hosts/jupiter/secrets.nix

@@ -43,15 +43,11 @@
     owner = "gitea";
   };
 
-  # SABnzbd credentials (web UI login, API keys, eweka.nl usenet server) —
-  # migrated off the reused ini in services/media/sabnzbd.nix into
-  # services.sabnzbd.settings + secretValues. sabnzbd_api_key predates this
-  # migration (provisioned for mediamanager's future use, services/experimental/
-  # mediamanager.nix — not currently imported by any host); reused here as the
-  # same single source of truth rather than duplicating it.
-  # owner = sabnzbd: the module's preStart (replace-secret) runs as the
-  # service's own User=/Group=, and sops secrets default to root:root 0400 —
-  # without this, replace-secret gets Permission denied reading /run/secrets.
+  # SABnzbd credentials (web UI login, API keys, eweka.nl usenet server) for
+  # services/media/sabnzbd.nix; sabnzbd_api_key is shared with
+  # services/experimental/mediamanager.nix rather than duplicated.
+  # owner = sabnzbd because the module's preStart runs as that user, and sops secrets
+  # default to root:root 0400.
   sops.secrets.sabnzbd_web_username.owner = "sabnzbd";
   sops.secrets.sabnzbd_web_password.owner = "sabnzbd";
   sops.secrets.sabnzbd_api_key.owner = "sabnzbd";

services/dev/gitea-pr-comment-filter.py

@@ -1,48 +0,0 @@
-#!/usr/bin/env python3
-"""Keep external comments on the agent's own Gitea pull requests."""
-from __future__ import annotations
-
-import json
-import os
-import sys
-
-AGENT_USERNAME = os.environ.get("GITEA_AGENT_USERNAME", "luna")
-
-
-def login(user: object) -> str:
-    if not isinstance(user, dict):
-        return ""
-    return str(user.get("login") or user.get("username") or "")
-
-
-def main() -> int:
-    try:
-        payload = json.load(sys.stdin)
-    except (json.JSONDecodeError, OSError):
-        return 1
-
-    if not isinstance(payload, dict):
-        return 1
-
-    pull_request = payload.get("pull_request")
-    comment = payload.get("comment")
-    if not isinstance(pull_request, dict) or not isinstance(comment, dict):
-        # Fail closed: only PR comment payloads for the agent's own PRs should
-        # wake the route.
-        return 0
-
-    if login(pull_request.get("user")) != AGENT_USERNAME:
-        return 0
-
-    # Do not wake Hermes for its own reply, which would otherwise create a
-    # comment -> run -> comment loop.
-    if login(comment.get("user")) == AGENT_USERNAME:
-        return 0
-
-    json.dump(payload, sys.stdout, ensure_ascii=False, separators=(",", ":"))
-    sys.stdout.write("\n")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())