randogoth/smolboid
1
0
Fork 0
Code Issues Pull requests Projects Releases 4 Packages Wiki Activity Actions

feat: add flake with static build, release app and NixOS module

Browse source 
packages.static is a static musl binary so a low-power deploy target can
fetch a prebuilt one rather than compile Rust; apps.release-static publishes
it to a Forgejo release, guarded on HEAD carrying the version's tag.

fumi-core is a path dependency on ../fumi, which escapes the flake source, so
fumi is vendored as its own input and re-laid beside the source tree in the
store. Over https, not a local path: a flake importing this one has to resolve
this input too when it locks.

services.smolboid runs as a real user rather than DynamicUser, because admit,
block and the fumi bootstrap are operator commands against the same master and
store and need a stable uid to sudo into.
This commit is contained in:
randogoth 2026-10-14 17:20:52 +03:00
parent 21c7cbe4ed
commit f2d2d75063
3 changed files with 482 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

39
README.md
View file

@ -57,6 +57,45 @@ smolboid block --config smolboid.toml tobias@smol.place # withdraw the token
smolboid check /srv/smolboid/data/feeds/tobias.txt # verify a feed's records, nonzero on forged ones
```
## Deploying with Nix
The flake exposes `packages.default`, `packages.static` (a static musl binary,
for deploy targets that should not compile Rust) and `nixosModules.default`:
```nix
{
inputs.smolboid.url = "git+https://code.randogoth.com/randogoth/smolboid.git";
# in your nixosSystem modules:
imports = [ inputs.smolboid.nixosModules.default ];
services.smolboid = {
enable = true;
listen = "127.0.0.1:8098";
baseUrl = "https://smol.place";
smolmailHost = "smol.place";
masterFile = "/run/smolboid/master.key"; # 32 raw bytes, provisioned out of band
};
}
```
The module runs the daemon as a real `smolboid` user rather than under
`DynamicUser`, because `admit`, `block` and the fumi bootstrap are operator
commands against the same master key and store and need a stable uid to
`sudo -u` into. It does not generate or manage the master.
`nix run .#release-static` builds the static binary and publishes it as a
Forgejo release on this repo, tagged from `daemon/Cargo.toml`'s version; it
refuses unless HEAD carries that tag. Needs `FORGEJO_TOKEN` with
`write:repository`.
`fumi-core` is a path dependency on a sibling `../fumi` checkout, which escapes
this repo and so cannot be reached from a flake `src`. The flake vendors fumi
as its own input and re-lays it beside the source tree in the store, the way
bunshin vendors microReticulum. One consequence: `nix build` compiles against
the **locked** fumi rev while `devbox run build` uses the sibling worktree, so
the two can disagree — the lock is the one that ships.
## The author's side
Post by sending the twt as the mail body, from any smolmail client. Fetch the daemon's welcome mail first — it carries the accept token that moves your posts out of the requests tier.