Add Nix reproducible build

.gitignore

@@ -1,3 +1,5 @@
 star-randsrv
 target
 include
+result
+*.tar.gz

Makefile

@@ -1,8 +1,8 @@
 prog := star-randsrv
 version := $(shell git describe --tag --dirty)
 image_tag := $(prog):$(version)
-image_tar := $(prog)-$(version)-kaniko.tar
-image_eif := $(image_tar:%.tar=%.eif)
+image_tar := $(prog)-$(version).tar.gz
+image_eif := $(image_tar:%.tar.gz=%.eif)
 
 RUST_DEPS := $(wildcard Cargo.* src/*.rs)
 
@@ -29,24 +29,20 @@ clean:
 eif: $(image_eif)
 
 $(image_eif): $(image_tar)
-	docker load -i $<
+	gunzip -c $(image_tar) | docker load
 	nitro-cli build-enclave --docker-uri $(image_tag) --output-file $@
 
 image: $(image_tar)
 
-$(image_tar): Dockerfile $(RUST_DEPS)
-	docker run -v $$PWD:/workspace gcr.io/kaniko-project/executor:v1.9.2 \
-		--context dir:///workspace/ \
-		--reproducible \
-		--no-push \
-		--tarPath $(image_tar) \
-		--destination $(image_tag) \
-		--custom-platform linux/amd64
+$(image_tar): default.nix $(RUST_DEPS)
+	nix-build -v --arg tag \"$(version)\"
+	rm -f $(image_tar)
+	cp -L ./result $(image_tar)
 
 run: $(image_eif)
 	$(eval ENCLAVE_ID=$(shell nitro-cli describe-enclaves | jq -r '.[0].EnclaveID'))
 	@if [ "$(ENCLAVE_ID)" != "null" ]; then nitro-cli terminate-enclave --enclave-id $(ENCLAVE_ID); fi
 	@echo "Starting enclave."
-	nitro-cli run-enclave --cpu-count 2 --memory 512 --eif-path $(image_eif) --debug-mode
+	nitro-cli run-enclave --cpu-count 4 --memory 2048 --eif-path $(image_eif) --debug-mode
 	@echo "Showing enclave logs."
 	nitro-cli console --enclave-id $$(nitro-cli describe-enclaves | jq -r '.[0].EnclaveID')

flake.nix

@@ -0,0 +1,67 @@
+{
+  description = "A very basic flake";
+
+  inputs = {
+    nixpkgs.url = "nixpkgs/nixos-24.05";
+    nitriding.url = "github:brave/nitriding-daemon/255fa70056b35b86ea493a0157d7a0b49a82579b";
+  };
+
+  outputs = { self, nixpkgs, nitriding }:
+    let
+      tag = "latest";
+      system = "x86_64-linux";
+
+      pkgs = import nixpkgs {
+        inherit system;
+      };
+
+      startSh = pkgs.writeTextFile {
+        name = "start.sh";
+        text = builtins.readFile ./start.sh;
+        executable = true;
+        destination = "/bin/start.sh";
+      };
+
+    in rec {
+      dockerImage = pkgs.dockerTools.buildImage {
+        name = "star-randsrv";
+        tag = tag;
+
+        config = {
+          Cmd = [ "/bin/start.sh" ];
+          ExposedPorts = {
+            "443/tcp" = {};
+          };
+          User = "65534";
+        };
+
+        copyToRoot = pkgs.buildEnv {
+          name = "image-root";
+          paths = [
+            pkgs.bash
+            pkgs.coreutils
+            startSh
+            nitriding.outputs.packages.${system}.default
+            rustApp
+          ];
+          pathsToLink = [ "/bin" ];
+        };
+      };
+      rustApp = pkgs.rustPlatform.buildRustPackage {
+        pname = "star-randsrv";
+        version = "0.2.0";
+
+        src = builtins.filterSource
+          (path: type:
+            let relPath = pkgs.lib.removePrefix (toString ./. + "/") path;
+            in (relPath == "src" && type == "directory") || pkgs.lib.hasSuffix ".rs" relPath ||
+                relPath == "Cargo.toml" || relPath == "Cargo.lock")
+          ./.;
+        cargoLock = {
+          lockFile = ./Cargo.lock;
+        };
+      };
+
+      packages.x86_64-linux.default = dockerImage;
+    };
+}

start.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-nitriding \
+nitriding-daemon \
   -fqdn "star-randsrv.bsg.brave.com" \
   -appurl "https://github.com/brave/star-randsrv" \
   -appwebsrv "http://127.0.0.1:8080" \