darmanandClaude Sonnet 5
6f24ab69ad
Comments had drifted into multi-paragraph narrative (git commit lineage, debugging stories, restated code) in several hot spots (scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix). Trim every comment to its load-bearing "why" — gotchas, safety warnings, and non-obvious rationale survive verbatim in substance, just tightened to 1-2 sentences; historical narrative and anything already covered in CLAUDE.md is cut. No code/logic changed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21
39 lines
1.5 KiB
Nix
39 lines
1.5 KiB
Nix
{ config, ... }:
|
|
|
|
# Cinephage — indexer search + streaming/library manager, run as the official
|
|
# container image rather than upstream's nix flake module (its npmDepsHash is
|
|
# stale and a transitive dep hard-enforces pnpm, breaking the sandboxed npm
|
|
# build). BETTER_AUTH_SECRET (paired sops secret, hosts/jupiter/secrets.nix)
|
|
# signs sessions and encrypts stored API keys — keep it static, since losing
|
|
# it invalidates everything.
|
|
{
|
|
virtualisation.oci-containers.containers.cinephage = {
|
|
image = "ghcr.io/moldytaint/cinephage:latest";
|
|
autoStart = true;
|
|
# Host networking, not a published port: cinephage needs to reach
|
|
# Prowlarr/SABnzbd on jupiter's own localhost (they're native systemd
|
|
# services, not containers) — bridge-mode "localhost" would be the
|
|
# container's own netns, not the host's.
|
|
extraOptions = [ "--network=host" ];
|
|
volumes = [
|
|
"/mnt/data/AppData/cinephage:/config"
|
|
"/mnt/data/HighSeas:/media"
|
|
"/mnt/data/HighSeas/Downloads:/downloads"
|
|
];
|
|
environment = {
|
|
PUID = "1000";
|
|
PGID = "100"; # darman:users — matches HighSeas' real on-disk ownership
|
|
TZ = "Europe/Berlin";
|
|
ORIGIN = "http://cinephage.jupiter.sol";
|
|
};
|
|
environmentFiles = [ config.sops.templates."cinephage.env".path ];
|
|
};
|
|
|
|
sops.templates."cinephage.env".content =
|
|
"BETTER_AUTH_SECRET=${config.sops.placeholder.cinephage_better_auth_secret}";
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /mnt/data/AppData/cinephage 0755 darman users -"
|
|
];
|
|
}
|