Skip to content

Commit a199b57

Browse files
zimbatmzimbatm
authored
Merge pull request #7 from numtide/feat/hsts
feat: add optional HTTP Strict Transport Security (HSTS) headers
2 parents c00f578 + b745e14 commit a199b57

File tree

15 files changed

+430
-37
lines changed

15 files changed

+430
-37
lines changed

‎.envrc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
use flake

‎.github/workflows/nix.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Nix
2+
on:
3+
push:
4+
branches:
5+
- master
6+
pull_request:
7+
workflow_dispatch:
8+
jobs:
9+
build:
10+
strategy:
11+
matrix:
12+
os: [ ubuntu-20.04 ]
13+
runs-on: ${{ matrix.os }}
14+
steps:
15+
- uses: actions/checkout@v3
16+
- uses: cachix/install-nix-action@v17
17+
- uses: cachix/cachix-action@v10
18+
with:
19+
name: numtide
20+
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
21+
- run: |
22+
export PRJ_ROOT=$PWD
23+
nix-shell --pure --run "just lint"
24+
- run: nix-build
25+
flakes:
26+
strategy:
27+
matrix:
28+
os: [ ubuntu-20.04 ]
29+
runs-on: ${{ matrix.os }}
30+
steps:
31+
- uses: actions/checkout@v3
32+
with:
33+
# Nix Flakes doesn't work on shallow clones
34+
fetch-depth: 0
35+
- uses: cachix/install-nix-action@v17
36+
with:
37+
extra_nix_config: |
38+
experimental-features = nix-command flakes
39+
- uses: cachix/cachix-action@v10
40+
with:
41+
name: numtide
42+
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
43+
- run: nix flake check
44+
- run: nix develop -c echo OK
45+
- name: Run nix flake archive
46+
run: nix flake archive

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
11
/serve-go
2+
/.direnv
3+
/result*

‎default.nix‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
system ? builtins.currentSystem,
3+
inputs ? import ./flake.lock.nix {},
4+
nixpkgs ?
5+
import inputs.nixpkgs {
6+
inherit system;
7+
# Makes the config pure as well. See <nixpkgs>/top-level/impure.nix:
8+
config = {};
9+
overlays = [];
10+
},
11+
buildGoModule ? nixpkgs.buildGoModule,
12+
}: let
13+
serve-go =
14+
buildGoModule
15+
{
16+
name = "serve-go";
17+
src = ./.;
18+
vendorSha256 = null;
19+
meta = with nixpkgs.lib; {
20+
description = "HTTP web server for SPA";
21+
homepage = "https://github.com/numtide/serve-go";
22+
license = licenses.mit;
23+
maintainers = with maintainers; [zimbatm jfroche];
24+
platforms = platforms.linux;
25+
};
26+
};
27+
devShell =
28+
nixpkgs.mkShellNoCC
29+
{
30+
buildInputs = with nixpkgs; [
31+
gofumpt
32+
golangci-lint
33+
alejandra
34+
go
35+
golint
36+
treefmt
37+
just
38+
gcc
39+
];
40+
};
41+
in {
42+
inherit serve-go devShell;
43+
default = serve-go;
44+
}

‎flake.lock‎

Lines changed: 43 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎flake.lock.nix‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
# Adapted from https://github.com/edolstra/flake-compat/blob/master/default.nix
2+
#
3+
# This version only gives back the inputs. In that mode, flake becomes little
4+
# more than a niv replacement.
5+
{src ? ./.}: let
6+
lockFilePath = src + "/flake.lock";
7+
8+
lockFile = builtins.fromJSON (builtins.readFile lockFilePath);
9+
10+
# Emulate builtins.fetchTree
11+
#
12+
# TODO: only implement polyfill if the builtin doesn't exist?
13+
fetchTree = info:
14+
if info.type == "github"
15+
then {
16+
outPath = fetchTarball {
17+
url = "https://api.${info.host or "github.com"}/repos/${info.owner}/${info.repo}/tarball/${info.rev}";
18+
sha256 = info.narHash;
19+
};
20+
rev = info.rev;
21+
shortRev = builtins.substring 0 7 info.rev;
22+
lastModified = info.lastModified;
23+
narHash = info.narHash;
24+
}
25+
else if info.type == "git"
26+
then
27+
{
28+
outPath =
29+
builtins.fetchGit
30+
(
31+
{
32+
url = info.url;
33+
sha256 = info.narHash;
34+
}
35+
// (
36+
if info ? rev
37+
then {inherit (info) rev;}
38+
else {}
39+
)
40+
// (
41+
if info ? ref
42+
then {inherit (info) ref;}
43+
else {}
44+
)
45+
);
46+
lastModified = info.lastModified;
47+
narHash = info.narHash;
48+
}
49+
// (
50+
if info ? rev
51+
then {
52+
rev = info.rev;
53+
shortRev = builtins.substring 0 7 info.rev;
54+
}
55+
else {}
56+
)
57+
else if info.type == "path"
58+
then {
59+
outPath = builtins.path {path = info.path;};
60+
narHash = info.narHash;
61+
}
62+
else if info.type == "tarball"
63+
then {
64+
outPath = fetchTarball {
65+
url = info.url;
66+
sha256 = info.narHash;
67+
};
68+
narHash = info.narHash;
69+
}
70+
else if info.type == "gitlab"
71+
then {
72+
inherit (info) rev narHash lastModified;
73+
outPath = fetchTarball {
74+
url = "https://${info.host or "gitlab.com"}/api/v4/projects/${info.owner}%2F${info.repo}/repository/archive.tar.gz?sha=${info.rev}";
75+
sha256 = info.narHash;
76+
};
77+
shortRev = builtins.substring 0 7 info.rev;
78+
}
79+
else
80+
# FIXME: add Mercurial, tarball inputs.
81+
throw "flake input has unsupported input type '${info.type}'";
82+
83+
allNodes =
84+
builtins.mapAttrs
85+
(
86+
key: node: let
87+
sourceInfo =
88+
if key == lockFile.root
89+
then {}
90+
else fetchTree (node.info or {} // removeAttrs node.locked ["dir"]);
91+
92+
inputs =
93+
builtins.mapAttrs
94+
(inputName: inputSpec: allNodes.${resolveInput inputSpec})
95+
(node.inputs or {});
96+
97+
# Resolve a input spec into a node name. An input spec is
98+
# either a node name, or a 'follows' path from the root
99+
# node.
100+
resolveInput = inputSpec:
101+
if builtins.isList inputSpec
102+
then getInputByPath lockFile.root inputSpec
103+
else inputSpec;
104+
105+
# Follow an input path (e.g. ["dwarffs" "nixpkgs"]) from the
106+
# root node, returning the final node.
107+
getInputByPath = nodeName: path:
108+
if path == []
109+
then nodeName
110+
else
111+
getInputByPath
112+
# Since this could be a 'follows' input, call resolveInput.
113+
(resolveInput lockFile.nodes.${nodeName}.inputs.${builtins.head path})
114+
(builtins.tail path);
115+
116+
result =
117+
sourceInfo
118+
// {
119+
inherit inputs;
120+
inherit sourceInfo;
121+
};
122+
in
123+
if node.flake or true
124+
then result
125+
else sourceInfo
126+
)
127+
lockFile.nodes;
128+
129+
result =
130+
if lockFile.version >= 5 && lockFile.version <= 7
131+
then allNodes.${lockFile.root}.inputs
132+
else throw "lock file '${lockFilePath}' has unsupported version ${toString lockFile.version}";
133+
in
134+
result

‎flake.nix‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
description = "HTTP web server for SPA";
3+
4+
inputs = {
5+
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
6+
flake-utils.url = "github:numtide/flake-utils";
7+
flake-utils.inputs.nixpkgs.follows = "nixpkgs";
8+
};
9+
10+
outputs = {
11+
self,
12+
nixpkgs,
13+
flake-utils,
14+
...
15+
}:
16+
flake-utils.lib.eachSystem ["x86_64-linux"] (
17+
system: let
18+
nixpkgs' = nixpkgs.legacyPackages.${system};
19+
pkgs = import self {
20+
inherit system;
21+
inputs = null;
22+
nixpkgs = nixpkgs';
23+
};
24+
in {
25+
defaultPackage = pkgs.default;
26+
packages = pkgs;
27+
devShells.default = pkgs.devShell;
28+
checks = {
29+
fmt = with nixpkgs';
30+
runCommandLocal "fmt" {} ''
31+
export HOME=$(mktemp -d)
32+
cd ${./.}
33+
${treefmt}/bin/treefmt --fail-on-change > $out
34+
'';
35+
};
36+
}
37+
);
38+
}

‎justfile‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
default:
2+
@just --list
3+
4+
# Format and lint project
5+
fmt:
6+
treefmt
7+
8+
# Build the project
9+
build:
10+
go build .
11+
12+
# Run linters not covered by treefmt
13+
lint:
14+
golangci-lint run

0 commit comments

Comments
 (0)