initial commit

2026-02-06 13:52:54 +01:00
commit e74b485510
10 changed files with 851 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,4 @@
+result
+result-*
+.direnv
+/.envrc
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -0,0 +1,195 @@
+# AGENTS.md
+
+Guide for AI coding agents working in this repository.
+
+## Project Overview
+
+This is a **pure Nix flake** project that exposes custom Nix packages, a development
+shell, checks, and a nixpkgs overlay. All source files are written in the **Nix
+expression language** (`.nix` files). There is no traditional programming language
+involved -- this is purely Nix infrastructure/packaging code.
+
+## Repository Structure
+
+```
+flake.nix              # Main flake entry point (inputs, outputs, nixConfig)
+flake.lock             # Pinned flake dependency versions
+.envrc                 # direnv integration ("use flake")
+.gitignore             # Ignores result, result-*, .direnv
+pkgs/
+  default.nix          # Package set aggregator (barrel file)
+  example-a/default.nix
+  example-b/default.nix
+checks/
+  default.nix          # Flake checks (formatting enforcement)
+devshells/
+  default.nix          # Development shell with tooling
+overlays/
+  default.nix          # Nixpkgs overlay re-exporting packages
+```
+
+Every directory uses `default.nix` as its entry point -- this is the Nix equivalent
+of index/barrel files. The top-level `flake.nix` imports each module via
+`import ./pkgs`, `import ./checks`, etc.
+
+## Build / Check / Format Commands
+
+```sh
+# Build the default package
+nix build
+
+# Build a specific package
+nix build .#example-a
+nix build .#example-b
+
+# Run all flake checks (currently: formatting validation)
+nix flake check
+
+# Format all Nix files (MUST pass before committing)
+nixfmt flake.nix pkgs checks devshells overlays
+
+# Check formatting without modifying files
+nixfmt --check flake.nix pkgs checks devshells overlays
+
+# Enter the development shell (provides nixfmt, nil, nix-tree)
+nix develop
+
+# View the dependency tree of a package
+nix-tree .#example-a
+
+# Update flake inputs
+nix flake update
+```
+
+### Testing
+
+There are no unit/integration tests. The only check is **formatting validation**
+via `nix flake check`, which runs `nixfmt --check` against all `.nix` files.
+Always run `nix flake check` before committing to ensure formatting is correct.
+
+## Code Style Guidelines
+
+### Formatter
+
+**`nixfmt-rfc-style`** is enforced via `nix flake check`. Always format files with
+`nixfmt` before committing. The formatter is available in the dev shell.
+
+### Indentation and Whitespace
+
+- **2 spaces** for indentation (no tabs)
+- Opening brace on the same line as context
+- Trailing semicolons on all attribute definitions
+
+### Naming Conventions
+
+| Entity              | Convention     | Examples                              |
+|---------------------|----------------|---------------------------------------|
+| Files / directories | `kebab-case`   | `example-a`, `example-b`             |
+| Entry point files   | `default.nix`  | Always `default.nix` per directory    |
+| Attributes/variables| `camelCase`    | `installPhase`, `buildInputs`         |
+| Package names       | `kebab-case`   | `example-a`, `nixfmt-rfc-style`      |
+
+### Function Parameters
+
+Always list parameters **one per line** with a trailing comma, enclosed in braces:
+
+```nix
+{
+  lib,
+  stdenv,
+}:
+```
+
+### Imports and Dependency Injection
+
+- Use **relative path imports**: `import ./pkgs { inherit pkgs; }`
+- Pass dependencies via **function arguments** (dependency injection), never globals
+- Use `inherit` to concisely forward bindings: `{ inherit pkgs system; }`
+- Use `pkgs.callPackage` to auto-inject dependencies into package definitions
+
+### Package Definition Template
+
+Every package follows this pattern:
+
+```nix
+{
+  lib,
+  stdenv,
+}:
+stdenv.mkDerivation {
+  pname = "package-name";
+  version = "0.1.0";
+  src = ./.;
+
+  installPhase = ''
+    # build/install commands
+  '';
+
+  meta = {
+    description = "Short description of the package";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+  };
+}
+```
+
+### Module / Barrel File Pattern
+
+Aggregator files (`pkgs/default.nix`) collect sub-packages and define a default:
+
+```nix
+{ pkgs }:
+let
+  self = {
+    example-a = pkgs.callPackage ./example-a { };
+    example-b = pkgs.callPackage ./example-b { };
+  };
+in
+self // { default = self.example-a; }
+```
+
+### Overlay Pattern
+
+Overlays use `inherit` to selectively re-export packages:
+
+```nix
+final: prev:
+let
+  customPkgs = import ../pkgs { pkgs = final; };
+in
+{
+  inherit (customPkgs) example-a example-b;
+}
+```
+
+### Comments
+
+- Prefer **self-documenting code** via `description` attributes in `meta` blocks
+- Inline comments are used sparingly and only when the intent is non-obvious
+- No JSDoc or similar documentation patterns -- Nix is declarative
+
+### Error Handling
+
+- Nix is a purely functional language; errors are build-time evaluation failures
+- Use `assert` for preconditions when needed
+- Use `lib.warn` or `lib.info` for non-fatal diagnostics
+- Use `builtins.throw` for fatal errors with descriptive messages
+
+### Flake Outputs
+
+Follow the standard flake output schema:
+
+- `packages.<system>.<name>` -- built packages
+- `packages.<system>.default` -- the default package
+- `devShells.<system>.default` -- development shell
+- `checks.<system>.<name>` -- CI checks
+- `overlays.default` -- nixpkgs overlay
+
+The flake uses `flake-utils.lib.eachDefaultSystem` for multi-platform support.
+
+## Dev Environment
+
+- **direnv** auto-activates the dev shell (`.envrc` contains `use flake`)
+- **nil** (Nix LSP) is available in the dev shell for editor integration
+- **nix-tree** is available for inspecting dependency trees
+- Binary cache: `nix-community.cachix.org` is configured as an extra substituter
--- a/checks/default.nix
+++ b/checks/default.nix
@@ -0,0 +1,8 @@
+{ pkgs }:
+{
+  formatting = pkgs.runCommand "check-formatting" { buildInputs = [ pkgs.nixfmt-rfc-style ]; } ''
+    cd ${./..}
+    nixfmt --check flake.nix pkgs checks devshells overlays
+    touch $out
+  '';
+}
--- a/devshells/default.nix
+++ b/devshells/default.nix
@@ -0,0 +1,27 @@
+
+{
+  pkgs,
+  system,
+  jailed-agents,
+  mcp-servers,
+}:
+pkgs.mkShell {
+  packages =
+    with pkgs;
+    [
+      nixfmt-rfc-style
+      nil
+      nix-tree
+      (jailed-agents.lib.${system}.makeJailed system {
+        agentTool = "opencode";
+        extraPkgs =
+          (with pkgs; [ mcp-nixos ])
+          ++ (with mcp-servers.packages.${system}; [ duckduckgo-mcp-server ]);
+      })
+    ];
+
+  shellHook = ''
+    echo "Nix packages development environment"
+    echo "Available tools: nixfmt-rfc-style, nil, nix-tree, opencode (jailed agent)"
+  '';
+}
--- a/flake.lock
+++ b/flake.lock
@@ -0,0 +1,496 @@
+{
+  "nodes": {
+    "blueprint": {
+      "inputs": {
+        "nixpkgs": [
+          "jailed-agents",
+          "llm-agents",
+          "nixpkgs"
+        ],
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1769353768,
+        "narHash": "sha256-zI+7cbMI4wMIR57jMjDSEsVb3grapTnURDxxJPYFIW0=",
+        "owner": "numtide",
+        "repo": "blueprint",
+        "rev": "c7da5c70ad1c9b60b6f5d4f674fbe205d48d8f6c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "blueprint",
+        "type": "github"
+      }
+    },
+    "blueprint_2": {
+      "inputs": {
+        "nixpkgs": [
+          "mcp-servers",
+          "jailed-agents",
+          "llm-agents",
+          "nixpkgs"
+        ],
+        "systems": "systems_6"
+      },
+      "locked": {
+        "lastModified": 1769353768,
+        "narHash": "sha256-zI+7cbMI4wMIR57jMjDSEsVb3grapTnURDxxJPYFIW0=",
+        "owner": "numtide",
+        "repo": "blueprint",
+        "rev": "c7da5c70ad1c9b60b6f5d4f674fbe205d48d8f6c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "blueprint",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_3": {
+      "inputs": {
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_4": {
+      "inputs": {
+        "systems": "systems_5"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "jail-nix": {
+      "locked": {
+        "lastModified": 1765903853,
+        "narHash": "sha256-buoPpx7moJzAXbLuHAImn6x9fGRdk3x0T57goPv1vnc=",
+        "owner": "~alexdavid",
+        "repo": "jail.nix",
+        "rev": "bf9f49c8118e7a77b68a675dbe26e93e91412066",
+        "type": "sourcehut"
+      },
+      "original": {
+        "owner": "~alexdavid",
+        "repo": "jail.nix",
+        "type": "sourcehut"
+      }
+    },
+    "jail-nix_2": {
+      "locked": {
+        "lastModified": 1765903853,
+        "narHash": "sha256-buoPpx7moJzAXbLuHAImn6x9fGRdk3x0T57goPv1vnc=",
+        "owner": "~alexdavid",
+        "repo": "jail.nix",
+        "rev": "bf9f49c8118e7a77b68a675dbe26e93e91412066",
+        "type": "sourcehut"
+      },
+      "original": {
+        "owner": "~alexdavid",
+        "repo": "jail.nix",
+        "type": "sourcehut"
+      }
+    },
+    "jailed-agents": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "jail-nix": "jail-nix",
+        "llm-agents": "llm-agents",
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1770246631,
+        "narHash": "sha256-a44ePXknnnWC7B3r8D4XgvypAdJ0hSfkBXuvRC/3j7M=",
+        "ref": "refs/heads/main",
+        "rev": "fc658b4112f5d924a038d5a3699eae3917371654",
+        "revCount": 6,
+        "type": "git",
+        "url": "ssh://gitea@gitea.bueso.eu/luis/jailed-agents"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@gitea.bueso.eu/luis/jailed-agents"
+      }
+    },
+    "jailed-agents_2": {
+      "inputs": {
+        "flake-utils": "flake-utils_4",
+        "jail-nix": "jail-nix_2",
+        "llm-agents": "llm-agents_2",
+        "nixpkgs": "nixpkgs_4"
+      },
+      "locked": {
+        "lastModified": 1770110471,
+        "narHash": "sha256-oAbwoCzhq/skEKzaPTtzCh1Eix2fwfsE2aJmpJZZhx8=",
+        "ref": "refs/heads/main",
+        "rev": "9cfc57d6a605466ed9a359abcaee86b4ec9f62e0",
+        "revCount": 2,
+        "type": "git",
+        "url": "ssh://gitea@gitea.bueso.eu/luis/jailed-agents"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@gitea.bueso.eu/luis/jailed-agents"
+      }
+    },
+    "llm-agents": {
+      "inputs": {
+        "blueprint": "blueprint",
+        "nixpkgs": "nixpkgs",
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1769813338,
+        "narHash": "sha256-IlRKon8+bfoi/uOa8CUPAAWW0Pv6AHBSF1jVSD4QO8U=",
+        "owner": "numtide",
+        "repo": "llm-agents.nix",
+        "rev": "58939415e56d01c30d429cf0c49a9d8e2a6a07c3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "llm-agents.nix",
+        "type": "github"
+      }
+    },
+    "llm-agents_2": {
+      "inputs": {
+        "blueprint": "blueprint_2",
+        "nixpkgs": "nixpkgs_3",
+        "treefmt-nix": "treefmt-nix_2"
+      },
+      "locked": {
+        "lastModified": 1769813338,
+        "narHash": "sha256-IlRKon8+bfoi/uOa8CUPAAWW0Pv6AHBSF1jVSD4QO8U=",
+        "owner": "numtide",
+        "repo": "llm-agents.nix",
+        "rev": "58939415e56d01c30d429cf0c49a9d8e2a6a07c3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "llm-agents.nix",
+        "type": "github"
+      }
+    },
+    "mcp-servers": {
+      "inputs": {
+        "flake-utils": "flake-utils_3",
+        "jailed-agents": "jailed-agents_2",
+        "nixpkgs": "nixpkgs_5"
+      },
+      "locked": {
+        "lastModified": 1770307561,
+        "narHash": "sha256-02lZaoZMUOLISczahZHuEwSlMQ5aIX1plUN59ifdu38=",
+        "ref": "refs/heads/main",
+        "rev": "734bf103018687943a63d301b569dc3b3d6bf7fe",
+        "revCount": 16,
+        "type": "git",
+        "url": "ssh://gitea@gitea.bueso.eu/luis/mcp-servers"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@gitea.bueso.eu/luis/mcp-servers"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1769740369,
+        "narHash": "sha256-xKPyJoMoXfXpDM5DFDZDsi9PHArf2k5BJjvReYXoFpM=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "6308c3b21396534d8aaeac46179c14c439a89b8a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1769461804,
+        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1769740369,
+        "narHash": "sha256-xKPyJoMoXfXpDM5DFDZDsi9PHArf2k5BJjvReYXoFpM=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "6308c3b21396534d8aaeac46179c14c439a89b8a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1769461804,
+        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1770181073,
+        "narHash": "sha256-ksTL7P9QC1WfZasNlaAdLOzqD8x5EPyods69YBqxSfk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "bf922a59c5c9998a6584645f7d0de689512e444c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1770169770,
+        "narHash": "sha256-awR8qIwJxJJiOmcEGgP2KUqYmHG4v/z8XpL9z8FnT1A=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "aa290c9891fa4ebe88f8889e59633d20cc06a5f2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "jailed-agents": "jailed-agents",
+        "mcp-servers": "mcp-servers",
+        "nixpkgs": "nixpkgs_6"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_5": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_6": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "jailed-agents",
+          "llm-agents",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769691507,
+        "narHash": "sha256-8aAYwyVzSSwIhP2glDhw/G0i5+wOrren3v6WmxkVonM=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "28b19c5844cc6e2257801d43f2772a4b4c050a1b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "mcp-servers",
+          "jailed-agents",
+          "llm-agents",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769691507,
+        "narHash": "sha256-8aAYwyVzSSwIhP2glDhw/G0i5+wOrren3v6WmxkVonM=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "28b19c5844cc6e2257801d43f2772a4b4c050a1b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
--- a/flake.nix
+++ b/flake.nix
@@ -0,0 +1,48 @@
+{
+  nixConfig = {
+    extra-substituters = [
+      "https://nix-community.cachix.org"
+    ];
+    extra-trusted-public-keys = [
+      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+    ];
+  };
+
+  description = "A flake for exposing custom Nix packages";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+    jailed-agents.url = "git+ssh://gitea@gitea.bueso.eu/luis/jailed-agents";
+    mcp-servers.url = "git+ssh://gitea@gitea.bueso.eu/luis/mcp-servers";
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+      jailed-agents,
+      mcp-servers,
+    }:
+    flake-utils.lib.eachDefaultSystem (
+      system:
+      let
+        pkgs = nixpkgs.legacyPackages.${system};
+      in
+      {
+        packages = import ./pkgs { inherit pkgs; };
+
+        devShells.default = import ./devshells {
+          inherit pkgs system;
+          jailed-agents = jailed-agents;
+          mcp-servers = mcp-servers;
+        };
+
+        checks = import ./checks { inherit pkgs; };
+      }
+    )
+    // {
+      overlays.default = import ./overlays;
+    };
+}
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -0,0 +1,7 @@
+final: prev:
+let
+  packages = import ../pkgs { pkgs = prev; };
+in
+{
+  inherit (packages) example-a example-b;
+}
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -0,0 +1,8 @@
+{ pkgs }:
+let
+  self = {
+    example-a = pkgs.callPackage ./example-a { };
+    example-b = pkgs.callPackage ./example-b { };
+  };
+in
+self // { default = self.example-a; }
--- a/pkgs/example-a/default.nix
+++ b/pkgs/example-a/default.nix
@@ -0,0 +1,29 @@
+
+{
+  lib,
+  stdenv,
+}:
+
+stdenv.mkDerivation {
+  pname = "example-a";
+  version = "0.1.0";
+
+  src = ./.;
+
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cat > $out/bin/example-a << 'EOF'
+    #!/bin/sh
+    echo "Hello from example-a!"
+    EOF
+    chmod +x $out/bin/example-a
+  '';
+
+  meta = {
+    description = "Example package A";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/example-b/default.nix
+++ b/pkgs/example-b/default.nix
@@ -0,0 +1,29 @@
+
+{
+  lib,
+  stdenv,
+}:
+
+stdenv.mkDerivation {
+  pname = "example-b";
+  version = "0.1.0";
+
+  src = ./.;
+
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cat > $out/bin/example-b << 'EOF'
+    #!/bin/sh
+    echo "Hello from example-b!"
+    EOF
+    chmod +x $out/bin/example-b
+  '';
+
+  meta = {
+    description = "Example package B";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+  };
+}