fix: filebot

hosts/fw/modules/pyload/default.nix

@@ -2,7 +2,6 @@
 let
   cids = import ../staticids.nix;
   networkPrefix = config.networkPrefix;
-  filebotScript = pkgs.callPackage ./filebot-process.nix {};
 
   pyloadUser = {
     isSystemUser = true;
@@ -46,17 +45,8 @@ in
     # PyLoad hook scripts directory
     "d /var/lib/pyload/config 0755 pyload pyload - -"
     "d /var/lib/pyload/config/scripts 0755 pyload pyload - -"
-    "d /var/lib/pyload/config/scripts/package_extracted 0755 pyload pyload - -"
-    "L+ /var/lib/pyload/config/scripts/package_extracted/filebot-process.sh - - - - ${filebotScript}/bin/filebot-process"
   ];
 
-  # FileBot license secret
-  sops.secrets.filebot-license = {
-    mode = "0440";
-    owner = "pyload";
-    group = "pyload";
-  };
-
   containers.pyload = {
     autoStart = true;
     ephemeral = false;
@@ -106,10 +96,6 @@ in
         hostPath = "/var/lib/multimedia";
         isReadOnly = false;
       };
-      "/var/lib/pyload/filebot-license.psm" = {
-        hostPath = config.sops.secrets.filebot-license.path;
-        isReadOnly = true;
-      };
     };
 
     config = { lib, config, pkgs, ... }: {
@@ -124,7 +110,6 @@ in
 
       nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
         "unrar"
-        "filebot"
       ];
 
       networking = {

hosts/fw/modules/pyload/filebot-process.nix

@@ -1,89 +0,0 @@
-{ pkgs }:
-
-pkgs.writeShellScriptBin "filebot-process" ''
-  #!/usr/bin/env bash
-  set -euo pipefail
-
-  # FileBot AMC script for automated media organization
-  # Called by PyLoad's package_extracted hook with parameters:
-  # $1 = package_id
-  # $2 = package_name
-  # $3 = download_folder (actual path to extracted files)
-  # $4 = password (optional)
-
-  PACKAGE_ID="''${1:-}"
-  PACKAGE_NAME="''${2:-unknown}"
-  DOWNLOAD_DIR="''${3:-/downloads}"
-  PASSWORD="''${4:-}"
-
-  OUTPUT_DIR="/multimedia"
-  LOG_FILE="/var/lib/pyload/filebot-amc.log"
-  EXCLUDE_LIST="/var/lib/pyload/filebot-exclude-list.txt"
-
-  # Ensure FileBot data directory exists
-  mkdir -p /var/lib/pyload/.local/share/filebot/data
-  mkdir -p "$(dirname "$LOG_FILE")"
-  touch "$EXCLUDE_LIST"
-
-  # Install FileBot license if not already installed
-  if [ ! -f /var/lib/pyload/.local/share/filebot/data/.license ]; then
-    echo "$(date): Installing FileBot license..." >> "$LOG_FILE"
-    ${pkgs.filebot}/bin/filebot --license /var/lib/pyload/filebot-license.psm || true
-  fi
-
-  echo "===========================================" >> "$LOG_FILE"
-  echo "$(date): PyLoad package extracted hook triggered" >> "$LOG_FILE"
-  echo "Package ID: $PACKAGE_ID" >> "$LOG_FILE"
-  echo "Package Name: $PACKAGE_NAME" >> "$LOG_FILE"
-  echo "Download Directory: $DOWNLOAD_DIR" >> "$LOG_FILE"
-  echo "===========================================" >> "$LOG_FILE"
-
-  # Check if download directory exists and has media files
-  if [ ! -d "$DOWNLOAD_DIR" ]; then
-    echo "$(date): Download directory does not exist: $DOWNLOAD_DIR" >> "$LOG_FILE"
-    exit 0
-  fi
-
-  # Check if there are any video/media files to process
-  if ! find "$DOWNLOAD_DIR" -type f \( -iname "*.mkv" -o -iname "*.mp4" -o -iname "*.avi" -o -iname "*.m4v" -o -iname "*.mov" \) -print -quit | grep -q .; then
-    echo "$(date): No media files found in: $DOWNLOAD_DIR" >> "$LOG_FILE"
-    echo "$(date): Skipping FileBot processing" >> "$LOG_FILE"
-    exit 0
-  fi
-
-  echo "$(date): Starting FileBot processing" >> "$LOG_FILE"
-
-  # Run FileBot AMC script
-  set +e  # Temporarily disable exit on error to capture exit code
-  ${pkgs.filebot}/bin/filebot \
-    -script fn:amc \
-    --output "$OUTPUT_DIR" \
-    --action move \
-    --conflict auto \
-    -non-strict \
-    --log-file "$LOG_FILE" \
-    --def \
-      excludeList="$EXCLUDE_LIST" \
-      movieFormat="$OUTPUT_DIR/movies/{n} ({y})/{n} ({y}) - {vf}" \
-      seriesFormat="$OUTPUT_DIR/tv-shows/{n}/Season {s.pad(2)}/{n} - {s00e00} - {t}" \
-      ut_dir="$DOWNLOAD_DIR" \
-      ut_kind=multi \
-      clean=y \
-      skipExtract=y
-
-  FILEBOT_EXIT_CODE=$?
-  set -e  # Re-enable exit on error
-
-  if [ $FILEBOT_EXIT_CODE -ne 0 ]; then
-    echo "$(date): FileBot processing failed with exit code $FILEBOT_EXIT_CODE" >> "$LOG_FILE"
-    exit 0  # Don't fail the hook even if FileBot fails
-  fi
-
-  echo "$(date): FileBot processing completed successfully" >> "$LOG_FILE"
-
-  # Clean up any remaining empty directories
-  find "$DOWNLOAD_DIR" -type d -empty -delete 2>/dev/null || true
-
-  echo "$(date): All processing completed" >> "$LOG_FILE"
-  exit 0
-''

hosts/fw/modules/pyload/pyload.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, ... }:
+{ pkgs, ... }:
 {
   environment.systemPackages = with pkgs; [
     unrar # Required for RAR archive extraction
@@ -50,20 +50,6 @@
         "/etc/ssl"
         "/etc/static/ssl"
       ];
-      # Bind mount multimedia directory as writable for FileBot hook scripts
-      BindPaths = [ "/multimedia" ];
-
-      # Override SystemCallFilter to allow @resources syscalls
-      # FileBot (Java) needs resource management syscalls like setpriority
-      # during cleanup operations. Still block privileged syscalls for security.
-      # Use mkForce to completely replace the NixOS module's default filter.
-      SystemCallFilter = lib.mkForce [
-        "@system-service"
-        "@resources"       # Explicitly allow resource management syscalls
-        "~@privileged"     # Still block privileged operations
-        "fchown"           # Re-allow fchown for FileBot file operations
-        "fchown32"         # 32-bit compatibility
-      ];
     };
   };
 }

hosts/fw/modules/staticids.nix

@@ -7,7 +7,6 @@
     foundry-vtt = 10005;
     pyload = 10006;
     jellyfin = 10007;
-    filebot = 10008;
     forgejo = 10009;
   };
   gids = {
@@ -18,7 +17,6 @@
     foundry-vtt = 10005;
     pyload = 10006;
     jellyfin = 10007;
-    filebot = 10008;
     forgejo = 10009;
   };
 }

utils/overlays/packages.nix

@@ -7,6 +7,7 @@ self: super: {
   ai-mailer = self.callPackage ../pkgs/ai-mailer.nix { };
   mautrix-mattermost = self.callPackage ../pkgs/mautrix-mattermost { };
   claude-code = self.callPackage ../pkgs/claude-code { claude-code = super.claude-code; };
+  filebot = self.callPackage ../pkgs/filebot { filebot = super.filebot; };
 
   # Python packages
   python3 = super.python3.override {
@@ -46,13 +47,15 @@ self: super: {
     in
     super.invidious.overrideAttrs (oldAttrs: {
       inherit version src;
-      postPatch = let
+      postPatch =
+        let
           branchTemplate = ''{{ "#{`git branch | sed -n '/* /s///p'`.strip}" }}'';
           commitTemplate = ''{{ "#{`git rev-list HEAD --max-count=1 --abbrev-commit`.strip}" }}'';
           versionTemplate = ''{{ "#{`git log -1 --format=%ci | awk '{print $1}' | sed s/-/./g`.strip}" }}'';
           tagTemplate = ''{{ "#{`git tag --points-at HEAD`.strip}" }}'';
           assetCommitTemplate = ''{{ "#{`git rev-list HEAD --max-count=1 --abbrev-commit -- assets`.strip}" }}'';
-      in ''
+        in
+        ''
           for d in ${videojs}/*; do ln -s "$d" assets/videojs; done
 
           substituteInPlace src/invidious.cr \

utils/pkgs/filebot/default.nix

@@ -0,0 +1,15 @@
+{ fetchurl, filebot }:
+
+# Override the nixpkgs filebot source URL.
+#
+# Upstream nixpkgs fetches from a single web.archive.org mirror which started
+# returning HTTP 429, breaking builds. The same tarball is still hosted at
+# get.filebot.net, so we swap the URL. The hash matches nixpkgs' pinned one
+# because archive.org captured a byte-identical copy. Run ./update.sh to
+# refresh if upstream re-uploads.
+filebot.overrideAttrs (oldAttrs: {
+  src = fetchurl {
+    url = "https://get.filebot.net/filebot/FileBot_${oldAttrs.version}/FileBot_${oldAttrs.version}-portable.tar.xz";
+    hash = "sha256-OcXXKaZcBuP584SJWeQB+aaxO0kih6Oiud0Vm8e9kPo=";
+  };
+})

utils/pkgs/filebot/update.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl cacert nix
+
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+# Discover latest upstream version (same logic as nixpkgs' genericUpdater).
+echo "Fetching latest FileBot version from filebot.net..."
+version=$(curl -fsSL https://www.filebot.net \
+  | sed -rne 's,^.*FileBot_([0-9]+\.[0-9]+\.[0-9]+)-portable\.tar\.xz.*,\1,p' \
+  | sort -uV | tail -n1)
+
+# Allow pinning: ./update.sh --version 5.2.0
+if [ "${1:-}" = "--version" ] && [ -n "${2:-}" ]; then
+  version="$2"
+fi
+
+if [ -z "${version:-}" ]; then
+  echo "Error: could not determine FileBot version" >&2
+  exit 1
+fi
+echo "Version: $version"
+
+url="https://get.filebot.net/filebot/FileBot_${version}/FileBot_${version}-portable.tar.xz"
+hash=$(nix-prefetch-url --type sha256 "$url")
+sri_hash=$(nix-hash --type sha256 --to-sri "$hash")
+echo "SRI hash: $sri_hash"
+
+sed -i "s|hash = \"sha256-[A-Za-z0-9+/=]\{43,\}=\";|hash = \"$sri_hash\";|" default.nix
+
+echo "Updated utils/pkgs/filebot/default.nix -> $sri_hash"