux") host-systems));
+      in
+        {
+          default = server;
+        }
+        // binaries
+        // images
     );
   };
 }

openapi.yaml

@@ -3,7 +3,7 @@ servers:
   - url: /grpc
 info:
   title: Trevstack API
-  version: 0.0.33
+  version: 0.0.47
   description: API for Trevstack
   contact:
     name: Trev

proto/buf.lock

@@ -0,0 +1,6 @@
+# Generated by buf. DO NOT EDIT.
+version: v2
+deps:
+  - name: buf.build/bufbuild/protovalidate
+    commit: 9f2d3c737feb481a83375159c0733275
+    digest: b5:19d3b83f7df2d284ff5935f4622d7f27e7464a93c210edb536e92a52bcc69b2a18da1312e96b5461601eba7b3764d5e90321bd62e6966870e7dbc2e4dedd98d6

proto/buf.yaml

@@ -1,6 +1,6 @@
 # For details on buf.yaml configuration, visit https://buf.build/docs/configuration/v2/buf-yaml
 version: v2
 modules:
-  - path: proto
+  - path: .
 deps:
   - buf.build/bufbuild/protovalidate

server/internal/handlers/item/v1/item.go

@@ -12,8 +12,8 @@ import (
 	itemv1 "github.com/spotdemo4/trevstack/server/internal/connect/item/v1"
 	"github.com/spotdemo4/trevstack/server/internal/connect/item/v1/itemv1connect"
 	"github.com/spotdemo4/trevstack/server/internal/interceptors"
+	"github.com/spotdemo4/trevstack/server/internal/putil"
 	"github.com/spotdemo4/trevstack/server/internal/sqlc"
-	"github.com/spotdemo4/trevstack/server/internal/util"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
@@ -80,9 +80,9 @@ func (h *Handler) GetItems(ctx context.Context, req *connect.Request[itemv1.GetI
 	// Get items
 	items, err := h.db.GetItems(ctx, sqlc.GetItemsParams{
 		UserID: userid,
-		Name:   util.NullLike(req.Msg.Filter),
-		Start:  util.NullTimestamp(req.Msg.Start),
-		End:    util.NullTimestamp(req.Msg.End),
+		Name:   putil.NullLike(req.Msg.Filter),
+		Start:  putil.NullTimestamp(req.Msg.Start),
+		End:    putil.NullTimestamp(req.Msg.End),
 		Offset: int64(offset),
 		Limit:  int64(limit),
 	})
@@ -97,9 +97,9 @@ func (h *Handler) GetItems(ctx context.Context, req *connect.Request[itemv1.GetI
 	// Get items count
 	count, err := h.db.GetItemsCount(ctx, sqlc.GetItemsCountParams{
 		UserID: userid,
-		Name:   util.NullLike(req.Msg.Filter),
-		Start:  util.NullTimestamp(req.Msg.Start),
-		End:    util.NullTimestamp(req.Msg.End),
+		Name:   putil.NullLike(req.Msg.Filter),
+		Start:  putil.NullTimestamp(req.Msg.Start),
+		End:    putil.NullTimestamp(req.Msg.End),
 	})
 	if err != nil {
 		return nil, connect.NewError(connect.CodeInternal, err)
@@ -157,8 +157,8 @@ func (h *Handler) UpdateItem(ctx context.Context, req *connect.Request[itemv1.Up
 		// set
 		Name:        req.Msg.Name,
 		Description: req.Msg.Description,
-		Price:       util.NullFloat64(req.Msg.Price),
-		Quantity:    util.NullInt64(req.Msg.Quantity),
+		Price:       putil.NullFloat64(req.Msg.Price),
+		Quantity:    putil.NullInt64(req.Msg.Quantity),
 
 		// where
 		ID:     req.Msg.Id,

server/internal/handlers/user/v1/user.go

@@ -19,8 +19,8 @@ import (
 	userv1 "github.com/spotdemo4/trevstack/server/internal/connect/user/v1"
 	"github.com/spotdemo4/trevstack/server/internal/connect/user/v1/userv1connect"
 	"github.com/spotdemo4/trevstack/server/internal/interceptors"
+	"github.com/spotdemo4/trevstack/server/internal/putil"
 	"github.com/spotdemo4/trevstack/server/internal/sqlc"
-	"github.com/spotdemo4/trevstack/server/internal/util"
 	"golang.org/x/crypto/bcrypt"
 )
 
@@ -96,7 +96,7 @@ func (h *Handler) UpdatePassword(ctx context.Context, req *connect.Request[userv
 
 	// Update password
 	err = h.db.UpdateUser(ctx, sqlc.UpdateUserParams{
-		Password: util.ToPointer(string(hash)),
+		Password: putil.ToPointer(string(hash)),
 		ID:       userid,
 	})
 	if err != nil {

server/internal/putil/pointers.go

@@ -1,4 +1,4 @@
-package util
+package putil
 
 func DerefOrEmpty[T any](val *T) T {
 	if val == nil {

server/internal/putil/sql.go

@@ -1,4 +1,4 @@
-package util
+package putil
 
 import (
 	"fmt"