Use stable Rust in Nix builds (#617)

* switch toolchain back

* flake.lock: Update

Flake lock file updates:

• Updated input 'crane':
    'github:ipetkov/crane/ef80ead953c1b28316cc3f8613904edc2eb90c28' (2024-11-08)
  → 'github:ipetkov/crane/76d64e779e2fbaf172110038492343a8c4e29b55' (2024-12-01)
• Updated input 'devenv':
    'github:cachix/devenv/9f6cadacb9db82f541bbadd67e0189a2b850937e' (2024-11-15)
  → 'github:cachix/devenv/2c928a199d56191d7a53f29ccafa56238c8ce4e5' (2024-11-29)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/dc460ec76cbff0e66e269457d7b728432263166c' (2024-11-11)
  → 'github:nixos/nixpkgs/ac35b104800bff9028425fec3b6e8a41de2bbfff' (2024-12-01)
• Updated input 'rust-overlay':
    'github:oxalica/rust-overlay/db10c66da18e816030b884388545add8cf096647' (2024-11-15)
  → 'github:oxalica/rust-overlay/e66c0d43abf5bdefb664c3583ca8994983c332ae' (2024-12-02)

* add ca certificates to docker image

* exclude mrfs from nix builds

flake.nix

@@ -53,12 +53,12 @@
             pkgs = import nixpkgs { inherit overlays system; };
             stdenv = pkgs.stdenvAdapters.useMoldLinker pkgs.stdenv;
             rustPlatform = pkgs.makeRustPlatform {
-              cargo = pkgs.rust-bin.nightly.latest.minimal;
-              rustc = pkgs.rust-bin.nightly.latest.minimal;
+              cargo = pkgs.rust-bin.stable.latest.minimal;
+              rustc = pkgs.rust-bin.stable.latest.minimal;
               inherit stdenv;
             };
 
-            craneLib = (crane.mkLib pkgs).overrideToolchain pkgs.rust-bin.nightly.latest.minimal;
+            craneLib = (crane.mkLib pkgs).overrideToolchain pkgs.rust-bin.stable.latest.minimal;
             buildInputs = with pkgs; [
             ];
 
@@ -76,6 +76,11 @@
             };
 
             commonArgs =
+              let
+                excludedPkgs = [ "example-mrf" "http-client-test" ];
+                buildExcludeParam = pkgs.lib.strings.concatMapStringsSep " " (pkgName: "--exclude ${pkgName}");
+                excludeParam = buildExcludeParam excludedPkgs;
+              in
               {
                 inherit
                   src
@@ -93,7 +98,7 @@
 
                 NIX_OUTPATH_USED_AS_RANDOM_SEED = "aaaaaaaaaa";
                 CARGO_PROFILE = "dist";
-                cargoExtraArgs = "--locked ${features}";
+                cargoExtraArgs = "--locked ${features} --workspace ${excludeParam}";
               }
               // (pkgs.lib.optionalAttrs inputs.debugBuild.value {
                 # do a debug build, as `dev` is the default debug profile
@@ -108,6 +113,7 @@
               // {
                 pname = "kitsune-workspace";
                 src = craneLib.cleanCargoSource src;
+                doCheck = false;
               }
             );
           in
@@ -131,7 +137,7 @@
               cli-docker = pkgs.dockerTools.buildLayeredImage {
                 name = "kitsune-cli";
                 tag = "latest";
-                contents = [ cli ];
+                contents = [ pkgs.dockerTools.caCertificates cli ];
                 config.Cmd = [ "${cli}/bin/kitsune-cli" ];
               };
 
@@ -148,7 +154,7 @@
               job-runner-docker = pkgs.dockerTools.buildLayeredImage {
                 name = "kitsune-job-runner";
                 tag = "latest";
-                contents = [ job-runner ];
+                contents = [ pkgs.dockerTools.caCertificates job-runner ];
                 config.Cmd = [ "${job-runner}/bin/kitsune-job-runner" ];
               };
 
@@ -182,7 +188,7 @@
               main-docker = pkgs.dockerTools.buildLayeredImage {
                 name = "kitsune";
                 tag = "latest";
-                contents = [ main ];
+                contents = [ pkgs.dockerTools.caCertificates main ];
                 config.Cmd = [ "${main}/bin/kitsune" ];
               };
 
@@ -218,7 +224,7 @@
                         [
                           cargo-insta
                           diesel-cli
-                          rust-bin.nightly.latest.default
+                          rust-bin.stable.latest.default
                         ]
                         ++ buildInputs
                         ++ nativeBuildInputs;