frontend: add hermetic nix derivation in nix/frontend.nix

Phase 2 of #273. Adds `packages.${system}.frontend` to the flake —
a `buildNpmPackage` derivation that consumes the lockfile committed
in the previous step and produces two static dist trees under $out:

  $out/dashboard/   the hive-c0re dashboard SPA assets
                     (index.html, app.js, dashboard.css, favicon.svg)
  $out/agent/       the per-agent default UI assets
                     (index.html, app.js, stats.html, stats.js,
                      agent.css, screen.html)

The dashboard favicon lives outside the frontend src tree
(branding/hyperhive.svg at the repo root). It's passed in as a
callPackage argument so the hermetic build can grab it.

`npmDepsHash` is set to `lib.fakeHash` — the build will fail on
first attempt with the actual sha256 printed; copy that in. Use
`nix run nixpkgs#prefetch-npm-deps -- frontend/package-lock.json`
to recompute locally without a build round-trip (works from
operator's host; iris's container can't recompute it without
prefetch-npm-deps in PATH).

The Rust crates and NixOS modules continue to use the legacy
include_str! routes; cutover happens in Phase 4.

Refs #273.
This commit is contained in:
iris 2026-05-23 13:05:07 +02:00 committed by Mara
parent 9c7d4df08c
commit c8af7bc70c
2 changed files with 67 additions and 1 deletions

View file

@ -51,12 +51,18 @@
in
{
packages = forAllSystems (
{ naersk-lib, ... }:
{ pkgs, naersk-lib, ... }:
{
default = naersk-lib.buildPackage {
src = ./.;
meta.description = "hyperhive workspace (hive-c0re, hive-ag3nt, hive-m1nd)";
};
# Bundled browser assets — see ./nix/frontend.nix. Output is
# $out/{dashboard,agent}/ which the Rust binaries serve via
# tower_http::ServeDir (wired up in Phase 4 of #273).
frontend = pkgs.callPackage ./nix/frontend.nix {
branding-svg = ./branding/hyperhive.svg;
};
}
);