Fully statically linked skyscope binary

.bazelrc

@@ -7,8 +7,8 @@ build:ci-windows --crosstool_top=@rules_haskell_ghc_windows_amd64//:cc_toolchain
 
 # This project uses a GHC provisioned via nix.
 # We need to use the rules_haskell nix toolchain accordingly:
-build --host_platform=@io_tweag_rules_nixpkgs//nixpkgs/platforms:host
-run --host_platform=@io_tweag_rules_nixpkgs//nixpkgs/platforms:host
+build --host_platform=//backend:regular_executable --incompatible_enable_cc_toolchain_resolution
+run --host_platform=//backend:regular_executable --incompatible_enable_cc_toolchain_resolution
 
 # test environment does not propagate locales by default
 # some tests reads files written in UTF8, we need to propagate the correct

WORKSPACE.bazel

@@ -4,9 +4,9 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 http_archive(
     name = "io_tweag_rules_nixpkgs",
-    sha256 = "1f3d86577eb1b85881f60c9eb1eb420c64d2ec8b9c951dbd66394db20cb5ddb1",
-    strip_prefix = "rules_nixpkgs-d28e07001f2c2386162cb51964f02f6c9b67628a",
-    urls = ["https://github.com/tweag/rules_nixpkgs/archive/d28e07001f2c2386162cb51964f02f6c9b67628a.tar.gz"],
+    sha256 = "9e3898a33c5f21f634aa9e2d45620e7c4b6d54d16d473571a891193bbd4725ca",
+    strip_prefix = "rules_nixpkgs-0c1f8f5470c7f292b7620762e224f53d837929d3",
+    urls = ["https://github.com/tweag/rules_nixpkgs/archive/0c1f8f5470c7f292b7620762e224f53d837929d3.tar.gz"],
 )
 
 load("@io_tweag_rules_nixpkgs//nixpkgs:repositories.bzl", "rules_nixpkgs_dependencies")
@@ -76,7 +76,23 @@ stack_snapshot(
 load("@io_tweag_rules_nixpkgs//nixpkgs:nixpkgs.bzl", "nixpkgs_git_repository")
 load("@io_tweag_rules_nixpkgs//nixpkgs:nixpkgs.bzl", "nixpkgs_cc_configure")
 
-nixpkgs_cc_configure(repository = "@nixpkgs")
+nixpkgs_cc_configure(
+    name = "local_config_cc_regular",
+    exec_constraints = ["@//backend:regular_linking"],
+    repository = "@nixpkgs",
+    target_constraints = ["@//backend:regular_linking"],
+)
+
+# TODO[AH] Replace this by global Nix configuration for appropriate Nix cache.
+static_nixopts = []  #["--builders", "@/etc/nix/machines", "-j0"]
+
+nixpkgs_cc_configure(
+    name = "local_config_cc_static",
+    exec_constraints = ["@//backend:fully_static_linking"],
+    nixopts = static_nixopts,
+    repository = "@static-nixpkgs",
+    target_constraints = ["@//backend:fully_static_linking"],
+)
 
 load("@io_tweag_rules_nixpkgs//nixpkgs:nixpkgs.bzl", "nixpkgs_python_configure")
 
@@ -85,8 +101,31 @@ nixpkgs_python_configure(repository = "@nixpkgs")
 load("@rules_haskell//haskell:nixpkgs.bzl", "haskell_register_ghc_nixpkgs")
 
 haskell_register_ghc_nixpkgs(
+    name = "rules_haskell_regular",
     attribute_path = "ghc",
+    exec_constraints = ["@//backend:regular_linking"],
     repository = "@nixpkgs",
+    target_constraints = ["@//backend:regular_linking"],
+    version = "9.0.2",
+)
+
+haskell_register_ghc_nixpkgs(
+    name = "rules_haskell_static",
+    attribute_path = "",
+    exec_constraints = ["@//backend:fully_static_linking"],
+    fully_static_link = True,
+    # TODO[AH] Upstream and expose through a Nix cache.
+    nix_file_content = """\
+with import <nixpkgs> { config = {}; overlays = []; };
+haskell.compiler.ghc902.override {
+  enableRelocatedStaticLibs = true;
+  enableShared = false;
+}
+""",
+    nixopts = static_nixopts,
+    repository = "@static-nixpkgs",
+    static_runtime = True,
+    target_constraints = ["@//backend:fully_static_linking"],
     version = "9.0.2",
 )
 
@@ -98,6 +137,13 @@ nixpkgs_package(
     repository = "@nixpkgs",
 )
 
+nixpkgs_package(
+    name = "nixpkgs_zlib.static",
+    attribute_path = "zlib.static",
+    nixopts = static_nixopts,
+    repository = "@static-nixpkgs",
+)
+
 nixpkgs_package(
     name = "zlib.dev",
     build_file = "//backend:zlib.BUILD.bazel",
@@ -117,13 +163,32 @@ nixpkgs_package(
     repository = "@nixpkgs",
 )
 
+nixpkgs_package(
+    name = "sqlite.dev.static",
+    build_file = "//backend:sqlite.BUILD.bazel",
+    nix_file_content = """
+        let pkgs = import <nixpkgs> { };
+        in pkgs.buildEnv {
+          name = "sqlite";
+          paths = [ pkgs.sqlite.dev pkgs.sqlite.out ];
+        }
+    """,
+    repository = "@static-nixpkgs",
+)
+
 load("@io_tweag_rules_nixpkgs//nixpkgs:nixpkgs.bzl", "nixpkgs_local_repository")
 
 nixpkgs_local_repository(
     name = "nixpkgs",
     nix_flake_lock_file = "//:flake.lock",
 )
 
+nixpkgs_local_repository(
+    name = "static-nixpkgs",
+    nix_file = "//:static-nixpkgs.nix",
+    nix_file_deps = ["//:flake.lock"],
+)
+
 nixpkgs_package(
     name = "esbuild",
     repository = "@nixpkgs",

backend/BUILD.bazel

@@ -1,5 +1,36 @@
 load("@rules_haskell//haskell:defs.bzl", "haskell_binary", "haskell_toolchain_library")
 
+constraint_setting(
+    name = "executable_linking",
+    visibility = ["//visibility:public"],
+)
+
+constraint_value(
+    name = "fully_static_linking",
+    constraint_setting = ":executable_linking",
+    visibility = ["//visibility:public"],
+)
+
+platform(
+    name = "static_executable",
+    constraint_values = [":fully_static_linking"],
+    parents = ["@io_tweag_rules_nixpkgs//nixpkgs/platforms:host"],
+    visibility = ["//visibility:public"],
+)
+
+constraint_value(
+    name = "regular_linking",
+    constraint_setting = ":executable_linking",
+    visibility = ["//visibility:public"],
+)
+
+platform(
+    name = "regular_executable",
+    constraint_values = [":regular_linking"],
+    parents = ["@io_tweag_rules_nixpkgs//nixpkgs/platforms:host"],
+    visibility = ["//visibility:public"],
+)
+
 haskell_toolchain_library(name = "base")
 
 haskell_binary(
@@ -21,6 +52,10 @@ haskell_binary(
         "//frontend:src/theme.css",
         "//backend:src/schema.sql",
     ],
+    features = select({
+        "@//backend:regular_linking": [],
+        "@//backend:fully_static_linking": ["fully_static_link"],
+    }),
     ghcopts = [
         "-O2",
         "-Wall",
@@ -83,5 +118,8 @@ cc_library(
     srcs = [":src/import.cpp"],
     copts = copts,
     linkstatic = True,
-    deps = ["@sqlite.dev"],
+    deps = select({
+        "@//backend:regular_linking": ["@sqlite.dev"],
+        "@//backend:fully_static_linking": ["@sqlite.dev.static//:sqlite.dev"],
+    }),
 )

backend/sqlite.BUILD.bazel

@@ -2,7 +2,15 @@ load("@rules_cc//cc:defs.bzl", "cc_library")
 
 cc_library(
     name = "sqlite.dev",
-    srcs = glob(["lib/*.so*"]),
+    srcs = select({
+        "@//backend:regular_linking": glob(["lib/*.so*"]),
+        "@//backend:fully_static_linking": [
+            # No need to link anything for sqlite when building a fully static executable.
+            # The direct-sqlite Haskell library already links against it so we can just
+            # assume the appropriate symbols will already be available in the executable
+            # and let the linker sort it out.
+        ],
+    }),
     hdrs = glob(["include/*.h"]),
     strip_include_prefix = "include",
     visibility = ["//visibility:public"],

backend/zlib.BUILD.bazel

@@ -7,7 +7,10 @@ filegroup(
 )
 cc_library(
     name = "zlib",
-    srcs = ["@nixpkgs_zlib//:lib"],
+    srcs = select({
+        "@//backend:regular_linking": ["@nixpkgs_zlib//:lib"],
+        "@//backend:fully_static_linking": ["@nixpkgs_zlib.static//:lib"],
+    }),
     hdrs = [":include"],
     strip_include_prefix = "include",
     visibility = ["//visibility:public"],

static-nixpkgs.nix

@@ -0,0 +1,20 @@
+{...}@args:
+let
+  lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+  nixpkgs =
+    let
+      src = lock.nodes.nixpkgs.locked;
+    in
+    assert src.type == "github";
+    fetchTarball {
+      url = "https://github.com/${src.owner}/${src.repo}/archive/${src.rev}.tar.gz";
+      sha256 = src.narHash;
+    };
+  normalPkgs = import nixpkgs args;
+  static-haskell-nix =
+    fetchTarball {
+      url = "https://github.com/nh2/static-haskell-nix/archive/bd66b86b72cff4479e1c76d5916a853c38d09837.tar.gz";
+      sha256 = "sha256:0rnsxaw7v27znsg9lgqk1i4007ydqrc8gfgimrmhf24lv6galbjh";
+    };
+in
+(import "${static-haskell-nix}/survey" { inherit normalPkgs; }).pkgsWithArchiveFiles