nix: add flake (crane + fenix) and nix-build CI on push to main

flake.nix provides a pure-Rust crane build (no C deps, unlike fin): the
squeezed package/app, a dev shell, and flake checks (clippy with -D warnings,
rustfmt, cargo-audit against advisory-db, nextest, and tarpaulin coverage on
x86_64-linux). Systems are listed explicitly (x86_64-linux, aarch64-linux,
aarch64-darwin) since nixpkgs-unstable dropped x86_64-darwin.

Add .github/workflows/nix.yml running `nix build .#default` and `nix flake
check` on push to main/master, pull requests, and manual dispatch.

Author: tsirysndr

.github/workflows/nix.yml

@@ -0,0 +1,30 @@
+name: Nix
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  nix-build:
+    name: nix build & flake checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v27
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      - name: Build package
+        run: nix build .#default -L
+
+      - name: Flake checks (clippy, fmt, audit, tests)
+        run: nix flake check -L

flake.lock

@@ -0,0 +1,143 @@
+{
+  description = "squeezed - serve a raw PCM audio stream to Squeezelite/Squeezebox clients over SlimProto";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+    # Current crane doesn't expose a `nixpkgs` input, so we don't follow it.
+    crane.url = "github:ipetkov/crane";
+
+    fenix = {
+      url = "github:nix-community/fenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.rust-analyzer-src.follows = "";
+    };
+
+    flake-utils.url = "github:numtide/flake-utils";
+
+    advisory-db = {
+      url = "github:rustsec/advisory-db";
+      flake = false;
+    };
+  };
+
+  outputs = { self, nixpkgs, crane, fenix, flake-utils, advisory-db, ... }:
+    # nixpkgs-unstable has dropped x86_64-darwin (EOL Intel macOS), so we list
+    # the currently-supported systems explicitly rather than eachDefaultSystem.
+    flake-utils.lib.eachSystem [
+      "x86_64-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+    ] (system:
+      let
+        pkgs = import nixpkgs {
+          inherit system;
+        };
+
+        inherit (pkgs) lib;
+
+        craneLib = crane.mkLib pkgs;
+
+        src = craneLib.cleanCargoSource ./.;
+
+        # squeezed is pure Rust — no C dependencies, no openssl, no pkg-config.
+        # The default stdenv toolchain (for linking) is all that's needed, so
+        # there are no extra native/build inputs.
+        commonArgs = {
+          inherit src;
+
+          pname = "squeezed";
+          version = "0.1.0";
+          strictDeps = true;
+
+          # Single-package crate with one bin target — build just that.
+          cargoExtraArgs = "--locked --bin squeezed";
+        };
+
+        craneLibLLvmTools = craneLib.overrideToolchain
+          (fenix.packages.${system}.complete.withComponents [
+            "cargo"
+            "llvm-tools"
+            "rustc"
+          ]);
+
+        # Cache the dependency graph separately from the crate source.
+        cargoArtifacts = craneLib.buildDepsOnly commonArgs;
+
+        squeezed = craneLib.buildPackage (commonArgs // {
+          inherit cargoArtifacts;
+          doCheck = false;
+
+          meta = {
+            description = "Serve a raw PCM audio stream to Squeezelite/Squeezebox clients over SlimProto";
+            homepage = "https://github.com/tsirysndr/squeezed";
+            license = lib.licenses.mit;
+            mainProgram = "squeezed";
+            platforms = lib.platforms.unix;
+          };
+        });
+
+      in
+      {
+        checks = {
+          inherit squeezed;
+
+          squeezed-clippy = craneLib.cargoClippy (commonArgs // {
+            inherit cargoArtifacts;
+            cargoClippyExtraArgs = "--all-targets -- --deny warnings";
+          });
+
+          squeezed-doc = craneLib.cargoDoc (commonArgs // {
+            inherit cargoArtifacts;
+          });
+
+          squeezed-fmt = craneLib.cargoFmt {
+            inherit src;
+          };
+
+          squeezed-audit = craneLib.cargoAudit {
+            inherit src advisory-db;
+          };
+
+          squeezed-nextest = craneLib.cargoNextest (commonArgs // {
+            inherit cargoArtifacts;
+            partitions = 1;
+            partitionType = "count";
+          });
+        } // lib.optionalAttrs (system == "x86_64-linux") {
+          squeezed-coverage = craneLib.cargoTarpaulin (commonArgs // {
+            inherit cargoArtifacts;
+          });
+        };
+
+        packages = {
+          default = squeezed;
+          squeezed = squeezed;
+
+          squeezed-llvm-coverage = craneLibLLvmTools.cargoLlvmCov (commonArgs // {
+            inherit cargoArtifacts;
+          });
+        };
+
+        apps.default = flake-utils.lib.mkApp {
+          drv = squeezed;
+          name = "squeezed";
+        };
+
+        devShells.default = pkgs.mkShell {
+          inputsFrom = builtins.attrValues self.checks.${system};
+
+          nativeBuildInputs = with pkgs; [
+            cargo
+            rustc
+            rustfmt
+            clippy
+            rust-analyzer
+          ];
+
+          shellHook = ''
+            echo "🔊 squeezed dev shell — $(cargo --version)"
+          '';
+        };
+      });
+}