flake.nix

{
  description = "GloriousFlywheel — pooled build/cache/runner substrate and dashboard";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
    nixpkgs-opentofu.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    flake-utils.url = "github:numtide/flake-utils";

    # Attic binary cache server
    # Don't follow nixpkgs - Attic needs its own nixpkgs with compatible Rust/Nix versions
    attic.url = "github:zhaofengli/attic";

    # OCI image building without Docker daemon
    # Don't follow nixpkgs - nix2container needs its own newer nixpkgs for Go 1.24
    nix2container.url = "github:nlewo/nix2container";

    # Exact prompt-toon Chapel source boundary. This revision's Nix metadata
    # advertises 2.7.0 while the compiler reports 2.8.0 pre-release; preserve
    # both facts until TIN-2807 reconciles provenance and the Chapel 2.9 uplift.
    chapel-nix.url = "github:Jesssullivan/chapel/ab552d88630823a961cca5db5f693b3511234e6c";

    # Treefmt for consistent formatting
    treefmt-nix = {
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = { self, nixpkgs, nixpkgs-opentofu, flake-utils, attic, nix2container, chapel-nix, treefmt-nix }:
    flake-utils.lib.eachDefaultSystem
      (system:
        let
          pkgs = import nixpkgs {
            inherit system;
            overlays = [ self.overlays.default ];
          };
          tofuPkgs = import nixpkgs-opentofu {
            inherit system;
          };
          opentofuTool = tofuPkgs.opentofu;

          # The publisher uses nix2container as a build-time image-copy helper.
          # Its own upstream Go tests are not part of the gf-reapi-cell image
          # contract, and this helper has been OOM-killed on
          # tinyland-nix-heavy before the image can publish. Keep its checks off
          # and its Go compile serial; GF validates the resulting image and
          # publish wrapper separately.
          nix2containerPkgs = nix2container.inputs.nixpkgs.legacyPackages.${system};
          nix2containerBuildPkgs = nix2containerPkgs.extend (_final: prev: {
            buildGoModule = args:
              prev.buildGoModule (args // prev.lib.optionalAttrs ((args.pname or "") == "nix2container") {
                doCheck = false;
                enableParallelBuilding = false;
                env = (args.env or { }) // {
                  GOMAXPROCS = "2";
                };
              });
          });
          n2c = (import nix2container { pkgs = nix2containerBuildPkgs; }).nix2container;

          # Treefmt configuration
          treefmtEval = treefmt-nix.lib.evalModule pkgs {
            projectRootFile = "flake.nix";
            programs = {
              nixpkgs-fmt.enable = true;
              prettier.enable = true;
              shfmt.enable = true;
            };
            settings.formatter.nixpkgs-fmt.excludes = [ "runners/Dockerfile.nix" ];
          };

          # Attic packages from upstream
          atticServer = attic.packages.${system}.attic-server or attic.packages.${system}.default;
          atticClient = attic.packages.${system}.attic or attic.packages.${system}.attic-client;

          # Compatibility wrapper for Bazel entrypoints. Normal repo usage
          # goes through `just bazel-build-cached` with BAZEL_REMOTE_CACHE set.
          bazelWrapper = pkgs.writeShellScriptBin "bazel" ''
            exec ${pkgs.bazelisk}/bin/bazelisk "$@"
          '';

          # Chapel is staged in the worker image as a pinned runtime closure,
          # not as broad language-family eligibility. The first consumer proof
          # is prompt-toon's no-cache ChapelCompile action under TIN-2949.
          gfChapelUpstreamPackage = chapel-nix.packages.${system}.chapel-system-llvm;
          gfChapelCompilerBuildProfile = "OPTIMIZE=0 DEBUG=0";
          gfChapelBoundBuildPhase = buildPhase:
            let
              upstreamBuildCommand = "make -j$NIX_BUILD_CORES";
              buildPhaseLines = pkgs.lib.splitString "\n" buildPhase;
              matchingBuildCommands = builtins.filter
                (line: line == upstreamBuildCommand)
                buildPhaseLines;
            in
            assert builtins.length matchingBuildCommands == 1;
            pkgs.lib.concatStringsSep "\n" (builtins.map
              (line:
                if line == upstreamBuildCommand then
                  "${line} ${gfChapelCompilerBuildProfile}"
                else
                  line)
              buildPhaseLines);
          gfChapelBuildPhaseGuardCheck =
            assert gfChapelBoundBuildPhase "make -j$NIX_BUILD_CORES" ==
            "make -j$NIX_BUILD_CORES ${gfChapelCompilerBuildProfile}";
            assert (builtins.tryEval (gfChapelBoundBuildPhase "echo no match")).success == false;
            assert (builtins.tryEval (gfChapelBoundBuildPhase ''
              make -j$NIX_BUILD_CORES
              make -j$NIX_BUILD_CORES
            '')).success == false;
            true;
          gfChapelPackage =
            assert gfChapelBuildPhaseGuardCheck;
            gfChapelUpstreamPackage.overrideAttrs (oldAttrs: {
              buildPhase = gfChapelBoundBuildPhase oldAttrs.buildPhase;
            });
          gfChapelNixPackageVersion = gfChapelPackage.version or null;
          gfChapelCompilerReportedVersion = "2.8.0 pre-release";
          gfChapelSourceRevision = "ab552d88630823a961cca5db5f693b3511234e6c";
          gfChapelClangRoot = builtins.dirOf (builtins.dirOf gfChapelPackage.CHPL_HOST_CC);
          gfChapelClangResourceInclude = "-I${gfChapelClangRoot}/resource-root/include";
          gfChapelCompilerIncludes =
            "${gfChapelClangResourceInclude} ${gfChapelPackage.CHPL_CLANG_INCLUDES}";
          gfChapelWrapped =
            assert gfChapelNixPackageVersion == "2.7.0";
            pkgs.runCommand "gf-chapel-prompt-toon-ab552d8"
              {
                nativeBuildInputs = [ pkgs.makeWrapper ];
                passthru = {
                  packageVersion = gfChapelNixPackageVersion;
                  compilerReportedVersion = gfChapelCompilerReportedVersion;
                  sourceRevision = gfChapelSourceRevision;
                };
              } ''
              mkdir -p "$out/bin" "$out/share/chapel" "$out/share/gloriousflywheel"
              for item in ${gfChapelPackage}/share/chapel/*; do
                ln -sf "$item" "$out/share/chapel/$(basename "$item")"
              done
              ln -sf ${gfChapelPackage}/lib "$out/share/chapel/lib"
              # Reuse the pinned package's evaluated compiler paths. Pointing
              # these at GF's root nixpkgs adds a second LLVM/Clang closure to
              # every worker image and weakens the source-revision boundary.
              makeWrapper ${gfChapelPackage}/bin/.chpl-wrapped "$out/bin/chpl" \
                --set CHPL_HOME "$out/share/chapel" \
                --set-default CHPL_LLVM "${gfChapelPackage.CHPL_LLVM}" \
                --set-default CHPL_LLVM_CONFIG "${gfChapelPackage.CHPL_LLVM_CONFIG}" \
                --set-default CHPL_HOST_COMPILER "${gfChapelPackage.CHPL_HOST_COMPILER}" \
                --set-default CHPL_HOST_CC "${gfChapelPackage.CHPL_HOST_CC}" \
                --set-default CHPL_HOST_CXX "${gfChapelPackage.CHPL_HOST_CXX}" \
                --set-default CHPL_TARGET_CC "${gfChapelPackage.CHPL_TARGET_CC}" \
                --set-default CHPL_TARGET_CXX "${gfChapelPackage.CHPL_TARGET_CXX}" \
                --set-default CHPL_TARGET_CPU "${gfChapelPackage.CHPL_TARGET_CPU}" \
                --set-default CHPL_CLANG_INCLUDES "${gfChapelCompilerIncludes}" \
                --set-default CHPL_GMP none \
                --set-default CHPL_RE2 bundled \
                --set-default CHPL_UNWIND ${if pkgs.stdenv.isDarwin then "system" else "bundled"} \
                --set-default CHPL_LAUNCHER none \
                --set-default CHPL_COMM none \
                --set-default CHPL_TASKS qthreads \
                --set-default CHPL_TARGET_MEM jemalloc \
                --set-default CHPL_HWLOC bundled \
                --prefix PATH : '${pkgs.lib.makeBinPath [
                  pkgs.coreutils pkgs.gnumake pkgs.pkg-config pkgs.python3 pkgs.which
                ]}' \
                --add-flags '${gfChapelCompilerIncludes}'
              cat > "$out/share/gloriousflywheel/chapel-toolchain.json" <<'EOF'
              ${builtins.toJSON {
                nix_package_version = gfChapelNixPackageVersion;
                compiler_reported_version = gfChapelCompilerReportedVersion;
                compiler_build_profile = gfChapelCompilerBuildProfile;
                source = "github:Jesssullivan/chapel";
                source_revision = gfChapelSourceRevision;
                consumer_issue = "TIN-2949";
                eligibility = "worker-image-candidate-not-broad-rbe";
              }}
              EOF
            '';

          # Exposed only as a remote Linux proof package. It executes the
          # compiler and must never become a local Darwin iteration path.
          gfChapelToolchainCheck = pkgs.runCommand "gf-chapel-toolchain-check"
            {
              nativeBuildInputs = [ gfChapelWrapped ];
            } ''
            version_line="$(chpl --version | head -n 1)"
            case "$version_line" in
              *"version ${gfChapelCompilerReportedVersion}"*) ;;
              *)
                echo "unexpected Chapel version: $version_line" >&2
                exit 1
                ;;
            esac
            cat > smoke.chpl <<'EOF'
            writeln("GF_CHAPEL_SMOKE");
            EOF
            chpl smoke.chpl -o smoke
            test "$(./smoke)" = "GF_CHAPEL_SMOKE"
            metadata=${gfChapelWrapped}/share/gloriousflywheel/chapel-toolchain.json
            grep -F '"nix_package_version":"${gfChapelNixPackageVersion}"' "$metadata" >/dev/null
            grep -F '"compiler_reported_version":"${gfChapelCompilerReportedVersion}"' "$metadata" >/dev/null
            grep -F '"compiler_build_profile":"${gfChapelCompilerBuildProfile}"' "$metadata" >/dev/null
            grep -F '"source_revision":"${gfChapelSourceRevision}"' "$metadata" >/dev/null
            mkdir -p "$out"
            printf '%s\n' "$version_line" > "$out/version.txt"
            cp "$metadata" "$out/chapel-toolchain.json"
          '';

          # Development tools
          devTools = with pkgs; [
            # Kubernetes tooling
            kubectl
            kubernetes-helm
            k9s
            kustomize

            # Infrastructure as Code
            opentofuTool
            # civo  # REMOVED — Civo cluster decommissioned April 2026

            # Attic client
            atticClient

            # Node.js / SvelteKit tooling
            nodejs_22
            nodePackages.pnpm

            # Nix tooling
            fh # FlakeHub CLI
            nix-prefetch-git
            nix-tree
            nixpkgs-fmt
            statix
            deadnix

            # Build tooling. Bazel is exposed as `bazel` for compatibility,
            # but the product contract routes routine use through Just.
            bazel-buildtools
            bazelWrapper

            # Container tooling
            skopeo
            dive

            # Configuration language (typed tfvars generation)
            dhall
            dhall-json

            # Development utilities
            just
            jq
            yq-go
            just
            direnv
            nix-direnv
            git
            gnumake

            # PostgreSQL client for debugging
            postgresql
          ];

          # Runner Dashboard: pnpm build wrapper
          # Source includes workspace root (lockfile, config) + app directory
          runnerDashboardSrc = pkgs.lib.cleanSourceWith {
            src = ./.;
            filter = path: _type:
              let
                baseName = builtins.baseNameOf path;
                relPath = pkgs.lib.removePrefix (toString ./.) path;
              in
              # Workspace root files
              baseName == "package.json"
              || baseName == "pnpm-lock.yaml"
              || baseName == "pnpm-workspace.yaml"
              || baseName == ".npmrc"
              # App directory
              || pkgs.lib.hasPrefix "/app" relPath
              # Config directory (for prebuild script)
              || pkgs.lib.hasPrefix "/config" relPath;
          };

          runnerDashboard = pkgs.stdenv.mkDerivation {
            pname = "runner-dashboard";
            version = "0.1.0";
            src = runnerDashboardSrc;
            nativeBuildInputs = [ pkgs.nodejs_22 pkgs.nodePackages.pnpm ];
            buildPhase = ''
              export HOME=$TMPDIR
              export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
              export NIX_SSL_CERT_FILE=$SSL_CERT_FILE
              export NODE_EXTRA_CA_CERTS=$SSL_CERT_FILE
              # Keep the proof-path dashboard build inside a predictable memory
              # envelope on self-hosted runners.
              export CI=1
              export NODE_OPTIONS="--max_old_space_size=4096"
              export npm_config_jobs=1
              pnpm install --frozen-lockfile --child-concurrency=1 --network-concurrency=16
              cd app
              pnpm build
            '';
            installPhase = ''
              mkdir -p $out
              cp -r build/. $out/
              cp package.json $out/
            '';
          };

          gfReapiGoPackage =
            { pname
            , subPackages
            , mainProgram
            , description
            ,
            }:
            pkgs.buildGo124Module {
              inherit pname subPackages;
              version = "0.1.0";
              src = ./services/gf-reapi-cell;
              vendorHash = "sha256-Rlejt70tckrzgYmRRamanDXfVFbN9MVRiOhW6WwCo9A=";
              ldflags = [
                "-s"
                "-w"
              ];
              meta = {
                inherit description mainProgram;
              };
            };

          gfReapiCell = gfReapiGoPackage {
            pname = "gf-reapi-cell";
            description = "Minimal GloriousFlywheel-owned REAPI proof cell";
            mainProgram = "gf-reapi-cell";
            subPackages = [
              "cmd/gf-reapi-cell"
              "cmd/gf-reapi-credhelper"
              "cmd/gf-reapi-token-exchange"
              "cmd/gf-reapi-worker"
            ];
          };

          gfReapiCredhelper = gfReapiGoPackage {
            pname = "gf-reapi-credhelper";
            description = "Bazel credential helper for gf-reapi-cell bearer tokens";
            mainProgram = "gf-reapi-credhelper";
            subPackages = [ "cmd/gf-reapi-credhelper" ];
          };

          gfReapiTokenExchange = gfReapiGoPackage {
            pname = "gf-reapi-token-exchange";
            description = "GitHub OIDC to gf-reapi-cell JWT/profile exchange helper";
            mainProgram = "gf-reapi-token-exchange";
            subPackages = [ "cmd/gf-reapi-token-exchange" ];
          };

          flywheelConsumerEnv = pkgs.writeShellScriptBin "flywheel-consumer-env" (builtins.readFile ./scripts/flywheel-consumer-env.sh);
          flywheelGithubOidcProfile = pkgs.writeShellScriptBin "flywheel-github-oidc-profile" (builtins.readFile ./scripts/flywheel-github-oidc-profile.sh);
          flywheelDoctor = pkgs.writeShellScriptBin "flywheel-doctor" (builtins.readFile ./scripts/flywheel-doctor.sh);
          flywheelVerify = pkgs.writeShellScriptBin "flywheel-verify" ''
            exec ${flywheelDoctor}/bin/flywheel-doctor --verify "$@"
          '';
          flywheelEnroll = pkgs.writeShellScriptBin "flywheel-enroll" ''
            export PATH="${flywheelConsumerEnv}/bin:$PATH"
            ${builtins.readFile ./scripts/flywheel-enroll.sh}
          '';
          gloriousflywheelBazel = pkgs.writeShellScriptBin "gloriousflywheel-bazel" (builtins.readFile ./examples/bazel/gloriousflywheel-bazel.sh);
          gloriousflywheelFrontdoorKit = pkgs.runCommand "gloriousflywheel-frontdoor-kit" { } ''
            mkdir -p $out/bin $out/share/gloriousflywheel/frontdoor
            mkdir -p $out/share/gloriousflywheel/frontdoor/tools/bazel/platforms
            cp ${./scripts/flywheel-frontdoor-kit.sh} $out/bin/flywheel-frontdoor-kit
            cp ${./examples/bazel/gloriousflywheel-bazel.sh} $out/bin/gloriousflywheel-bazel
            cp ${./kit/frontdoor/README.md} $out/share/gloriousflywheel/frontdoor/README.md
            cp ${./kit/frontdoor/justfile.flywheel} $out/share/gloriousflywheel/frontdoor/justfile.flywheel
            cp ${./kit/frontdoor/.bazelrc.flywheel} $out/share/gloriousflywheel/frontdoor/.bazelrc.flywheel
            cp ${./kit/frontdoor/manifest.json} $out/share/gloriousflywheel/frontdoor/manifest.json
            cp ${./kit/frontdoor/tools/bazel/platforms/BUILD.bazel} $out/share/gloriousflywheel/frontdoor/tools/bazel/platforms/BUILD.bazel
            chmod +x $out/bin/flywheel-frontdoor-kit $out/bin/gloriousflywheel-bazel
          '';

          gloriousflywheelFrontdoorTools = pkgs.buildEnv {
            name = "gloriousflywheel-frontdoor-tools";
            paths = [
              flywheelDoctor
              flywheelEnroll
              flywheelConsumerEnv
              flywheelGithubOidcProfile
              flywheelVerify
              gloriousflywheelFrontdoorKit
            ];
            pathsToLink = [ "/bin" ];
          };

          gloriousflywheelProfileTools = pkgs.buildEnv {
            name = "gloriousflywheel-profile-tools";
            paths = [
              gloriousflywheelFrontdoorTools
              gfReapiCredhelper
              gfReapiTokenExchange
            ];
            pathsToLink = [ "/bin" ];
          };

          gfReapiCellWorkerCompatRoot = pkgs.runCommand "gf-reapi-cell-worker-compat-root" { } ''
            mkdir -p $out/bin $out/lib64 $out/usr/bin
            ln -s ${pkgs.bash}/bin/bash $out/bin/sh
            ln -s ${pkgs.coreutils}/bin/env $out/usr/bin/env
            ${pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isLinux ''
            ln -s ${pkgs.nix-ld}/libexec/nix-ld $out/lib64/ld-linux-x86-64.so.2
            ''}
          '';

          gfReapiReconcilerToolsKubernetesTargetVersion = "1.33";
          # The root nixpkgs pin currently carries kubectl 1.31, which is two
          # minors behind the live Kubernetes 1.33 control plane. The
          # nix2container input's locked nixpkgs carries kubectl 1.34 and is
          # already part of flake.lock, keeping the image reproducible while
          # staying inside kubectl's supported +/-1 minor skew.
          gfReapiReconcilerToolsKubectl =
            assert pkgs.lib.assertMsg
              (pkgs.lib.versionAtLeast nix2containerPkgs.kubectl.version "1.32"
              && pkgs.lib.versionOlder nix2containerPkgs.kubectl.version "1.35")
              "gf-reapi-reconciler-tools kubectl must support Kubernetes 1.33 (+/-1 minor)";
            nix2containerPkgs.kubectl;
          gfReapiReconcilerToolsKubectlVersion = gfReapiReconcilerToolsKubectl.version;
          gfReapiReconcilerToolsKubectlNixpkgsRevision = nix2container.inputs.nixpkgs.rev;

          gfReapiReconcilerToolsShellRoot = pkgs.runCommand "gf-reapi-reconciler-tools-shell-root" { } ''
            mkdir -p $out/bin
            ln -s ${pkgs.bash}/bin/bash $out/bin/bash
            ln -s ${pkgs.bash}/bin/bash $out/bin/sh
          '';

          # Keep this list exact: it is both the image root input and the
          # machine-readable runtime contract exposed on the image package.
          gfReapiReconcilerToolsRuntime = [
            {
              name = "bash";
              package = gfReapiReconcilerToolsShellRoot;
            }
            {
              name = "coreutils/date";
              package = pkgs.coreutils;
            }
            {
              name = "grep";
              package = pkgs.gnugrep;
            }
            {
              name = "diff";
              package = pkgs.diffutils;
            }
            {
              name = "yq";
              package = pkgs.yq-go;
            }
            {
              name = "oras";
              package = pkgs.oras;
            }
            {
              name = "cosign";
              package = pkgs.cosign;
            }
            {
              name = "kubectl";
              package = gfReapiReconcilerToolsKubectl;
            }
            {
              name = "ca-certs";
              package = pkgs.cacert;
            }
          ];
          gfReapiReconcilerToolsRuntimeNames = builtins.map (tool: tool.name) gfReapiReconcilerToolsRuntime;
          gfReapiReconcilerToolsRuntimePackages = builtins.map (tool: tool.package) gfReapiReconcilerToolsRuntime;
          gfReapiReconcilerToolsRuntimeCsv = pkgs.lib.concatStringsSep "," gfReapiReconcilerToolsRuntimeNames;

          gfReapiReconcilerToolsRoot = pkgs.buildEnv {
            name = "gf-reapi-reconciler-tools-root";
            paths = gfReapiReconcilerToolsRuntimePackages;
            pathsToLink = [ "/bin" "/etc" ];
          };

          gfReapiReconcilerToolsConfig = {
            Entrypoint = [ "/bin/bash" ];
            Env = [
              "PATH=/bin"
              "SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
            ];
            Labels = {
              "org.opencontainers.image.source" = "https://github.com/tinyland-inc/GloriousFlywheel";
              "org.opencontainers.image.description" = "GloriousFlywheel REAPI desired-state reconciler tools";
              "dev.tinyland.gf-reapi-reconciler-tools.runtime-tools" = gfReapiReconcilerToolsRuntimeCsv;
              "dev.tinyland.gf-reapi-reconciler-tools.kubectl-version" = gfReapiReconcilerToolsKubectlVersion;
              "dev.tinyland.gf-reapi-reconciler-tools.kubernetes-target-version" = gfReapiReconcilerToolsKubernetesTargetVersion;
              "dev.tinyland.gf-reapi-reconciler-tools.kubectl-nixpkgs-revision" = gfReapiReconcilerToolsKubectlNixpkgsRevision;
            };
          };

          gfReapiReconcilerToolsImage =
            assert pkgs.lib.assertMsg pkgs.stdenv.hostPlatform.isLinux
              "gf-reapi-reconciler-tools must be built from a Linux package set";
            (n2c.buildImage {
              name = "gf-reapi-reconciler-tools";
              tag = "main";
              copyToRoot = gfReapiReconcilerToolsRoot;
              config = gfReapiReconcilerToolsConfig;

              meta = {
                description = "First-party runtime tools for the GF REAPI desired-state reconciler";
                platforms = pkgs.lib.platforms.linux;
              };
            }).overrideAttrs
              (oldAttrs: {
                passthru = (oldAttrs.passthru or { }) // {
                  kubectlVersion = gfReapiReconcilerToolsKubectlVersion;
                  kubernetesTargetVersion = gfReapiReconcilerToolsKubernetesTargetVersion;
                  kubectlNixpkgsRevision = gfReapiReconcilerToolsKubectlNixpkgsRevision;
                  runtimeTools = gfReapiReconcilerToolsRuntimeNames;
                  root = gfReapiReconcilerToolsRoot;
                  ociConfig = gfReapiReconcilerToolsConfig;
                };
              });

          # A derivation can prove the root closure, but it cannot execute an
          # unpacked container filesystem inside the Nix sandbox. Run this app
          # from the first-party Linux runner to copy the exact nix2container
          # output to OCI layout, unpack its layers, and execute the resulting
          # rootfs. This catches rewrite, symlink, loader, and PATH defects that
          # store-root execution cannot.
          gfReapiReconcilerToolsOciRuntimeProof = pkgs.writeShellApplication {
            name = "prove-gf-reapi-reconciler-tools-oci-runtime";
            runtimeInputs = [
              gfReapiReconcilerToolsImage.copyTo
              pkgs.coreutils
              pkgs.gnugrep
              pkgs.jq
              pkgs.umoci
            ];
            text = ''
              if [[ $(id -u) -ne 0 ]]; then
                echo "ERROR: OCI rootfs proof requires the root-running tinyland-nix-heavy capability" >&2
                exit 1
              fi

              work_dir="$(mktemp -d)"
              trap 'rm -rf "$work_dir"' EXIT

              copy-to "oci:$work_dir/oci:proof"
              umoci unpack --image "$work_dir/oci:proof" "$work_dir/bundle"

              rootfs="$work_dir/bundle/rootfs"
              runtime_config="$work_dir/bundle/config.json"
              test -x "$rootfs/bin/bash"
              test -s "$rootfs/etc/ssl/certs/ca-bundle.crt"
              jq -e '
                .process.args == ["/bin/bash"]
                and (.process.env | index("PATH=/bin")) != null
                and (.process.env | index("SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt")) != null
              ' "$runtime_config" >/dev/null

              mkdir -p "$rootfs/dev" "$rootfs/tmp"
              chmod 1777 "$rootfs/tmp"
              rm -f "$rootfs/dev/null" "$rootfs/dev/urandom"
              mknod -m 666 "$rootfs/dev/null" c 1 3
              mknod -m 666 "$rootfs/dev/urandom" c 1 9

              cat > "$rootfs/tmp/probe.sh" <<'PROBE'
              set -euo pipefail
              test -n "$BASH_VERSION"
              test "$(date -u -d @0 +%Y-%m-%dT%H:%M:%SZ)" = "1970-01-01T00:00:00Z"
              printf "gf-reapi-reconciler-tools\n" | grep -Fx "gf-reapi-reconciler-tools" >/dev/null
              printf "{\"ok\":true}\n" | yq -e ".ok == true" >/dev/null
              printf "before\n" > /tmp/before
              printf "after\n" > /tmp/after
              rc=0
              diff -u /tmp/before /tmp/after > /tmp/diff || rc=$?
              test "$rc" -eq 1
              grep -F -- "-before" /tmp/diff >/dev/null
              grep -F -- "+after" /tmp/diff >/dev/null
              oras version >/dev/null
              cosign version >/dev/null
              kubectl version --client=true --output=yaml > /tmp/kubectl-version.yaml
              grep -F "gitVersion: v${gfReapiReconcilerToolsKubectlVersion}" /tmp/kubectl-version.yaml >/dev/null
              grep -F -- "-----BEGIN CERTIFICATE-----" "$SSL_CERT_FILE" >/dev/null
              PROBE
              chmod 0555 "$rootfs/tmp/probe.sh"

              env -i \
                HOME=/tmp \
                PATH=/bin \
                SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt \
                ${pkgs.coreutils}/bin/chroot --userspec=65532:65532 "$rootfs" /bin/bash /tmp/probe.sh

              printf 'oci_rootfs_execution=passed\n'
              printf 'runtime_uid_gid=65532:65532\n'
              printf 'runtime_tools=%s\n' '${gfReapiReconcilerToolsRuntimeCsv}'
              printf 'kubectl=%s\n' '${gfReapiReconcilerToolsKubectlVersion}'
            '';
          };

          # This check builds the actual nix2container image JSON and executes
          # every required tool from the exact root rewritten into the image.
          gfReapiReconcilerToolsImageCheck = pkgs.runCommand "gf-reapi-reconciler-tools-image-check"
            {
              nativeBuildInputs = [ pkgs.jq ];
            } ''
            set -euo pipefail

            root=${gfReapiReconcilerToolsRoot}
            image=${gfReapiReconcilerToolsImage}
            cert_file="$root/etc/ssl/certs/ca-bundle.crt"
            export HOME="$TMPDIR/home"
            export SSL_CERT_FILE="$cert_file"
            mkdir -p "$HOME"

            for binary in bash sh date grep diff yq oras cosign kubectl; do
              test -x "$root/bin/$binary"
            done
            test -s "$cert_file"

            "$root/bin/bash" -ceu 'test -n "$BASH_VERSION"'
            "$root/bin/sh" -ceu 'test -n "$BASH_VERSION"'
            test "$("$root/bin/date" -u -d @0 +%Y-%m-%dT%H:%M:%SZ)" = "1970-01-01T00:00:00Z"
            printf 'gf-reapi-reconciler-tools\n' | "$root/bin/grep" -Fx 'gf-reapi-reconciler-tools' >/dev/null
            printf 'before\n' > "$TMPDIR/before"
            printf 'after\n' > "$TMPDIR/after"
            rc=0
            "$root/bin/diff" -u "$TMPDIR/before" "$TMPDIR/after" > "$TMPDIR/diff" || rc=$?
            test "$rc" -eq 1
            "$root/bin/grep" -F -- '-before' "$TMPDIR/diff" >/dev/null
            "$root/bin/grep" -F -- '+after' "$TMPDIR/diff" >/dev/null
            printf '{"ok":true}\n' | "$root/bin/yq" -e '.ok == true' >/dev/null
            "$root/bin/oras" version > "$TMPDIR/oras-version.txt"
            "$root/bin/cosign" version > "$TMPDIR/cosign-version.txt"
            "$root/bin/kubectl" version --client=true --output=yaml > "$TMPDIR/kubectl-version.yaml"
            "$root/bin/grep" -F 'gitVersion: v${gfReapiReconcilerToolsKubectlVersion}' "$TMPDIR/kubectl-version.yaml" >/dev/null
            "$root/bin/grep" -F -- '-----BEGIN CERTIFICATE-----' "$cert_file" >/dev/null

            jq -e \
              --arg root "$root" \
              --arg arch "${nix2containerBuildPkgs.go.GOARCH}" \
              --arg runtimeTools "${gfReapiReconcilerToolsRuntimeCsv}" \
              --arg kubectlVersion "${gfReapiReconcilerToolsKubectlVersion}" \
              --arg kubernetesTarget "${gfReapiReconcilerToolsKubernetesTargetVersion}" \
              --arg nixpkgsRevision "${gfReapiReconcilerToolsKubectlNixpkgsRevision}" \
              '
                .version == 1
                and .arch == $arch
                and (.layers | length) > 0
                and .["image-config"].Entrypoint == ["/bin/bash"]
                and (.["image-config"].Env | index("PATH=/bin")) != null
                and (.["image-config"].Env | index("SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt")) != null
                and .["image-config"].Labels["dev.tinyland.gf-reapi-reconciler-tools.runtime-tools"] == $runtimeTools
                and .["image-config"].Labels["dev.tinyland.gf-reapi-reconciler-tools.kubectl-version"] == $kubectlVersion
                and .["image-config"].Labels["dev.tinyland.gf-reapi-reconciler-tools.kubernetes-target-version"] == $kubernetesTarget
                and .["image-config"].Labels["dev.tinyland.gf-reapi-reconciler-tools.kubectl-nixpkgs-revision"] == $nixpkgsRevision
                and any(.layers[].paths[]?;
                  .path == $root
                  and .options.rewrite.regex == ("^" + $root)
                  and .options.rewrite.repl == "")
              ' "$image" >/dev/null

            mkdir -p "$out"
            cp "$image" "$out/image.json"
            cat > "$out/runtime-evidence.txt" <<EOF
            image_arch=${nix2containerBuildPkgs.go.GOARCH}
            image_root=$root
            runtime_tools=${gfReapiReconcilerToolsRuntimeCsv}
            bash=${pkgs.bash.version}
            coreutils=${pkgs.coreutils.version}
            grep=${pkgs.gnugrep.version}
            diff=${pkgs.diffutils.version}
            yq=${pkgs.yq-go.version}
            oras=${pkgs.oras.version}
            cosign=${pkgs.cosign.version}
            kubectl=${gfReapiReconcilerToolsKubectlVersion}
            kubernetes_target=${gfReapiReconcilerToolsKubernetesTargetVersion}
            ca_certs=${pkgs.cacert.version}
            store_root_execution=passed
            oci_config_and_root_rewrite=passed
            EOF
          '';

          mkAdapterNodeImage =
            { name
            , app
            , tag ? "latest"
            , nodejs ? pkgs.nodejs_22
            , appDir ? "/app"
            , port ? 3000
            , cmd ? [ "${appDir}/index.js" ]
            , env ? [ ]
            , labels ? { }
            , extraRootPaths ? [ ]
            , pathsToLink ? [ "/bin" "/etc" "/share" "/lib" ]
            }:
            let
              portString = toString port;
            in
            n2c.buildImage {
              inherit name tag;

              copyToRoot = pkgs.buildEnv {
                name = "${name}-root";
                paths = [
                  nodejs
                  pkgs.cacert
                  pkgs.tzdata
                ] ++ extraRootPaths;
                inherit pathsToLink;
              };

              layers = [
                (n2c.buildLayer {
                  copyToRoot = pkgs.runCommand "${name}-app" { } ''
                    mkdir -p "$out${appDir}"
                    cp -r ${app}/* "$out${appDir}/"
                  '';
                })
              ];

              config = {
                Entrypoint = [ "${nodejs}/bin/node" ];
                Cmd = cmd;
                WorkingDir = appDir;
                Env = [
                  "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
                  "TZ=UTC"
                  "PORT=${portString}"
                  "HOST=0.0.0.0"
                  "NODE_ENV=production"
                ] ++ env;
                ExposedPorts = {
                  "${portString}/tcp" = { };
                };
                Labels = labels;
              };
            };

          # OCI image for Runner Dashboard, using the same reusable adapter-node
          # builder exported to nix-only spokes.
          runnerDashboardImage = mkAdapterNodeImage {
            name = "runner-dashboard";
            app = runnerDashboard;
            labels = {
              "org.opencontainers.image.source" = "https://github.com/tinyland-inc/GloriousFlywheel";
              "org.opencontainers.image.description" = "GloriousFlywheel Runner Dashboard";
            };
          };

          # WebKit runtime for the cell's Playwright-WebKit lane. Sourced from the
          # unstable input (tofuPkgs): the nixos-24.11 playwright-driver (1.50.1 /
          # webkit-2123) is too old for consumers — tofuPkgs ships 1.59.1 /
          # webkit-2272, which consumer repos pin @playwright/test against
          # (EXACT pin; WebKit revisions are playwright-version-locked, unlike
          # the CDP-stable chromium lane). Fonts are scoped to WebKit via the
          # derivation's own fontconfig_file wrapping — no global FONTCONFIG_FILE,
          # so the proved fontless-chromium lane is byte-identical.
          gfWebkitFontsConf = tofuPkgs.makeFontsConf {
            fontDirectories = [
              tofuPkgs.dejavu_fonts
              tofuPkgs.liberation_ttf
            ];
          };
          gfWebkitBrowsers = tofuPkgs.playwright-driver.browsers.override {
            withChromium = false;
            withChromiumHeadlessShell = false;
            withFirefox = false;
            withFfmpeg = false;
            fontconfig_file = gfWebkitFontsConf;
          };
          gfWebkitRevision = tofuPkgs.playwright-driver.passthru.browsersJSON.webkit.revision;
          # The absolute store path, NOT a buildEnv /bin symlink: pw_run.sh
          # resolves its sibling browser tree via `dirname $0`, which breaks
          # through symlinks.
          gfWebkitExecutable = "${gfWebkitBrowsers}/webkit-${gfWebkitRevision}/pw_run.sh";
          # Launch shim, proved necessary by the first remote WebKit dispatch
          # (darkmap run 27329374675): the image-global LD_LIBRARY_PATH points
          # at the nixos-24.11 glibc and poisons the unstable-glibc binaries in
          # the webkit closure the moment pw_run.sh's bash loads ("symbol
          # lookup error: ... __nptl_change_stack_perm, version GLIBC_PRIVATE").
          # Nix binaries resolve via embedded rpaths — the webkit subtree needs
          # no LD_LIBRARY_PATH at all, so unset it HERE (scoped; proved
          # chromium keeps the image runtime path). The shim
          # itself is written against the 24.11 runtimeShell so it loads fine
          # under the poisoned env, then execs the unstable tree clean. Generic
          # worker actions do not inherit this image-global LD_LIBRARY_PATH;
          # gf-reapi-cell strips it at the action environment boundary so
          # consumer Nix closures resolve their own glibc/runtime libraries.
          # Fonts ride the same scope: nixpkgs' fontconfig_file override only
          # wraps chromium/firefox (a silent no-op for webkit), so
          # FONTCONFIG_FILE is exported here instead — WebKit-only, chromium
          # stays fontless.
          gfWebkitLauncher = pkgs.writeShellScript "gf-webkit-launcher" ''
            unset LD_LIBRARY_PATH
            export FONTCONFIG_FILE=${gfWebkitFontsConf}
            exec ${gfWebkitExecutable} "$@"
          '';

          # OCI image for the explicit RBE proof cell. This is not the default
          # Bazel path and should not use the current RustFS service as CAS/AC.
          gfReapiCellImage = n2c.buildImage {
            name = "gf-reapi-cell";
            tag = "latest";

            copyToRoot = pkgs.buildEnv {
              name = "gf-reapi-cell-root";
              paths = [
                gfReapiCell
                gfReapiCellWorkerCompatRoot
                gfChapelWrapped
                gfWebkitBrowsers
                pkgs.bash
                pkgs.cacert
                pkgs.chromium
                pkgs.coreutils
                pkgs.findutils
                pkgs.fontconfig
                pkgs.freetype
                pkgs.gawk
                pkgs.gnugrep
                pkgs.gnused
                pkgs.gnutar
                pkgs.gzip
                pkgs.nodejs_22
                pkgs.python3
                pkgs.stdenv.cc
                pkgs.stdenv.cc.cc.lib
                pkgs.tzdata
                pkgs.which
                pkgs.xorg.libX11
                pkgs.xorg.libXcomposite
                pkgs.xorg.libXdamage
                pkgs.xorg.libXext
                pkgs.xorg.libXfixes
                pkgs.xorg.libXrandr
                pkgs.xz
                pkgs.zlib
                pkgs.zstd
              ] ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [
                pkgs.bubblewrap
              ];
              pathsToLink = [ "/bin" "/etc" "/lib" "/share" "/usr" ]
              ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [ "/lib64" ];
            };

            config = {
              Entrypoint = [ "/bin/gf-reapi-cell" ];
              Env = [
                "PATH=/bin:/usr/bin"
                "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
                "TZ=UTC"
                "GF_REAPI_ADDR=:8980"
                "GF_REAPI_HTTP_ADDR=:8080"
                "GF_REAPI_STORE_ROOT=/var/lib/gf-reapi-cell"
                "GF_RBE_PLATFORM=gloriousflywheel-rbe-linux-x86_64"
                "GF_RBE_CHROMIUM_EXECUTABLE=/bin/chromium"
                "GF_RBE_WEBKIT_EXECUTABLE=${gfWebkitLauncher}"
              ] ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [
                "LD_LIBRARY_PATH=${pkgs.glibc}/lib:${pkgs.stdenv.cc.cc.lib}/lib:${pkgs.zlib}/lib"
                "NIX_LD=${pkgs.glibc}/lib/ld-linux-x86-64.so.2"
                "NIX_LD_LIBRARY_PATH=${pkgs.stdenv.cc.cc.lib}/lib:${pkgs.stdenv.cc.cc.lib}/lib64:${pkgs.zlib}/lib"
              ];
              ExposedPorts = {
                "8980/tcp" = { };
                "8080/tcp" = { };
              };
              Labels = {
                "org.opencontainers.image.source" = "https://github.com/tinyland-inc/GloriousFlywheel";
                "org.opencontainers.image.description" = "GloriousFlywheel minimal REAPI proof cell";
              };
            };
          };

          # OCI image for Attic server
          atticServerImage = n2c.buildImage {
            name = "attic-server";
            tag = "latest";

            # Use a minimal base image
            copyToRoot = pkgs.buildEnv {
              name = "attic-server-root";
              paths = [
                atticServer
                pkgs.cacert
                pkgs.tzdata
              ];
              pathsToLink = [ "/bin" "/etc" "/share" ];
            };

            config = {
              Entrypoint = [ "${atticServer}/bin/atticd" ];
              Cmd = [ "--config" "/etc/attic/server.toml" "--mode" "api-server" ];
              Env = [
                "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
                "TZ=UTC"
              ];
              ExposedPorts = {
                "8080/tcp" = { };
              };
              Labels = {
                "org.opencontainers.image.source" = "https://github.com/tinyland-inc/GloriousFlywheel";
                "org.opencontainers.image.description" = "Attic Nix Binary Cache Server";
                "org.opencontainers.image.licenses" = "Zlib";
              };
            };
          };

          # OCI image for Attic garbage collector
          atticGCImage = n2c.buildImage {
            name = "attic-gc";
            tag = "latest";

            copyToRoot = pkgs.buildEnv {
              name = "attic-gc-root";
              paths = [
                atticServer
                pkgs.cacert
                pkgs.tzdata
              ];
              pathsToLink = [ "/bin" "/etc" "/share" ];
            };

            config = {
              Entrypoint = [ "${atticServer}/bin/atticd" ];
              Cmd = [ "--config" "/etc/attic/server.toml" "--mode" "garbage-collector" ];
              Env = [
                "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
                "TZ=UTC"
              ];
              Labels = {
                "org.opencontainers.image.source" = "https://github.com/tinyland-inc/GloriousFlywheel";
                "org.opencontainers.image.description" = "Attic Nix Binary Cache Garbage Collector";
                "org.opencontainers.image.licenses" = "Zlib";
              };
            };
          };

        in
        {
          lib = {
            inherit mkAdapterNodeImage;
          };

          # Development shell with all required tools
          devShells.default = pkgs.mkShell {
            name = "gloriousflywheel-dev";
            # Surface the GloriousFlywheel front-door tools (gloriousflywheel-bazel,
            # flywheel-doctor/verify/enroll) on PATH in the default shell, not only
            # in devShells.ci. This is the canonical, byte-identical wrapper source;
            # consumers should reach it here (or via the flywheel-profile module /
            # `nix run .#gloriousflywheel-bazel`) and never vendor a copy that drifts.
            packages = devTools ++ [ gloriousflywheelFrontdoorTools ];

            shellHook = ''
              echo "GloriousFlywheel Development Environment"
              echo "========================================"
              echo ""
              echo "Available tools:"
              echo "  kubectl, helm, k9s    - Kubernetes management"
              echo "  tofu                  - Infrastructure as Code"
              echo "  # civo removed        - Civo decommissioned April 2026"
              echo "  attic                 - Attic client"
              echo "  bazel                 - Compatibility wrapper for cache-backed Bazel"
              echo ""
              echo "Substrate checks:"
              echo "  just info                   - Show cache/substrate mode"
              echo "  just bazel-build-cached     - Build through Bazel only with BAZEL_REMOTE_CACHE"
              echo "  just check                  - Run repo validation"
              echo "  just nix-build              - Build runner-dashboard through Nix"
              echo ""
              if [ -n "''${BAZEL_REMOTE_CACHE:-}" ]; then
                echo "Bazel substrate: shared-cache-backed (''${BAZEL_REMOTE_CACHE})"
              else
                echo "Bazel substrate: compatibility-local-only; set BAZEL_REMOTE_CACHE before Bazel dogfood."
              fi
              echo ""

              # Set up direnv if available
              if command -v direnv &> /dev/null; then
                eval "$(direnv hook bash 2>/dev/null || direnv hook zsh 2>/dev/null || true)"
              fi

              # Configure kubectl context hint
              if [ -n "$KUBECONFIG" ]; then
                echo "KUBECONFIG: $KUBECONFIG"
              fi
            '';

            # Environment variables
            ATTIC_CACHE_URL = "https://nix-cache.tinyland.dev";
          };

          # Lightweight CI shell for Bazel jobs (no attic/Rust builds)
          devShells.ci = pkgs.mkShell {
            name = "gloriousflywheel-ci";
            packages = [
              pkgs.bazel-buildtools
              bazelWrapper
              opentofuTool
              pkgs.go_1_24
              pkgs.kubectl
              pkgs.jq
              pkgs.jdk_headless
              pkgs.nodejs_22
              pkgs.nodePackages.pnpm
              pkgs.python3
              pkgs.just
              pkgs.git
              pkgs.gh
              pkgs.yq-go
              gloriousflywheelFrontdoorTools
            ];
          };

          # Packages
          packages = {
            default = atticClient;
            attic-server = atticServer;
            attic-client = atticClient;
            opentofu = opentofuTool;
            tofu = opentofuTool;

            # OCI images
            container = atticServerImage;
            attic-server-image = atticServerImage;
            attic-gc-image = atticGCImage;
            gf-reapi-cell-image = gfReapiCellImage;

            # Combined tarball for manual deployment
            container-tarball = pkgs.runCommand "attic-server-image.tar.gz" { } ''
              ${atticServerImage.copyToDockerDaemon}/bin/copy-to-docker-daemon | gzip > $out
            '';

            # Runner Dashboard
            runner-dashboard = runnerDashboard;
            runner-dashboard-image = runnerDashboardImage;

            # RBE proof cell
            gf-reapi-cell = gfReapiCell;
            gf-reapi-credhelper = gfReapiCredhelper;
            gf-reapi-token-exchange = gfReapiTokenExchange;

            # Fleet-managed profile tools
            flywheel-doctor = flywheelDoctor;
            flywheel-enroll = flywheelEnroll;
            flywheel-consumer-env = flywheelConsumerEnv;
            flywheel-github-oidc-profile = flywheelGithubOidcProfile;
            flywheel-verify = flywheelVerify;
            gloriousflywheel-bazel = gloriousflywheelBazel;
            gloriousflywheel-frontdoor-kit = gloriousflywheelFrontdoorKit;
            gloriousflywheel-frontdoor-tools = gloriousflywheelFrontdoorTools;
            gloriousflywheel-profile-tools = gloriousflywheelProfileTools;
          } // pkgs.lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux {
            gf-chapel-toolchain = gfChapelWrapped;
            gf-chapel-toolchain-check = gfChapelToolchainCheck;
            # Kubernetes cannot consume a Darwin-root OCI artifact.
            gf-reapi-reconciler-tools-image = gfReapiReconcilerToolsImage;
            gf-reapi-reconciler-tools-oci-runtime-proof = gfReapiReconcilerToolsOciRuntimeProof;
          };

          # Checks for CI validation
          checks = {
            # Formatting check
            formatting = treefmtEval.config.build.check self;

            # Nix linting
            statix = pkgs.runCommand "statix-check" { } ''
              ${pkgs.statix}/bin/statix check --ignore runners/Dockerfile.nix ${self}
              touch $out
            '';

            # Dead code detection
            deadnix = pkgs.runCommand "deadnix-check" { } ''
              ${pkgs.deadnix}/bin/deadnix --fail --exclude runners/Dockerfile.nix ${self}
              touch $out
            '';

            # Verify attic packages build
            attic-client-check = atticClient;
            attic-server-check = atticServer;

            # Verify container image builds
            container-check = atticServerImage;
            gf-reapi-cell-check = gfReapiCell;
            gf-reapi-credhelper-check = gfReapiCredhelper;
            gf-reapi-token-exchange-check = gfReapiTokenExchange;
          } // pkgs.lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux {
            gf-reapi-reconciler-tools-image-check = gfReapiReconcilerToolsImageCheck;
          };

          # Formatter
          formatter = treefmtEval.config.build.wrapper;

          # Apps for easy execution
          apps = {
            default = {
              type = "app";
              program = "${atticClient}/bin/attic";
            };
            attic = {
              type = "app";
              program = "${atticClient}/bin/attic";
            };
            atticd = {
              type = "app";
              program = "${atticServer}/bin/atticd";
            };
            tofu = {
              type = "app";
              program = "${opentofuTool}/bin/tofu";
            };
            gf-reapi-cell = {
              type = "app";
              program = "${gfReapiCell}/bin/gf-reapi-cell";
            };
            gf-reapi-credhelper = {
              type = "app";
              program = "${gfReapiCredhelper}/bin/gf-reapi-credhelper";
            };
            gf-reapi-token-exchange = {
              type = "app";
              program = "${gfReapiTokenExchange}/bin/gf-reapi-token-exchange";
            };
            gloriousflywheel-bazel = {
              type = "app";
              program = "${gloriousflywheelBazel}/bin/gloriousflywheel-bazel";
            };
            flywheel-frontdoor-kit = {
              type = "app";
              program = "${gloriousflywheelFrontdoorKit}/bin/flywheel-frontdoor-kit";
            };
            flywheel-github-oidc-profile = {
              type = "app";
              program = "${flywheelGithubOidcProfile}/bin/flywheel-github-oidc-profile";
            };
          };
        }
      ) // {
      # System-independent outputs

      overlays.default = _final: prev: {
        # Add any custom overlays here
        attic-server = attic.packages.${prev.system}.attic-server or attic.packages.${prev.system}.default;
        attic-client = attic.packages.${prev.system}.attic or attic.packages.${prev.system}.attic-client;
        gloriousflywheel-profile-tools = self.packages.${prev.system}.gloriousflywheel-profile-tools;
        gloriousflywheel-frontdoor-tools = self.packages.${prev.system}.gloriousflywheel-frontdoor-tools;
        flywheel-consumer-env = self.packages.${prev.system}.flywheel-consumer-env;
        flywheel-github-oidc-profile = self.packages.${prev.system}.flywheel-github-oidc-profile;
        gloriousflywheel-bazel = self.packages.${prev.system}.gloriousflywheel-bazel;
        gloriousflywheel-frontdoor-kit = self.packages.${prev.system}.gloriousflywheel-frontdoor-kit;
      };

      # NixOS/nix-darwin and Home Manager modules.
      nixosModules = {
        default = { config, lib, ... }: {
          options.services.attic-cache = {
            enable = lib.mkEnableOption "Attic cache client configuration";

            cacheUrl = lib.mkOption {
              type = lib.types.str;
              default = "https://nix-cache.tinyland.dev/main";
              description = "URL of the Attic cache";
            };

            publicKey = lib.mkOption {
              type = lib.types.str;
              default = "";
              description = "Public key for the cache (will be populated after deployment)";
            };
          };

          config = lib.mkIf config.services.attic-cache.enable {
            nix.settings = {
              substituters = [ config.services.attic-cache.cacheUrl ];
              trusted-public-keys = lib.optional
                (config.services.attic-cache.publicKey != "")
                config.services.attic-cache.publicKey;
            };
          };
        };
        attic-cache = self.nixosModules.default;
        flywheel-profile = import ./nix/modules/nixos/flywheel-profile.nix;
      };

      homeManagerModules = {
        default = self.homeManagerModules.flywheel-profile;
        flywheel-profile = import ./nix/modules/home-manager/flywheel-profile.nix;
      };
    };

  # Attic binary cache — configure in your nix.conf (via Home Manager or manually):
  #
  #   extra-substituters = https://nix-cache.tinyland.dev
  #   extra-trusted-public-keys = main:eaUydxuDu7xBoy5cCo3MdknYAkVyTIASQ7DGuwxa+XA=
  #
  # To extract the public key from a deployed Attic instance:
  #   ./scripts/init-cache.sh -e https://your-attic-cache.example.com
}