build(nix): pin the Rust toolchain to 1.97.1 via rust-overlay

nixpkgs 26.05 ships rustc 1.95.0, but this crate was developed and verified on
1.97.1 (what CachyOS had, installed 2026-07-17). Taking the compiler from
oxalica/rust-overlay decouples "which Rust the project targets" from "which
release the audio stack came from", so a nixpkgs bump can no longer move the
compiler under the lint gate as a side effect.

Chosen over rustup, which would also have worked here (nix-ld is enabled, so
its prebuilt binaries run) and would have let one rust-toolchain.toml cover the
packaging distroboxes too. The deciding factor is purity: rustup records
nothing in flake.lock, so a fresh clone or darp5 would resolve whatever it
fetched that day. rust-overlay gives the same exact-version control with the
choice pinned in the lock.

`.default` is the rustup "default" profile — rustc, cargo, rust-std, rustfmt
and clippy — so those are no longer listed individually. No windows-gnu target
here: pixelpass is Linux-only, unlike peerspeak.

Verified on 1.97.1: 256 tests pass, fmt clean, and `cargo clippy --all-targets
-- -D warnings` is clean.

.gitignore

@@ -1 +1,7 @@
 /target
+
+# Nix: the symlink `nix build` drops, and direnv's local cache. flake.nix and
+# flake.lock ARE tracked — the lock is what pins the toolchain.
+/result
+/result-*
+/.direnv/

flake.lock

@@ -0,0 +1,48 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1785989512,
+        "narHash": "sha256-HFQhkQcl5D1hUNoen3SGHCSFCt2Bg6uP+HgbrnA3InQ=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "445d861c6d31b4af0c79d8d4be2331f762a361d7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786076960,
+        "narHash": "sha256-jfR6OhwurCKn1tREyfOcK/Omxf1Q/DzDDFbnEr1mBLs=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "57a23bfaf4f7017267294b161175db1e32eb1c85",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,147 @@
+{
+  description = "PixelPass — P2P screen sharing CLI over iroh";
+
+  inputs = {
+    # Same channel the hosts run (nixos-config tracks nixos-26.05). The capture
+    # path talks to the live PipeWire daemon and the system PulseAudio server,
+    # so the client libraries here should come from the same release the server
+    # did.
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
+
+    # The Rust toolchain is pinned SEPARATELY from the system libraries, so a
+    # nixpkgs bump cannot move the compiler under the lint gate. nixpkgs 26.05
+    # ships 1.95.0; this crate was developed and verified on 1.97.1, and
+    # peerspeak — the sibling project this one is built against — has a clippy
+    # lint that differs between exactly those two versions. Keeping both repos
+    # on one pinned compiler means a check that passes here passes there.
+    #
+    # This is the reproducible alternative to rustup: the same exact-version
+    # control, but recorded in flake.lock, so a fresh clone resolves the
+    # identical toolchain rather than whatever rustup fetches that day.
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    { nixpkgs, rust-overlay, ... }:
+    let
+      system = "x86_64-linux";
+      pkgs = import nixpkgs {
+        inherit system;
+        overlays = [ rust-overlay.overlays.default ];
+      };
+
+      # Matches what CachyOS shipped (rust 1:1.97.1-1) and what peerspeak pins.
+      # `default` is the rustup "default" profile — rustc, cargo, rust-std,
+      # rustfmt and clippy — so those are NOT listed separately below. No
+      # windows-gnu target here: pixelpass is Linux-only (portal/PipeWire/X11
+      # capture), unlike peerspeak which has a Windows port.
+      rustToolchain = pkgs.rust-bin.stable."1.97.1".default;
+
+      # GStreamer is driven as a SUBPROCESS (gst-launch-1.0 / gst-inspect-1.0),
+      # not linked — there is no gstreamer-sys in Cargo.lock. So these are PATH
+      # dependencies at runtime rather than build inputs, and `deps.rs` refuses
+      # to start a share if any are missing.
+      gstPlugins = with pkgs; [
+        gst_all_1.gstreamer # gst-launch-1.0 / gst-inspect-1.0
+        gst_all_1.gst-plugins-base # videoscale (quality-preset downscale)
+        gst_all_1.gst-plugins-good # pulsesrc, ximagesrc
+        gst_all_1.gst-plugins-bad # h264parse, mpegtsmux, aacparse, vah264enc
+        gst_all_1.gst-plugins-ugly # x264enc (software-encode fallback)
+        gst_all_1.gst-libav # avenc_aac
+        pipewire # pipewiresrc (Wayland capture; ships in this pkg)
+      ];
+
+      # Opened with dlopen by the optional `--gui` front end (eframe/egui_glow/
+      # winit/glutin), never linked. Harmless for the default headless build.
+      guiRuntimeLibs = with pkgs; [
+        libGL
+        libxkbcommon
+        wayland
+        libx11
+        libxcursor
+        libxrandr
+        libxi
+      ];
+    in
+    {
+      devShells.${system}.default = pkgs.mkShell {
+        nativeBuildInputs =
+          [ rustToolchain ]
+          ++ (with pkgs; [
+            # Debian packaging (`cargo deb --no-build`). Build the binary
+            # inside a Debian/Ubuntu distrobox first so it links that distro's
+            # glibc — see the packaging notes in Cargo.toml.
+            cargo-deb
+
+            pkg-config
+
+            # pipewire-sys, libspa-sys and libpulse-sys all generate bindings
+            # with bindgen, which needs a real libclang at build time.
+            clang
+          ])
+          ++ gstPlugins
+          ++ [
+            # The rest of what `deps::check_host_binaries` looks for.
+            pkgs.pulseaudio # `pactl` (PipeWire stays the actual audio server)
+            pkgs.mpv # the viewer-side player
+            pkgs.xwininfo # the `--window` click-picker on X11
+
+            # `--doctor` shells out to vainfo to confirm the VA-API H.264
+            # ENCODE entrypoint really exists. Without it the report can only
+            # say "vah264enc and a render node are present" and has to leave
+            # hardware encode unconfirmed — which matters, because a GPU
+            # missing that entrypoint produces no video at all under the
+            # default encoder rather than failing loudly.
+            pkgs.libva-utils
+          ];
+
+        buildInputs =
+          with pkgs;
+          [
+            pipewire # pipewire-sys + libspa-sys
+            libpulseaudio # libpulse-sys: --repair reads/unloads Pulse modules
+
+            # x11rb is declared `default-features = false` here, which by itself
+            # is pure Rust — but Cargo unifies features across the graph, and
+            # arboard pulls x11rb with its `libxcb` feature on. That drags in
+            # as-raw-xcb-connection and makes the final link need -lxcb. It is a
+            # real link-time dependency of the binary, not an optional extra.
+            libxcb
+          ]
+          ++ guiRuntimeLibs;
+
+        # bindgen finds libclang through this variable specifically — having
+        # clang on PATH is not sufficient.
+        LIBCLANG_PATH = "${pkgs.llvmPackages.libclang.lib}/lib";
+
+        # NixOS keeps every GStreamer plugin in its own store path, so
+        # gst-launch-1.0 discovers them ONLY through this search path. Without
+        # it, pixelpass's `gst-inspect-1.0 --exists pipewiresrc` preflight fails
+        # even though the plugins are installed. Same reasoning as the
+        # GST_PLUGIN_SYSTEM_PATH_1_0 block in nixos-config hosts/darp5.
+        GST_PLUGIN_SYSTEM_PATH_1_0 = pkgs.lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gstPlugins;
+
+        LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath guiRuntimeLibs;
+
+        # Only greet an interactive shell. shellHook also runs under
+        # `nix develop --command …`, where printing this would interleave the
+        # banner with the command's own output (and corrupt it outright for
+        # anything whose stdout is parsed, such as pixelpass's `--output json`).
+        shellHook = ''
+          if [ -t 1 ]; then
+            echo "pixelpass — rustc $(rustc --version | cut -d' ' -f2) / cargo $(cargo --version | cut -d' ' -f2)"
+            echo "  cargo build --release                 headless build (what peerspeak spawns)"
+            echo "  cargo build --release --features gui  with the egui front end"
+            echo "  cargo test                            unit + integration tests"
+            echo "  ./target/debug/pixelpass --doctor     verify this machine can host"
+            echo
+            echo "GStreamer, pactl, mpv and xwininfo are on PATH in this shell, so"
+            echo "capture works here without a system rebuild."
+          fi
+        '';
+      };
+    };
+}