depot/third_party/default.nix

# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
#
# SPDX-License-Identifier: Apache-2.0

{ depot, system, ... }@ch:
let
  nixpkgsConfig = {
    allowUnfree = true;
    checkMeta = false;
    permittedInsecurePackages = [
      "nodejs-16.20.2"  # for openvscode-server
      "envoy-1.27.3"
      "envoy-1.27.3-deps.tar.gz"

      "python3.11-django-3.2.25"
      "python3.12-django-3.2.25"

      # for authentik?
      "python3.10-requests-2.29.0"
      "python3.10-cryptography-40.0.2"
      "python3.11-requests-2.29.0"
      "python3.11-cryptography-40.0.2"
    ];
    packageOverrides = pkgs: rec {
      factorio = pkgs.factorio.override depot.ops.secrets.factorio;
      factorio-experimental = pkgs.factorio-experimental.override depot.ops.secrets.factorio;
      ntfy = (pkgs.ntfy.override {
        withXmpp = false;
        withSlack = false;
        python39 = pkgs.python3;
      }).overridePythonAttrs (oldAttrs: {
        doCheck = false;
        checkPhase = "";
        patches = oldAttrs.patches ++ [
          ./ntfy-0001-Swap-from-inspect.getargspec-to-inspect.signature-fo.patch
          ./ntfy-0003-Swap-description-file-for-description_file-to-make-s.patch
        ];
      });
      delve = pkgs.delve.overrideAttrs (oldAttrs: {
        meta = oldAttrs.meta // {
          platforms = oldAttrs.meta.platforms ++ [ "aarch64-linux" ];
        };
      });
      sofia_sip = pkgs.sofia_sip.overrideAttrs (oldAttrs: {
        src = pkgs.fetchFromGitHub {
          owner = "lukegb";
          repo = "sofia-sip";
          rev = "2e1e3117f4ab1b7dff7e2a70b238ba2ff7a90d11";  # tls-sni branch
          sha256 = "0llayw2a5nir0zx3hx4wf3kvyjfb5gksxv6wagwfbc0cca5qp1nc";
        };
      });
      freeswitch = pkgs.freeswitch.overrideAttrs (oldAttrs: {
        src = pkgs.fetchFromGitHub {
          owner = "lukegb";
          repo = "freeswitch";
          rev = "4f5a64c7912364ccb1059c64463daf06aaf49745";  # rtp-avpf-moz-variable
          sha256 = "1jdyk6d80jmsg6qn7hw58088yydn78g3kn3lmgg8argihb69pf2i";
        };
      });
      prometheus-ipmi-exporter = pkgs.prometheus-ipmi-exporter.override (old: {
        freeipmi = old.freeipmi.overrideAttrs (oldAttrs: {
          env.NIX_CFLAGS_COMPILE = "-DIPMI_DONT_CHECK_FOR_ROOT";
          enableParallelBuilding = true;
        });
      });
    };
  };
  nixpkgs = import ./nixpkgs {
    inherit system;
    config = nixpkgsConfig;
  };
  crate2nixSrc = nixpkgs.fetchFromGitHub {
    owner = "kolloch";
    repo = "crate2nix";
    rev = "e07af104b8e41d1cd7e41dc7ac3fdcdf4953efae";
    hash = "sha256:07syygn1rc5n1big7hf42pzgm5wc1r0mzglzvlbcb7rkzgqqhbqx";
  };
  naerskSrc = nixpkgs.fetchFromGitHub {
    owner = "nmattia";
    repo = "naersk";
    rev = "e0fe990b478a66178a58c69cf53daec0478ca6f9";
    sha256 = "sha256:0qjyfmw5v7s6ynjns4a61vlyj9cghj7vbpgrp9147ngb1f8krz2c";
  };
  poetry2nixSrcRaw = nixpkgs.fetchFromGitHub {
    owner = "nix-community";
    repo = "poetry2nix";
    rev = "f554d27c1544d9c56e5f1f8e2b8aff399803674e";  # 2024.11.109713
    hash = "sha256-F7N1mxH1VrkVNHR3JGNMRvp9+98KYO4b832KS8Gl2xI=";
  };
  poetry2nixSrc = nixpkgs.runCommand "poetry2nix-patched" {
    patches = [
      ./poetry2nix-rpds-py-0.21.0.patch
    ];
    src = poetry2nixSrcRaw;
  } ''
    cp -R $src $out
    chmod -R +w $out
    cd $out
    for p in $patches; do
      patch -p1 < "$p"
    done
  '';

  tvlDepot = import ./tvl { nixpkgsBisectPath = ./nixpkgs; inherit nixpkgsConfig; nixpkgsSystem = system; };
in
rec {
  inherit nixpkgsConfig nixpkgs;
  nixos = import ./nixpkgs/nixos;
  nixeval = import ./nixpkgs/nixos/lib/eval-config.nix;
  buildGo =
    let orig = import ./tvl/nix/buildGo { pkgs = nixpkgs; inherit gopkgs; };
    in orig // {
      program = { dockerData ? [], ... }@args:
        let
          origOut = orig.program (nixpkgs.lib.filterAttrs (n: v: n != "dockerData") args);
        in origOut // {
          dockerImage = nixpkgs.dockerTools.buildImage {
            name = args.name;
            copyToRoot = nixpkgs.buildEnv {
              name = "${args.name}-env";
              paths = dockerData;
            };
            config = {
              Entrypoint = [ "${origOut}/bin/${args.name}" ];
              Env = [
                "SSL_CERT_FILE=${nixpkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
              ];
            };
          };
        };
    };
  readTree = import ./tvl/nix/readTree {};
  gopkgs = readTree {
    args = ch;
    path = ./gopkgs;
  };

  bat_syntaxes = tvlDepot.third_party.bat_syntaxes;
  cheddar = tvlDepot.tools.cheddar;
  buildGo2 = tvlDepot.nix.buildGo2;
  naersk = nixpkgs.callPackage naerskSrc {};

  crate2nix = import "${crate2nixSrc}" { pkgs = ch.depot.pkgs; };

  poetry2nix = import "${poetry2nixSrc}" { pkgs = ch.depot.pkgs; };

  lanzaboote = import ./lanzaboote.nix { pkgs = nixpkgs; };

  hackyplayerSrc = nixpkgs.fetchFromGitHub {
    owner = "hacks-r-us";
    repo = "hackyplayer";
    rev = "a07cc8d00e358af2375cdbac03db16b3a432917b";
    hash = "sha256-lVEs5kZFJfHvyQfW8aKvHQrDPQkfoR0TsVdLb4CK4iU=";
  };
  hackyplayer = import hackyplayerSrc { pkgs = nixpkgs; };

  nixDarwinSrc = nixpkgs.fetchFromGitHub {
    owner = "LnL7";
    repo = "nix-darwin";
    rev = "fd0e3ed30b75ddf7f3d94829d80a078b413b6244";
    hash = "sha256-KtE4F2wTzIpE6fI9diD5dDkUgGAt7IG80TnFqkCD8Ws=";
  };
  nixDarwinEval = import (nixDarwinSrc + /eval-config.nix);
}