feat: package gatekeeper in this package set

Author: samrose

flake.lock

@@ -28,8 +28,10 @@
     git-hooks.inputs.nixpkgs.follows = "nixpkgs";
     nixpkgs-go124.url = "github:Nixos/nixpkgs/d2ac4dfa61fba987a84a0a81555da57ae0b9a2b0";
     nixpkgs-pgbackrest.url = "github:nixos/nixpkgs/nixos-unstable-small";
-    gatekeeper.url = "git+ssh://git@github.com/supabase/jit-db-gatekeeper?ref=sam/add-flake-parts&rev=34ba4a222c15b2480b837bbb3076508f36c9296f";
-    gatekeeper.inputs.nixpkgs.follows = "nixpkgs";
+    gatekeeper-src = {
+      url = "git+ssh://git@github.com/supabase/jit-db-gatekeeper?ref=sam/add-flake-parts&rev=34ba4a222c15b2480b837bbb3076508f36c9296f";
+      flake = false;
+    };
   };
 
   outputs =

flake.nix

@@ -35,7 +35,7 @@
         (old.postInstall or "")
         + ''
           mkdir -p $out/lib/security
-          cp ${final.gatekeeper}/lib/security/*.so $out/lib/security/
+          cp ${self.packages.${final.system}.gatekeeper}/lib/security/*.so $out/lib/security/
         '';
     });
   };

nix/overlays/default.nix

@@ -1,12 +1,47 @@
 { inputs, ... }:
 {
   perSystem =
-    { system, ... }:
+    { system, pkgs, ... }:
     let
-
       go124 = inputs.nixpkgs-go124.legacyPackages.${system}.go_1_24;
+      # Use completely clean nixpkgs without any overlays for gatekeeper
+      cleanPkgs = inputs.nixpkgs.legacyPackages.${system};
+      buildGoModule = cleanPkgs.buildGoModule.override { go = go124; };
     in
     {
-      packages.gatekeeper = inputs.gatekeeper.lib.${system}.makeGatekeeper { go = go124; };
+      packages.gatekeeper = buildGoModule {
+        pname = "gatekeeper";
+        version = "0.1.0";
+
+        src = inputs.gatekeeper-src;
+
+        vendorHash = "sha256-pdF+bhvZQwd2iSEHVtDAGihkYZGSaQaFdsF8MSrWuKQ=";
+
+        buildInputs =
+          [ cleanPkgs.pam ]
+          ++ cleanPkgs.lib.optionals cleanPkgs.stdenv.isDarwin [
+            cleanPkgs.darwin.apple_sdk.frameworks.Security
+          ];
+
+        buildPhase = ''
+          runHook preBuild
+          go build -buildmode=c-shared -o pam_jwt_pg.so
+          runHook postBuild
+        '';
+
+        installPhase = ''
+          runHook preInstall
+          mkdir -p $out/lib/security
+          cp pam_jwt_pg.so $out/lib/security/
+          runHook postInstall
+        '';
+
+        meta = with pkgs.lib; {
+          description = "PAM module for JWT authentication with PostgreSQL backend";
+          homepage = "https://github.com/supabase/jit-db-gatekeeper";
+          license = licenses.mit;
+          platforms = platforms.unix;
+        };
+      };
     };
 }