diff --git a/hosts/fw/modules/web/default.nix b/hosts/fw/modules/web/default.nix index de51256..31e742c 100644 --- a/hosts/fw/modules/web/default.nix +++ b/hosts/fw/modules/web/default.nix @@ -61,9 +61,9 @@ in { ./proxies.nix # ./matrix.nix ./n8n.nix - ./piped.nix # Replaced by Invidious - # ./invidious.nix - # ./invidious-init-user.nix + # ./piped.nix # Replaced by Invidious + ./invidious.nix + ./invidious-init-user.nix ]; networkPrefix = config.networkPrefix; diff --git a/hosts/fw/modules/web/invidious.nix b/hosts/fw/modules/web/invidious.nix index 72b7114..0cf88a0 100644 --- a/hosts/fw/modules/web/invidious.nix +++ b/hosts/fw/modules/web/invidious.nix @@ -1,9 +1,15 @@ { config, pkgs, lib, ... }: +with lib; { # Invidious - Privacy-focused YouTube frontend # Replaces Piped with native NixOS service + # Secret for Invidious companion authentication + sops.secrets.invidious-companion-key = { + key = "invidious-companion-key"; + }; + # Main Invidious service services.invidious = { enable = true; @@ -52,6 +58,115 @@ }; }; + # Use Podman for OCI containers + virtualisation.oci-containers.backend = "podman"; + + # Create Invidious network for container communication + systemd.services.init-invidious-network = { + description = "Create Podman network for Invidious companion"; + wantedBy = [ "multi-user.target" ]; + before = [ "podman-invidious-companion.service" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + }; + script = '' + ${pkgs.podman}/bin/podman network exists invidious-net || \ + ${pkgs.podman}/bin/podman network create --interface-name=podman2 --subnet=10.90.0.0/24 invidious-net + ''; + }; + + # Create systemd tmpfiles directory for Invidious config + systemd.tmpfiles.rules = [ + "d /var/lib/invidious 0755 root root - -" + "d /run/invidious-companion 0700 root root - -" + ]; + + # Generate companion environment file with secret key + systemd.services.invidious-companion-env-generate = { + description = "Generate Invidious companion environment file"; + wantedBy = [ "multi-user.target" ]; + before = [ "podman-invidious-companion.service" ]; + after = [ "init-invidious-network.service" ]; + requires = [ "init-invidious-network.service" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + }; + script = '' + COMPANION_KEY=$(cat ${config.sops.secrets.invidious-companion-key.path}) + cat > /run/invidious-companion/env < /var/lib/invidious/companion-config.json <" + echo "Example: $0 6de059dca7cc9c053b56f26ff14edb77083fad73" + exit 1 +fi + +COMMIT_HASH="$1" + +# Validate commit hash format (basic check for 40-char hex or 7+ char short hash) +if ! [[ "$COMMIT_HASH" =~ ^[0-9a-f]{7,40}$ ]]; then + echo -e "${RED}Error: Invalid commit hash format${NC}" + echo "Commit hash must be 7-40 hexadecimal characters" + exit 1 +fi + +echo -e "${GREEN}==> Updating ai-mailer to commit: ${COMMIT_HASH}${NC}" + +# File to update +PKG_FILE="$REPO_ROOT/utils/pkgs/ai-mailer.nix" + +if [ ! -f "$PKG_FILE" ]; then + echo -e "${RED}Error: Package file not found: $PKG_FILE${NC}" + exit 1 +fi + +# Step 1: Update rev in package file +echo -e "${YELLOW}Step 1: Updating rev in package file...${NC}" +sed -i "s/rev = \"[0-9a-f]\{7,40\}\";/rev = \"$COMMIT_HASH\";/" "$PKG_FILE" +echo " ✓ Updated rev in $PKG_FILE" + +# Step 2: Set sha256 to lib.fakeHash to trigger hash discovery +echo -e "${YELLOW}Step 2: Setting sha256 to lib.fakeHash...${NC}" +sed -i 's/sha256 = "sha256-[^"]*";/sha256 = lib.fakeHash;/' "$PKG_FILE" +echo " ✓ Updated sha256 in $PKG_FILE" + +# Step 3: Build package to discover the correct source hash +echo -e "${YELLOW}Step 3: Building package to discover source hash...${NC}" +BUILD_OUTPUT=$(NIXPKGS_ALLOW_UNFREE=1 nix-build --impure -E "with import { config.allowUnfree = true; }; callPackage $PKG_FILE { }" 2>&1 || true) + +# Extract source hash from error message +SOURCE_HASH=$(echo "$BUILD_OUTPUT" | grep -oP '\s+got:\s+\Ksha256-[A-Za-z0-9+/=]+' | head -1) + +if [ -z "$SOURCE_HASH" ]; then + echo -e "${RED}Error: Failed to extract source hash from build output${NC}" + echo "Build output:" + echo "$BUILD_OUTPUT" + exit 1 +fi + +echo " ✓ Discovered sha256: $SOURCE_HASH" + +# Step 4: Update package file with the correct source hash +echo -e "${YELLOW}Step 4: Updating sha256 in package file...${NC}" +sed -i "s|sha256 = lib\.fakeHash;|sha256 = \"$SOURCE_HASH\";|" "$PKG_FILE" +echo " ✓ Updated sha256 in $PKG_FILE" + +# Step 5: Set vendorHash to lib.fakeHash to trigger hash discovery +echo -e "${YELLOW}Step 5: Setting vendorHash to lib.fakeHash...${NC}" +sed -i 's/vendorHash = "sha256-[^"]*";/vendorHash = lib.fakeHash;/' "$PKG_FILE" +echo " ✓ Updated vendorHash in $PKG_FILE" + +# Step 6: Build package to discover the correct vendor hash +echo -e "${YELLOW}Step 6: Building package to discover vendor hash...${NC}" +BUILD_OUTPUT=$(NIXPKGS_ALLOW_UNFREE=1 nix-build --impure -E "with import { config.allowUnfree = true; }; callPackage $PKG_FILE { }" 2>&1 || true) + +# Extract vendor hash from error message +VENDOR_HASH=$(echo "$BUILD_OUTPUT" | grep -oP '\s+got:\s+\Ksha256-[A-Za-z0-9+/=]+' | head -1) + +if [ -z "$VENDOR_HASH" ]; then + echo -e "${RED}Error: Failed to extract vendor hash from build output${NC}" + echo "Build output:" + echo "$BUILD_OUTPUT" + exit 1 +fi + +echo " ✓ Discovered vendorHash: $VENDOR_HASH" + +# Step 7: Update package file with the correct vendor hash +echo -e "${YELLOW}Step 7: Updating vendorHash in package file...${NC}" +sed -i "s|vendorHash = lib\.fakeHash;|vendorHash = \"$VENDOR_HASH\";|" "$PKG_FILE" +echo " ✓ Updated vendorHash in $PKG_FILE" + +# Step 8: Verify the build succeeds +echo -e "${YELLOW}Step 8: Verifying build with correct hashes...${NC}" +if NIXPKGS_ALLOW_UNFREE=1 nix-build --impure -E "with import { config.allowUnfree = true; }; callPackage $PKG_FILE { }" > /dev/null 2>&1; then + echo " ✓ Build verification successful" +else + echo -e "${RED}Error: Build verification failed${NC}" + exit 1 +fi + +# Step 9: Test configuration for fw host (which uses ai-mailer) +echo -e "${YELLOW}Step 9: Testing fw configuration...${NC}" +cd "$REPO_ROOT" +if ./scripts/test-configuration fw > /dev/null 2>&1; then + echo " ✓ Configuration test passed" +else + echo -e "${RED}Warning: Configuration test failed${NC}" + echo "This may be due to missing secrets or other issues unrelated to the hash update." +fi + +# Success summary +echo -e "${GREEN}" +echo "======================================" +echo "✓ ai-mailer updated successfully!" +echo "======================================" +echo "Commit: $COMMIT_HASH" +echo "SourceHash: $SOURCE_HASH" +echo "VendorHash: $VENDOR_HASH" +echo -e "${NC}" +echo "Next steps:" +echo " 1. Review changes: git diff $PKG_FILE" +echo " 2. Test locally if needed" +echo " 3. Commit changes: git add $PKG_FILE && git commit -m 'update: ai-mailer to $COMMIT_HASH'" +echo " 4. Push to trigger automatic deployment" diff --git a/utils/pkgs/ai-mailer.nix b/utils/pkgs/ai-mailer.nix index eb10d82..9cefb34 100644 --- a/utils/pkgs/ai-mailer.nix +++ b/utils/pkgs/ai-mailer.nix @@ -6,8 +6,8 @@ buildGoModule rec { src = fetchgit { url = "https://git.cloonar.com/Paraclub/ai-mailer.git"; - rev = "56c9f764fcea2834fefac28f446b86c52f3274bd"; - sha256 = "sha256-zOabK0OWh0iHEL0kMC74i4rYnUlry57dGQE4k/wqDG0="; + rev = "6de059dca7cc9c053b56f26ff14edb77083fad73"; + sha256 = "sha256-EPW0yLu1XHejEsU25ACO5FjxxCneVMlLmy1ZEHYqFtQ="; }; vendorHash = "sha256-h4RaB891GXAkgObZHYil6BOvbYp6yJSRxRj40Fhchmw=";