feat: adding back our nix modules #454

gordysunsaronic · 2025-06-30T13:55:19Z

adding back out nix modules

moq-relay command

therishidesai

lets remove all of the lines that have "Gordy" in it

therishidesai · 2025-07-01T16:26:51Z

flake.nix

        inputsFrom = [
          rs.devShells.${system}.default
-          js.devShells.${system}.default
+          js.devShells.${system}.default 


nit: whitespace

therishidesai · 2025-07-01T16:27:08Z

flake.nix

+          js.devShells.${system}.default 
        ];
+        shellHook = ''
+          echo "🎯 Using Gordy's Top-Level MoQ Flake (Rust environment only)"


nit: remove your name

therishidesai · 2025-07-01T16:27:56Z

rs/flake.nix

you should combine this flake.nix with the top level flake.nix so there is one unified nix flake in the moq repo

just the rs/flake.nix or also the js/flake.nix?

also - problem here is if i combine this with the top level flake.nix, it gives me problems with the js stuff which isn't in the moq-relay server but is related to the webplayer and front end

therishidesai · 2025-07-01T16:29:48Z

rs/nix/modules/moq-relay.nix

+
+      serviceConfig = {
+        ExecStart = "${pkgs.moq-relay}/bin/moq-relay --bind [::]:${builtins.toString cfg.port}" + 
+          (if cfg.dev.enable then " --tls-generate ${cfg.dev.tls_url}" else "");


I don't think these args are up to date with the new moq-relay

updated them

therishidesai · 2025-07-01T16:35:03Z

rs/nix/packages/moq.nix

@@ -0,0 +1,34 @@
+{ fenix, naersk, flake-utils, ... }:


why naersk? We used to use crate2nix in the original moq. I think we should stick to crate2nix as it allows for better caching

I switched over to naersk primarily because it doesn't require a separate lockfile (don't want to mandate Nix). I don't know the differences otherwise.

I think that can get updated now, but naersk also works fine. This is a smaller project so shouldn't be an issue with the caching

therishidesai · 2025-07-01T16:40:54Z

rs/nix/shell.nix

@@ -0,0 +1,40 @@
+{ self, nixpkgs, flake-utils, fenix, ... }:


move the dev shell from the top level nix into this

the dev shells have both rs and js, so i gotta keep it at the top level

…flake.nix file

…erver is set up

…m having)

therishidesai

This looks good to me on the nix side of things. In future PRs let's add a way of validating the config file at eval time I case the underlying rust code gets changed. Let's also add a NixOS VM test for the relay in a future PR.

@kixelated thoughts on this PR?

kixelated · 2025-07-10T23:06:12Z

js/hang-demo/src/index.ts


 // If query params are provided, use it as the broadcast name.
+
+


kixelated · 2025-07-10T23:06:14Z

js/hang-demo/src/index.ts

 const urlParams = new URLSearchParams(window.location.search);
-const name = urlParams.get("name") ?? "demo/bbb";
-watch.setAttribute("url", `http://localhost:4443/${name}.hang`);
+const name = urlParams.get("name") ?? "jwt-test/bbb";


kixelated · 2025-07-10T23:09:04Z

rs/flake.nix

+
+          # Environment variables from moq-rs
+          shellHook = ''
+            export LIBCLANG_PATH="${pkgs.libclang.lib}/lib"


What does this do?

deals with some C dependencies in Rust code

kixelated · 2025-07-10T23:09:28Z

rs/justfile

 	fi
+
+	# Generate publisher-only token
+	if [ ! -f "dev/bum-publisher.jwt" ]; then \


Remove these?

kixelated · 2025-07-10T23:10:05Z

rs/nix/modules/moq-relay.nix

+  tomlFormat = pkgs.formats.toml {};
+
+  # Build the configuration
+  configData = {


pretty cool tbh

kixelated · 2025-07-10T23:11:13Z

rs/nix/overlay.nix

+  moq-token = naersk'.buildPackage {
+    pname = "moq-token-cli";
+    src = ../.;
+    cargoBuildOptions = opts: opts ++ [ "-p" "moq-token-cli" ];


We should also have these options for the other binaries.

kixelated · 2025-07-10T23:14:54Z

rs/nix/shell.nix

+            with pkgs;
+            mkShell {
+              nativeBuildInputs = [
+                go


cursor

Bug: Moq-Relay Module Fails Due to Incorrect Binary Reference

The moq-relay NixOS module incorrectly references the moq-token binary as moq-token instead of moq-token-cli, causing preStart commands for auth key and cluster token generation to fail. Additionally, the cluster token generation lacks validation that the authentication key has been successfully generated, leading to potential failures if the key generation step fails.

rs/nix/modules/moq-relay.nix#L221-L234

https://github.com/kixelated/moq/blob/5812bd212a0a6465149878f1af53ac77f05e5fe2/rs/nix/modules/moq-relay.nix#L221-L234

Fix in Cursor • Fix in Web

Was this report helpful? Give feedback by reacting with 👍 or 👎

kixelated · 2025-07-16T15:11:26Z

Bug: Curl Command Change Causes Silent Failures

The curl command was changed from -fsSL to -s, removing the -f (fail on HTTP errors), -S (show errors), and -L (follow redirects) flags. This can lead to silent download failures when encountering HTTP errors (e.g., 404) or redirects, potentially resulting in incomplete or incorrect files being downloaded without an explicit error.

rs/justfile#L45-L46
Fix in Cursor • Fix in Web

Bug: Flake Inputs Bypassed for Dependencies

Using builtins.getFlake to fetch fenix and naersk flakes bypasses flake inputs and the lock file. This causes impure network fetches during evaluation, leading to non-reproducible builds and version inconsistencies. These dependencies should be passed as inputs to the overlay function instead.

rs/nix/overlay.nix#L2-L4
Fix in Cursor • Fix in Web

Bug: JWT Key Misconfiguration in Moq-Relay

When JWT authentication is enabled and services.moq-relay.auth.keyFile is null, the preStart script correctly generates a JWT signing key at cfg.stateDir/root.jwk. However, the generated moq-relay.toml configuration incorrectly sets auth.key to null, preventing the moq-relay service from using the generated key.

rs/nix/modules/moq-relay.nix#L27-L28
Fix in Cursor • Fix in Web

Bug: Service Fails When Cluster URLs Are Null

The moq-relay service's ExecStart command incorrectly passes cfg.cluster.rootUrl and cfg.cluster.nodeUrl as the string "null" to their respective command-line arguments (--cluster-root, --cluster-node) when these options are null (their default). This results in invalid command line arguments.

rs/nix/modules/moq-relay.nix#L214-L217
Fix in Cursor • Fix in Web

BugBot free trial expires on July 22, 2025 Learn more in the Cursor dashboard.

Was this report helpful? Give feedback by reacting with 👍 or 👎

FYI @gordysunsaronic I let Cursor fix these issues, but I don't have a way of validating the nixos fixes. Could you double check everything still runs?

gordysunsaronic added 17 commits June 30, 2025 08:41

feat: adding back our nix modules

37c0361

chore: just adding some last stuff

24485e8

chore: adding some indicators, will remove

27c340b

fix: comment out js flake input to fix psm build

393e625

chore: i hate this

747c0ea

chore: blah blah fix

4f0c002

chore: ....

e8d625f

chore: added some minor stuff

c4174a4

fix: trying this fix

6d18f2b

fix: fixing more

a65bf70

Fix: Remove deprecated --dev flags from

ee3d7ca

moq-relay command

Fix network binding capability for moq-relay service

cf6886b

Change default port to 8443 to avoid permission issues

55f96ee

asd

ecb5620

Remove CapabilityBoundingSet restriction to fix network binding

365db9c

Add dev mode support with --tls-generate flag

50b2412

Remove all systemd hardening and user config to fix permissions

9c93c67

therishidesai suggested changes Jul 1, 2025

View reviewed changes

gordysunsaronic added 6 commits July 1, 2025 16:02

fix: removing the rs/flake.nix file and moving up into the top level …

7db213f

…flake.nix file

chore: remove references to my name

0d9deac

fix: modifying moq-relay.nix to adjust for changes in how the relay s…

c744a51

…erver is set up

chore: uploading the flake.lock stuff (idk if it'll fix the problem i…

db83f69

…m having)

chore: breaking the flake.nix files again

879a679

feat: adding some stuff to get JWT generation working

eaeb985

gordysunsaronic marked this pull request as ready for review July 3, 2025 19:05

chore: removing some specific-to-me demo stuff

d1ec22f

gordysunsaronic requested review from kixelated and therishidesai July 7, 2025 18:29

therishidesai approved these changes Jul 8, 2025

View reviewed changes

kixelated requested changes Jul 10, 2025

View reviewed changes

chore: making some last changes

4444fe3

gordysunsaronic requested a review from kixelated July 11, 2025 14:59

kixelated added 4 commits July 16, 2025 07:27

Revert the hang-demo changes.

a564a25

Merge remote-tracking branch 'origin/main' into gordy/nix-modules

223f310

Merge remote-tracking branch 'origin/main' into gordy/nix-modules

f8bae2f

Remove the remaining WASM stuff.

60fc129

kixelated enabled auto-merge (squash) July 16, 2025 14:52

This comment was marked as outdated.

Sign in to view

kixelated disabled auto-merge July 16, 2025 14:54

YOLO Cursor PR review.

5812bd2

kixelated enabled auto-merge (squash) July 16, 2025 14:59

kixelated merged commit 5ce21b5 into moq-dev:main Jul 16, 2025
3 checks passed

cursor bot reviewed Jul 16, 2025

View reviewed changes

moq-bot bot mentioned this pull request Jul 16, 2025

chore: release #456

Merged


		// If query params are provided, use it as the broadcast name.

feat: adding back our nix modules #454

feat: adding back our nix modules #454

Uh oh!

Conversation

gordysunsaronic commented Jun 30, 2025

Uh oh!

therishidesai left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

therishidesai left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Bug: Moq-Relay Module Fails Due to Incorrect Binary Reference

Uh oh!

kixelated commented Jul 16, 2025

Bug: Curl Command Change Causes Silent Failures

Bug: Flake Inputs Bypassed for Dependencies

Bug: JWT Key Misconfiguration in Moq-Relay

Bug: Service Fails When Cluster URLs Are Null

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants