nix support for desktop and relay

[DanConwayDev]

This was largely one-shotted from #3434, which required a few fixes, together with an updated adaptation of #2307. I’m posting it as a draft for anyone who might be interested.

I have used it to deploy Buzz to a NixOS server and run buzz-desktop locally against that relay, including running Codex through codex-acp. This provides some basic x86_64 Linux coverage, but it has not been robustly tested; other platforms and some desktop integrations remain untested.

Summary

Provide unified Nix support for the Buzz desktop app, relay server,
administration CLI, agent sidecars, development shell, and NixOS deployments.

This combines Daniel Toubul’s desktop work in #3434 with an updated adaptation
of thesimplekid’s relay module from #2307.

Problems addressed

• Build the current checkout using the repository-pinned Rust toolchain.
• Replace stale and placeholder dependency hashes with verified inputs.
• Align pnpm fetching with the desktop workspace’s offline build.
• Include the native Sherpa, GTK, WebKit, audio, OpenSSL, and C++ dependencies.
• Repair Tauri binary RPATHs so the packaged desktop app starts on NixOS.
• Package buzz-relay and buzz-admin from the root workspace.
• Add runnable buzz-relay and buzz-admin flake apps.
• Provide a hardened NixOS systemd module using the relay’s current settings.
• Support environment files for credentials without copying secrets into the
  Nix store.
• Model current S3 addressing, read-replica pool, and bounded-staleness routing
  controls.
• Add deployment documentation covering PostgreSQL, Redis, S3, TLS,
  migrations, closed relays, health probes, and metrics.
• Add path-scoped CI covering formatting, evaluation, module checks, and builds.

Flake outputs

• packages.<system>.buzz-desktop
• packages.<system>.buzz-sidecars
• packages.<linux-system>.buzz-relay
• apps.<linux-system>.buzz-relay
• apps.<linux-system>.buzz-admin
• nixosModules.buzz-relay
• devShells.<system>.default

Validation

The branch has been rebased onto current main, including Buzz Desktop
v0.5.2.

• nix fmt -- --check ...
• nix flake show --all-systems
• nix flake check --print-build-logs
• Built buzz-desktop, buzz-sidecars, buzz-relay, and buzz-admin
• Verified the packaged ELF binaries have complete runtime library closures
• Launched the desktop package under an isolated Xvfb/D-Bus session
• Started the packaged relay against disposable PostgreSQL, Redis, and MinIO
• Verified migration 0026
• Verified path-style S3 git-object conformance
• Verified readiness, liveness, application health, and Prometheus metrics
• Verified the packaged buzz-admin CLI
• Validated the GitHub Actions workflow with actionlint

The full build and runtime tests were performed on x86_64 Linux. ARM64 Linux
and Apple Silicon macOS outputs were evaluated successfully but were not
physically built on this host.

Draft status

This is being opened as a draft to collect feedback from people interested in
using or maintaining Nix support.

In particular, physical build and runtime testing on ARM64 Linux and Apple
Silicon macOS would be useful before marking it ready for review.

Credits

• Initial desktop Nix work: Daniel Toubul, feat: first-class Nix support (flake, CI-relay, multi-platform) #3434
• Initial relay/NixOS module proposal: thesimplekid, feat(nix): add Buzz relay NixOS module #2307