flake.nix

{
  description = "Nix-built OCI image for exe.dev machines";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    nix-darwin = {
      url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    home-manager = {
      url = "github:nix-community/home-manager/release-26.05";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nixvim = {
      url = "github:nix-community/nixvim/nixos-26.05";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    # Installs and owns the Homebrew prefix itself, so a fresh Mac doesn't need
    # brew pre-installed — the first darwin-rebuild switch bootstraps it. The
    # nix-darwin `homebrew` module only manages an already-installed brew.
    # (No nixpkgs input to follow; it pins Homebrew/brew via its own brew-src.)
    nix-homebrew.url = "github:zhaofengli/nix-homebrew";
    # One `nix fmt` / `nix flake check` gate over the whole tree (nix, python,
    # shell, yaml) instead of nix-only. Config lives in ./treefmt.nix.
    treefmt-nix = {
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    # encore binaries
    encore = {
      url = "github:encoredev/encore-flake";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    inputs@{
      self,
      nixpkgs,
      nix-darwin,
      ...
    }:
    let
      lib = nixpkgs.lib;

      linuxSystems = [
        "x86_64-linux"
        "aarch64-linux"
      ];
      # darwin builds the matching-arch Linux image via the linux-builder VM.
      darwinToLinux = {
        "aarch64-darwin" = "aarch64-linux";
        "x86_64-darwin" = "x86_64-linux";
      };
      allSystems = linuxSystems ++ builtins.attrNames darwinToLinux;
      linuxOf = system: darwinToLinux.${system} or system;

      configFor =
        linuxSystem:
        (import ./modules/exedev {
          pkgs = nixpkgs.legacyPackages.${linuxSystem};
          specialArgs = { inherit inputs; };
        }).eval
          ./hosts/exedev;

      releaseFor = system: import ./packages/release { pkgs = nixpkgs.legacyPackages.${system}; };

      treefmtFor =
        system: inputs.treefmt-nix.lib.evalModule nixpkgs.legacyPackages.${system} ./treefmt.nix;
    in
    {
      # This Mac, configured with a Linux builder VM (so it can build *-linux).
      darwinConfigurations.macbook = nix-darwin.lib.darwinSystem {
        specialArgs = { inherit inputs; };
        modules = [ ./hosts/macbook ];
      };

      # `nix build .#exedev` (base image) or `.#system` (the in-place generation);
      # `.#packages.<sys>.{exedev,system}` for a specific arch.
      packages = lib.genAttrs allSystems (
        system:
        let
          cfg = configFor (linuxOf system);
        in
        {
          exedev = cfg.build.image;
          system = cfg.build.system;
          default = cfg.build.image;
        }
        // releaseFor system
      );

      devShells = lib.genAttrs allSystems (system: {
        default =
          let
            pkgs = nixpkgs.legacyPackages.${system};
          in
          pkgs.mkShell {
            packages = [
              pkgs.gh
              pkgs.gitMinimal
              pkgs.regctl
              pkgs.jujutsu
              pkgs.skopeo
            ]
            ++ lib.attrValues (releaseFor system);
          };
      });

      formatter = lib.genAttrs allSystems (system: (treefmtFor system).config.build.wrapper);

      # `nix flake check` fails if the tree isn't treefmt-clean. CI relies on this
      # instead of a bespoke `nix fmt && git diff` step.
      checks = lib.genAttrs allSystems (system: {
        formatting = (treefmtFor system).config.build.check self;
      });
    };
}