From e14571d029e0db8c7a2e0f192cac151d5ae80883 Mon Sep 17 00:00:00 2001
From: Erik Simon <mail@erik-s.dev>
Date: Sun, 23 Aug 2026 07:04:30 +0200
Subject: [PATCH] common: add jq to systemPackages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

jq was only ever on the `path` of the units that call it, so it was absent
from an interactive shell — which made the hook-migration commands in the
README unrunnable on the host they target. It is a general-purpose tool and
every host already carries curl, so it belongs alongside it rather than being
pulled in per-unit.

Also simplifies those README commands now that jq is present, and uses mars's
existing `hermes` alias instead of spelling out the podman exec.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S94o42aQ8VkBmEWvDem5xa
---
 README.md  | 16 +++++++++-------
 common.nix |  2 +-
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 4652c35..8482ec4 100644
--- a/README.md
+++ b/README.md
@@ -59,19 +59,21 @@ Retiring the pre-rename `gitea-events` route is therefore a one-off, done by
 hand after the first deploy of both hosts:
 
 ```
-# on mars — drop the old subscription
-sudo podman exec hermes-agent hermes webhook remove gitea-events
+# on mars — drop the old subscription (`hermes` is the alias in common.nix)
+hermes webhook remove gitea-events
 
 # on jupiter — delete the old hook (it posts to the relay's bare /gitea path)
 api=http://127.0.0.1:3000/api/v1; repo=darman/homelab
-tok="$(sudo cat /run/secrets/gitea_provisioning_token)"
-old="$(curl -fsS -H "Authorization: token $tok" "$api/repos/$repo/hooks" \
-  | jq -r '.[] | select(.config.url == "http://mars.orbit.sol:8645/gitea") | .id')"
-for id in $old; do
-  curl -fsS -H "Authorization: token $tok" -X DELETE "$api/repos/$repo/hooks/$id"
+auth=(-H "Authorization: token $(sudo cat /run/secrets/gitea_provisioning_token)")
+for id in $(curl -fsS "${auth[@]}" "$api/repos/$repo/hooks" \
+    | jq -r '.[] | select(.config.url == "http://mars.orbit.sol:8645/gitea") | .id'); do
+  curl -fsS "${auth[@]}" -X DELETE "$api/repos/$repo/hooks/$id"
 done
 ```
 
+Or just delete it in the web UI: repo Settings -> Webhooks, the entry whose
+URL ends in `:8645/gitea` with no route after it.
+
 Check `hermes webhook list` and the repo's webhook page afterwards; until the
 old hook is gone both it and the new one fire, so events arrive twice.
 
diff --git a/common.nix b/common.nix
index 3284006..32cf979 100644
--- a/common.nix
+++ b/common.nix
@@ -51,7 +51,7 @@
     options = "--delete-older-than 30d";
   };
 
-  environment.systemPackages = with pkgs; [ git btop tmux curl wget zsh-powerlevel10k lsd ];
+  environment.systemPackages = with pkgs; [ git btop tmux curl wget zsh-powerlevel10k lsd jq ];
 
   # ---- home-manager (user-level config for darman, all hosts) ----
   # Requires home-manager.nixosModules.home-manager in the host's own