nix-native builds

flake.nix

@@ -12,6 +12,56 @@
       # Self-contained (D8): a host with ONLY nix can enter this shell and run
       # `make check`. ffmpeg is present because the migrated music pipeline needs
       # it; the scaffold itself is pure stdlib Go.
+      # Daemonless image build (D8): `nix build .#image` produces an OCI tarball
+      # with no docker/podman daemon. CI loads/pushes it with skopeo. This is the
+      # Nix-native replacement for `docker build` on the host-mode runner, which
+      # has no container runtime. ffmpeg-headless ships the BMU codec path.
+      packages = forAllSystems (pkgs:
+        let
+          version = self.shortRev or self.dirtyShortRev or "unknown";
+          crucible = pkgs.buildGoModule {
+            pname = "crucible";
+            inherit version;
+            src = ./.;
+            vendorHash = "sha256-hm6mrNAtXv0LidzHUfz4eukTFZouizGtxkZ8gKJFUVI=";
+            subPackages = [
+              "cmd/crucible"
+              "cmd/crucible-depot"
+              "cmd/crucible-hak"
+              "cmd/crucible-module"
+              "cmd/crucible-topdata"
+              "cmd/crucible-wiki"
+            ];
+            env.CGO_ENABLED = 0;
+            ldflags = [
+              "-s"
+              "-w"
+              "-X git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/buildinfo.Version=${version}"
+            ];
+            # Unit tests run in the `test` workflow / `make check`, not here.
+            doCheck = false;
+          };
+        in
+        {
+          inherit crucible;
+          default = crucible;
+
+          image = pkgs.dockerTools.buildLayeredImage {
+            name = "registry.westgate.pw/sow/crucible";
+            tag = version;
+            contents = [ crucible pkgs.cacert pkgs.ffmpeg-headless pkgs.fakeNss ];
+            config = {
+              Entrypoint = [ "/bin/crucible" ];
+              Cmd = [ "help" ];
+              User = "65532:65532";
+              Env = [
+                "PATH=/bin"
+                "SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
+              ];
+            };
+          };
+        });
+
       devShells = forAllSystems (pkgs: {
         default = pkgs.mkShell {
           name = "sow-tools";