wow

hosts/server/natsu/services/cfwithoutincident.nix

@@ -1,5 +1,75 @@
 { inputs, pkgs, ... }:
 
+let
+  nodeModules = pkgs.stdenvNoCC.mkDerivation {
+    pname = "cfwithoutincident-node-modules";
+    version = "1.0.50";
+    src = inputs.cfwithoutincident;
+
+    nativeBuildInputs = [ pkgs.bun ];
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+      export HOME="$TMPDIR/home"
+      export BUN_INSTALL_CACHE_DIR="$TMPDIR/bun-cache"
+      mkdir -p "$HOME" "$BUN_INSTALL_CACHE_DIR"
+
+      bun install \
+        --frozen-lockfile \
+        --ignore-scripts \
+        --no-progress \
+        --production
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p "$out"
+      cp -R node_modules "$out/"
+
+      runHook postInstall
+    '';
+
+    # Bun dependencies are fetched in this fixed-output derivation, so the
+    # regular build remains network-independent and reproducible.
+    dontFixup = true;
+    outputHash = "sha256-FrYyXCpzunrA92NQ9ffrmjJaPTFiTlCsW8OXdpt4m28=";
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+  };
+
+  cfwithoutincident = pkgs.stdenvNoCC.mkDerivation {
+    pname = "cfwithoutincident";
+    version = "1.0.50";
+    src = inputs.cfwithoutincident;
+
+    nativeBuildInputs = [ pkgs.bun ];
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+      cp -R ${nodeModules}/node_modules .
+      bun build --compile --minify src/index.ts --outfile cfwithoutincident
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      install -Dm755 cfwithoutincident "$out/bin/cfwithoutincident"
+
+      runHook postInstall
+    '';
+
+    dontFixup = true;
+  };
+in
 {
   systemd.services.cfwithoutincident = {
     description = "Cloudflare Status D-Day dashboard";
@@ -11,21 +81,12 @@
       Type = "simple";
       User = "imnyang";
       Group = "users";
-      WorkingDirectory = "/var/lib/cfwithoutincident";
       Environment = [
         "PORT=31774"
       ];
-      ExecStartPre = [
-        "${pkgs.coreutils}/bin/cp -r ${inputs.cfwithoutincident}/. /var/lib/cfwithoutincident/"
-        "${pkgs.bun}/bin/bun install --frozen-lockfile"
-      ];
-      ExecStart = "${pkgs.bun}/bin/bun run src/index.ts";
+      ExecStart = "${cfwithoutincident}/bin/cfwithoutincident";
       Restart = "always";
       RestartSec = 5;
-      StateDirectory = "cfwithoutincident";
-      StateDirectoryMode = "0755";
     };
-
-    path = [ pkgs.bun ];
   };
 }