.envrc

# Dev tools from the flake's devShell (which wraps web-session).
# nix-direnv caches the evaluation so reload is fast.
# NOTE: bazelisk reads .bazelversion and auto-downloads the correct Bazel version.
# "bazel" wrapper script (exec's bazelisk) is defined in nix/home/home.nix via writeShellScriptBin.
use flake

# Force Bazel to use system GCC instead of Nix GCC for C/C++ compilation.
#
# Problem: rules_rust downloads its own rustc binary (built for generic Linux,
# uses system glibc at /lib64/ld-linux-x86-64.so.2). But Bazel auto-detects
# Nix's GCC as the C toolchain, which links binaries with Nix's glibc
# (/nix/store/.../ld-linux-x86-64.so.2).
#
# When rustc compiles a proc-macro crate (like thiserror_impl), it uses Nix GCC
# to link the .so file. Then when rustc tries to dlopen() that proc-macro, it
# fails because the .so expects Nix glibc but rustc's runtime uses system glibc.
#
# Error looks like: "error[E0463]: can't find crate for `thiserror_impl`"
#
# Fix: Force CC to system GCC so linked binaries match what rustc expects.
#
# Trade-off: This breaks building Python native extensions (like pycairo) locally
# because pip/meson use /usr/bin/gcc (links system glibc) but the shell runtime
# has Nix's glibc loaded, causing "undefined symbol: __tunable_is_initialized".
# Packages with native deps (gterm_theme) use tags=["manual"]
# and build in GitHub CI instead.
# export CC=/usr/bin/gcc

# Bazel's hermetic Python (python-build-standalone) has OpenSSL compiled with
# default cert paths for standard Linux (/etc/ssl/cert.pem). NixOS doesn't have
# that file — certs live at /etc/ssl/certs/ca-certificates.crt instead.
# SSL_CERT_FILE tells OpenSSL where to find the CA bundle at runtime.
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt