feat: bake a deploy-time server pin into the client via presetServer

nix/bridge.nix

@@ -2,11 +2,23 @@
 # shebang (`uv run --script`) is only for `devbox run serve`; here it runs
 # under a plain interpreter with aiohttp from nixpkgs, so no network access
 # or uv is needed at build or run time — required for the Nix sandbox anyway.
-{ lib, stdenvNoCC, makeWrapper, python3, nix-gitignore }:
+{ lib, stdenvNoCC, makeWrapper, python3, nix-gitignore
+# A server this deployment pre-pins for every first-time visitor (the NixOS
+# module's `presetServer`). Both or neither — see web/js/config.js. Baking a
+# config value into the served JS is a build-time concern, not something
+# bridge.py — "one file, no keys" — should gain runtime logic to do.
+, serverHost ? null
+, serverPublicKey ? null
+}:
 
 let
   pythonEnv = python3.withPackages (ps: [ ps.aiohttp ]);
+  hasPreset = serverHost != null && serverPublicKey != null;
+  presetLine = "export const PRESET_SERVER = "
+    + builtins.toJSON { host = serverHost; publicKey = serverPublicKey; } + ";";
 in
+assert lib.assertMsg ((serverHost == null) == (serverPublicKey == null))
+  "gsmol-bridge: serverHost and serverPublicKey must be set together, or not at all";
 stdenvNoCC.mkDerivation {
   pname = "gsmol-bridge";
   version = "0.1.0";
@@ -30,6 +42,10 @@ stdenvNoCC.mkDerivation {
     cp bridge.py $out/share/gsmol/bridge.py
     cp -r web $out/share/gsmol/web
 
+    ${lib.optionalString hasPreset ''
+      printf '%s\n' ${lib.escapeShellArg presetLine} > $out/share/gsmol/web/js/config.js
+    ''}
+
     makeWrapper ${pythonEnv}/bin/python3 $out/bin/gsmol-bridge \
       --add-flags "$out/share/gsmol/bridge.py" \
       --add-flags "--dir $out/share/gsmol/web"