Fix invidious env

modules/server/containers/apps/invidious.nix

@@ -13,7 +13,6 @@ let
     tag = pkgs.invidious.version;
     config = {
       Entrypoint = [ "${patchedInvidious}/bin/invidious" ];
-      Cmd = [ "--config" "/etc/invidious/config.yml" ];
       ExposedPorts = { "3000/tcp" = {}; };
     };
   };
@@ -21,6 +20,10 @@ let
 in {
   sops = true;
   db = true;
+  paths = [{
+    path="${serverCfg.configPath}/invidious";
+    mode = "0755";
+  }];
 
   containers = {
     server = builder.mkContainer {
@@ -28,48 +31,33 @@ in {
       imageStream = invidiousImage;
       port = 3000;
       secret = name;
-      extraEnv = {
-        INVIDIOUS_DATABASE_URL = "postgres://invidious_user:\${DB_PASS}@${builder.host}/invidious_db";
-        INVIDIOUS_HMAC_KEY = "\${HMAC_KEY}";
-        INVIDIOUS_COMPANION_URL = "http://invidious-companion:8282/companion";
-        INVIDIOUS_PO_TOKEN = "\${PO_TOKEN}";
-        INVIDIOUS_VISITOR_DATA = "\${VISITOR_DATA}";
-        INVIDIOUS_PORT = "3000";
-        INVIDIOUS_COMPANION_KEY = "\${INVIDIOUS_KEY}";
-        INVIDIOUS_DOMAIN = "${containerCfg.subdomain}.${serverCfg.domain}";
-        # INVIDIOUS_CONFIG: |
-        #     channel_threads: 1
-        #     check_tables: true
-        #     feed_threads: 1
-        #     hmac_key: 1058f1474503055f8663dd99dbae561b9a5b3f1e
-        #     db:
-        #       dbname: invidious
-        #       user: kemal
-        #       password: xXrmHRHXcZLF2yDhF2ER4LhZ7FDgW5fb
-        #       host: postgres_inv
-        #       port: 5432
-        #     full_refresh: false
-        #     https_only: true
-        #     domain: yt.helcel.net
-        #     external_port: 80
-        #     invidious_companion:
-        #     - private_url: "http://invidious-companion:8282/companion"
-        #     invidious_companion_key: "fee4cai"
-
-        #     visitor_data: CgtzS3RSVUN
-        #     po_token: MnR6UWTyMu4mYnppjHRmSLk
-        #registration_enabled: false
+      overrides = {
+        Cmd = [ "--config" "/data/config.yml" ];
+        volumes = [
+          "${serverCfg.configPath}/invidious:/data:ro"
+        ];
       };
     };
 
     companion = builder.mkContainer {
       image = "quay.io/invidious/invidious-companion:latest";
       port = 8282;
-        # - SERVER_SECRET_KEY=fee4caePhoVohjei
-        # cap_drop:
-        # - ALL
-      # security_opt:
-      #   - no-new-privileges:true
+      secret = name; #SERVER_SECRET_KEY = INVIDIOUS_COMPANION_KEY
+      extraOptions = [
+        "--cap-drop=all"
+        "--security-opt=no-new-privileges"
+      ];
     };
   };
+
+  setup = {
+    trigger = "server";
+    envFile = [ config.sops.secrets."INVIDIOUS".path config.sops.secrets."CUSTOM".path ];
+    script = pkgs.writeShellScript "setup" ''
+      export DB_HOST=${builder.host}
+      export INVIDIOUS_DOMAIN=${containerCfg.subdomain}.${serverCfg.domain}
+
+      ${pkgs.gettext}/bin/envsubst < "${../data/invidious/config.yml}" > "${serverCfg.configPath}/invidious/config.yml"
+    '';
+  };
 }

modules/server/containers/data/invidious/config.yml

@@ -0,0 +1,137 @@
+db:
+    user: invidious_user
+    password: $DB_PASSWORD
+    host: $DB_HOST
+    port: 5432
+    dbname: invidious_db
+
+#check_tables: false
+invidious_companion:
+    - private_url: "http://immich-companion:8282/companion"
+
+invidious_companion_key: $SERVER_SECRET_KEY
+port: 3000
+
+external_port: 443
+host_binding: 0.0.0.0
+domain: $INVIDIOUS_DOMAIN
+https_only: true
+#hsts: true
+
+## Accepted values: true, false, dash, livestreams, downloads, local
+#disable_proxy: false
+# use_innertube_for_captions: false
+
+# -----------------------------
+#  Features
+# -----------------------------
+
+popular_enabled: flase
+statistics_enabled: true
+registration_enabled: true
+login_enabled: true
+captcha_enabled: false
+admins: ["$DEFAULT_ADMIN_EMAIL"]
+enable_user_notifications: false
+
+# -----------------------------
+#  Background jobs
+# -----------------------------
+
+channel_threads: 1
+#channel_refresh_interval: 30m
+
+full_refresh: false
+feed_threads: 1
+
+jobs:
+    clear_expired_items:
+        enable: true
+    refresh_channels:
+        enable: true
+    refresh_feeds:
+        enable: true
+
+# -----------------------------
+#  Miscellaneous
+# -----------------------------
+
+#banner:
+use_pubsub_feeds: true
+
+hmac_key: $HMAC_KEY
+#dmca_content:
+#cache_annotations: false
+#modified_source_code_url: ""
+#playlist_length_limit: 500
+
+#########################################
+#
+#  Default user preferences
+#
+#########################################
+
+default_user_preferences:
+    # -----------------------------
+    #  Internationalization
+    # -----------------------------
+
+    #locale: en-US
+    #region: US
+    ## Top 3 preferred languages for video captions.
+    #captions: ["", "", ""]
+
+    # -----------------------------
+    #  Interface
+    # -----------------------------
+
+    dark_mode: "auto"
+    #thin_mode: false
+    feed_menu: ["Subscriptions", "Playlists"]
+    default_home: Subscriptions
+    #max_results: 40
+    #annotations: false
+    #annotations_subscribed: false
+    #comments: ["youtube", ""]
+    #player_style: invidious
+    #related_videos: true
+
+    # -----------------------------
+    #  Video player behavior
+    # -----------------------------
+
+    #preload: true
+    #autoplay: false
+    #continue: false
+    #continue_autoplay: true
+    #listen: false
+    #video_loop: false
+
+    # -----------------------------
+    #  Video playback settings
+    # -----------------------------
+
+    #quality: dash
+    #quality_dash: auto
+    #speed: 1.0
+    #volume: 100
+    #vr_mode: true
+    save_player_pos: true
+
+    # -----------------------------
+    #  Subscription feed
+    # -----------------------------
+
+    #latest_only: false
+    #notifications_only: false
+    unseen_only: true
+    #sort: published
+
+    # -----------------------------
+    #  Miscellaneous
+    # -----------------------------
+
+    #local: false
+    show_nick: false
+    #automatic_instance_redirect: false
+    #extend_desc: false