feat: add invidious

hosts/fw/modules/web/invidious.nix

@@ -0,0 +1,60 @@
+{ config, pkgs, lib, ... }:
+
+{
+  # Invidious - Privacy-focused YouTube frontend
+  # Replaces Piped with native NixOS service
+
+  # Main Invidious service
+  services.invidious = {
+    enable = true;
+    domain = "invidious.cloonar.com";
+    port = 3000;
+
+    # PostgreSQL database configuration
+    database = {
+      createLocally = true;
+    };
+
+    # Enable nginx reverse proxy with automatic TLS
+    nginx.enable = true;
+
+    # Signature helper disabled - crashes with current YouTube player patterns
+    # Re-enable once inv-sig-helper is updated to handle new YouTube obfuscation
+    # sig-helper = {
+    #   enable = true;
+    # };
+
+    # Service settings
+    settings = {
+      # Disable registration - admin user created via init script
+      registration_enabled = false;
+
+      # Disable CAPTCHA (not needed for private instance)
+      captcha_enabled = false;
+
+      # Database configuration
+      check_tables = true;
+      db = {
+        user = "invidious";
+        dbname = "invidious";
+      };
+
+      # Optional: Instance customization
+      default_home = "Popular";
+      feed_menu = [ "Popular" "Trending" "Subscriptions" ];
+    };
+  };
+
+  # Override nginx vhost configuration
+  services.nginx.virtualHosts."invidious.cloonar.com" = {
+    acmeRoot = null;
+  };
+
+  # Firewall configuration for Invidious
+  # (nginx handles external access on ports 80/443)
+
+  # PostgreSQL backup for Invidious database
+  services.postgresqlBackup = {
+    databases = [ "invidious" ];
+  };
+}