haze/nix/image/haze.nix

{
  lib,
  dockerTools,
  php,
  bash,
  nginx,
  blackfire,
  coreutils,
  getent,
  writers,
  shadow,
  runCommand,
  callPackage,
  cronie,
  redis,
  gnused,
  samba,
  wget,
  curl,
  git,
  sqlite-interactive,
  procps,
  gnugrep,
  minio-client,
  sudo,
  su,
  which,
  clamav,
  jq,
  oracle-instantclient,
  debug ? false,
  writeShellApplication,
  vim,
  helix,
  python3Packages,
  dnsmasq,
  frankenphp,
  nushell,
  nix2container,
  buildEnv,
}:
let
  inherit (builtins) toString compareVersions;
  inherit (lib)
    readFile
    getExe
    concatStringsSep
    splitString
    take
    optionals
    ;

  version = (fromTOML (readFile ../../Cargo.toml)).package.version;

  phpVersion = concatStringsSep "." (take 2 (splitString "." php.version));
  phpEnv = callPackage ./php.nix { inherit debug php; };

  bootstrap = writers.writeNuBin "bootstrap" (readFile ./bootstrap);
  shadowSetupScript = writeShellApplication {
    name = "shadow-setup";
    text = dockerTools.shadowSetup;
  };

  baseDirs = runCommand "tmp-dir" { } ''
    mkdir -p $out/tmp
    mkdir -p $out/var/cache/nginx
    mkdir -p $out/var/log/nginx
    mkdir -p $out/var/log/cron
    mkdir -p $out/var/www/html
    mkdir -p $out/var/run
    mkdir -p $out/var/tmp
    mkdir -p $out/run
    mkdir -p $out/conf
    mkdir -p $out/var/spool
  '';
  configs = callPackage ./configs.nix { };
  scripts = callPackage ./scripts.nix { };
  phpunitUnwrapped =
    majorVersion:
    callPackage ./phpunit.nix {
      inherit majorVersion;
      php = phpEnv;
    };

  phpunit = writeShellApplication {
    name = "phpunit";
    runtimeInputs = [ jq ];
    text = ''
      MAJOR=$(jq -r 'first(.require."phpunit/phpunit" | scan("[[:digit:]]+"))' vendor-bin/phpunit/composer.json)
      case "$MAJOR" in
        9)
        PKG=${phpunitUnwrapped "9"}
        ;;
        10)
        PKG=${phpunitUnwrapped "10"}
        ;;
        11)
        PKG=${phpunitUnwrapped "11"}
        ;;
        12)
        PKG=${phpunitUnwrapped "12"}
        ;;
        *)
        PKG=${phpunitUnwrapped "10"}
        ;;
      esac
      "$PKG"/bin/phpunit "$@"
    '';
  };

  certificates = runCommand "scripts" { } ''
    mkdir -p $out
    cp -r ${../../certificates} $out/certificates
  '';
  clamav-data = runCommand "scripts" { } ''
    mkdir -p $out/etc
    mkdir -p $out/var/lib/clamav
    cp ${data/clamav/daily.cvd} $out/var/lib/clamav/daily.cvd
    cp -r ${configs/clamav} $out/etc/clamav
  '';

  basePackages = [
    dockerTools.caCertificates
    dockerTools.usrBinEnv
    bash
    blackfire
    nginx
    coreutils
    shadow
    cronie
    redis
    gnused
    procps
    gnugrep
    minio-client
    sudo
    su
    which
    git
    sqlite-interactive
    clamav
    samba
    wget
    curl
    oracle-instantclient
    vim
    helix
    python3Packages.supervisor
    dnsmasq
    nushell
    getent
    clamav-data
  ];

  phpPackages = [
    phpEnv
    phpEnv.packages.composer
    phpunit
  ]
  ++ optionals ((compareVersions phpVersion "8.2") == 1) [
    (frankenphp.override {
      php = php.withExtensions (
        import ./php-ext.nix {
          inherit lib php;
          enableBlackfire = false;
        }
      );
    })
  ];

  # https://blog.eigenvalue.net/2023-nix2container-everything-once/
  foldImageLayers =
    let
      mergeToLayer =
        priorLayers: component:
        assert builtins.isList priorLayers;
        assert builtins.isAttrs component;
        let
          layer = nix2container.buildLayer (
            component
            // {
              layers = priorLayers;
            }
          );
        in
        priorLayers ++ [ layer ];
    in
    layers: lib.foldl mergeToLayer [ ] layers;
in
nix2container.buildImage {
  name = "icewind1991/haze";
  tag = phpVersion;
  layers = foldImageLayers [
    {
      copyToRoot = buildEnv {
        name = "base";
        paths = basePackages;
        pathsToLink = [
          "/bin"
          "/sbin"
          "/etc"
          "/usr"
          "/conf"
        ];
      };
    }
    {
      copyToRoot = buildEnv {
        name = "php";
        paths = phpPackages;
        pathsToLink = [ "/bin" ];
      };
    }
    {
      copyToRoot = [
        baseDirs
        bootstrap
        configs
        scripts
        certificates
        shadowSetupScript
      ];
      perms = [
        {
          path = baseDirs;
          regex = "/tmp|var/(tmp|run|log/nginx|cache/nginx|spool)";
          mode = "0777";
        }
        {
          path = baseDirs;
          regex = "/etc/nc";
          mode = "0755";
        }
      ];
    }
  ];
  config = {
    Cmd = [ (getExe bootstrap) ];
    Env = [
      "EDITOR=hx"
      "WEBROOT=/var/www/html"
      "HAZE_IMAGE_VERSION=${toString version}"
    ];
    WorkingDir = "/var/www/html";
    Labels = {
      "nl.icewind.haze.version" = toString version;
    };
  };
}