diff --git a/hosts/fw/modules/web/default.nix b/hosts/fw/modules/web/default.nix index 31e742c..de51256 100644 --- a/hosts/fw/modules/web/default.nix +++ b/hosts/fw/modules/web/default.nix @@ -61,9 +61,9 @@ in { ./proxies.nix # ./matrix.nix ./n8n.nix - # ./piped.nix # Replaced by Invidious - ./invidious.nix - ./invidious-init-user.nix + ./piped.nix # Replaced by Invidious + # ./invidious.nix + # ./invidious-init-user.nix ]; networkPrefix = config.networkPrefix; diff --git a/hosts/fw/modules/web/invidious.nix b/hosts/fw/modules/web/invidious.nix index 0cf88a0..72b7114 100644 --- a/hosts/fw/modules/web/invidious.nix +++ b/hosts/fw/modules/web/invidious.nix @@ -1,15 +1,9 @@ { config, pkgs, lib, ... }: -with lib; { # Invidious - Privacy-focused YouTube frontend # Replaces Piped with native NixOS service - # Secret for Invidious companion authentication - sops.secrets.invidious-companion-key = { - key = "invidious-companion-key"; - }; - # Main Invidious service services.invidious = { enable = true; @@ -58,115 +52,6 @@ with lib; }; }; - # Use Podman for OCI containers - virtualisation.oci-containers.backend = "podman"; - - # Create Invidious network for container communication - systemd.services.init-invidious-network = { - description = "Create Podman network for Invidious companion"; - wantedBy = [ "multi-user.target" ]; - before = [ "podman-invidious-companion.service" ]; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - }; - script = '' - ${pkgs.podman}/bin/podman network exists invidious-net || \ - ${pkgs.podman}/bin/podman network create --interface-name=podman2 --subnet=10.90.0.0/24 invidious-net - ''; - }; - - # Create systemd tmpfiles directory for Invidious config - systemd.tmpfiles.rules = [ - "d /var/lib/invidious 0755 root root - -" - "d /run/invidious-companion 0700 root root - -" - ]; - - # Generate companion environment file with secret key - systemd.services.invidious-companion-env-generate = { - description = "Generate Invidious companion environment file"; - wantedBy = [ "multi-user.target" ]; - before = [ "podman-invidious-companion.service" ]; - after = [ "init-invidious-network.service" ]; - requires = [ "init-invidious-network.service" ]; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - }; - script = '' - COMPANION_KEY=$(cat ${config.sops.secrets.invidious-companion-key.path}) - cat > /run/invidious-companion/env < /var/lib/invidious/companion-config.json <" - echo "Example: $0 6de059dca7cc9c053b56f26ff14edb77083fad73" - exit 1 -fi - -COMMIT_HASH="$1" - -# Validate commit hash format (basic check for 40-char hex or 7+ char short hash) -if ! [[ "$COMMIT_HASH" =~ ^[0-9a-f]{7,40}$ ]]; then - echo -e "${RED}Error: Invalid commit hash format${NC}" - echo "Commit hash must be 7-40 hexadecimal characters" - exit 1 -fi - -echo -e "${GREEN}==> Updating ai-mailer to commit: ${COMMIT_HASH}${NC}" - -# File to update -PKG_FILE="$REPO_ROOT/utils/pkgs/ai-mailer.nix" - -if [ ! -f "$PKG_FILE" ]; then - echo -e "${RED}Error: Package file not found: $PKG_FILE${NC}" - exit 1 -fi - -# Step 1: Update rev in package file -echo -e "${YELLOW}Step 1: Updating rev in package file...${NC}" -sed -i "s/rev = \"[0-9a-f]\{7,40\}\";/rev = \"$COMMIT_HASH\";/" "$PKG_FILE" -echo " ✓ Updated rev in $PKG_FILE" - -# Step 2: Set sha256 to lib.fakeHash to trigger hash discovery -echo -e "${YELLOW}Step 2: Setting sha256 to lib.fakeHash...${NC}" -sed -i 's/sha256 = "sha256-[^"]*";/sha256 = lib.fakeHash;/' "$PKG_FILE" -echo " ✓ Updated sha256 in $PKG_FILE" - -# Step 3: Build package to discover the correct source hash -echo -e "${YELLOW}Step 3: Building package to discover source hash...${NC}" -BUILD_OUTPUT=$(NIXPKGS_ALLOW_UNFREE=1 nix-build --impure -E "with import { config.allowUnfree = true; }; callPackage $PKG_FILE { }" 2>&1 || true) - -# Extract source hash from error message -SOURCE_HASH=$(echo "$BUILD_OUTPUT" | grep -oP '\s+got:\s+\Ksha256-[A-Za-z0-9+/=]+' | head -1) - -if [ -z "$SOURCE_HASH" ]; then - echo -e "${RED}Error: Failed to extract source hash from build output${NC}" - echo "Build output:" - echo "$BUILD_OUTPUT" - exit 1 -fi - -echo " ✓ Discovered sha256: $SOURCE_HASH" - -# Step 4: Update package file with the correct source hash -echo -e "${YELLOW}Step 4: Updating sha256 in package file...${NC}" -sed -i "s|sha256 = lib\.fakeHash;|sha256 = \"$SOURCE_HASH\";|" "$PKG_FILE" -echo " ✓ Updated sha256 in $PKG_FILE" - -# Step 5: Set vendorHash to lib.fakeHash to trigger hash discovery -echo -e "${YELLOW}Step 5: Setting vendorHash to lib.fakeHash...${NC}" -sed -i 's/vendorHash = "sha256-[^"]*";/vendorHash = lib.fakeHash;/' "$PKG_FILE" -echo " ✓ Updated vendorHash in $PKG_FILE" - -# Step 6: Build package to discover the correct vendor hash -echo -e "${YELLOW}Step 6: Building package to discover vendor hash...${NC}" -BUILD_OUTPUT=$(NIXPKGS_ALLOW_UNFREE=1 nix-build --impure -E "with import { config.allowUnfree = true; }; callPackage $PKG_FILE { }" 2>&1 || true) - -# Extract vendor hash from error message -VENDOR_HASH=$(echo "$BUILD_OUTPUT" | grep -oP '\s+got:\s+\Ksha256-[A-Za-z0-9+/=]+' | head -1) - -if [ -z "$VENDOR_HASH" ]; then - echo -e "${RED}Error: Failed to extract vendor hash from build output${NC}" - echo "Build output:" - echo "$BUILD_OUTPUT" - exit 1 -fi - -echo " ✓ Discovered vendorHash: $VENDOR_HASH" - -# Step 7: Update package file with the correct vendor hash -echo -e "${YELLOW}Step 7: Updating vendorHash in package file...${NC}" -sed -i "s|vendorHash = lib\.fakeHash;|vendorHash = \"$VENDOR_HASH\";|" "$PKG_FILE" -echo " ✓ Updated vendorHash in $PKG_FILE" - -# Step 8: Verify the build succeeds -echo -e "${YELLOW}Step 8: Verifying build with correct hashes...${NC}" -if NIXPKGS_ALLOW_UNFREE=1 nix-build --impure -E "with import { config.allowUnfree = true; }; callPackage $PKG_FILE { }" > /dev/null 2>&1; then - echo " ✓ Build verification successful" -else - echo -e "${RED}Error: Build verification failed${NC}" - exit 1 -fi - -# Step 9: Test configuration for fw host (which uses ai-mailer) -echo -e "${YELLOW}Step 9: Testing fw configuration...${NC}" -cd "$REPO_ROOT" -if ./scripts/test-configuration fw > /dev/null 2>&1; then - echo " ✓ Configuration test passed" -else - echo -e "${RED}Warning: Configuration test failed${NC}" - echo "This may be due to missing secrets or other issues unrelated to the hash update." -fi - -# Success summary -echo -e "${GREEN}" -echo "======================================" -echo "✓ ai-mailer updated successfully!" -echo "======================================" -echo "Commit: $COMMIT_HASH" -echo "SourceHash: $SOURCE_HASH" -echo "VendorHash: $VENDOR_HASH" -echo -e "${NC}" -echo "Next steps:" -echo " 1. Review changes: git diff $PKG_FILE" -echo " 2. Test locally if needed" -echo " 3. Commit changes: git add $PKG_FILE && git commit -m 'update: ai-mailer to $COMMIT_HASH'" -echo " 4. Push to trigger automatic deployment" diff --git a/utils/pkgs/ai-mailer.nix b/utils/pkgs/ai-mailer.nix index 9cefb34..eb10d82 100644 --- a/utils/pkgs/ai-mailer.nix +++ b/utils/pkgs/ai-mailer.nix @@ -6,8 +6,8 @@ buildGoModule rec { src = fetchgit { url = "https://git.cloonar.com/Paraclub/ai-mailer.git"; - rev = "6de059dca7cc9c053b56f26ff14edb77083fad73"; - sha256 = "sha256-EPW0yLu1XHejEsU25ACO5FjxxCneVMlLmy1ZEHYqFtQ="; + rev = "56c9f764fcea2834fefac28f446b86c52f3274bd"; + sha256 = "sha256-zOabK0OWh0iHEL0kMC74i4rYnUlry57dGQE4k/wqDG0="; }; vendorHash = "sha256-h4RaB891GXAkgObZHYil6BOvbYp6yJSRxRj40Fhchmw=";