create update scripts, use universal manifest (#257)

* create update scripts, use universal manifest

* update other universal plugin locations

* fix some things, pin jellyfin stable

* create root update script

* run update scripts when updating flake.lock

* retain yaml whitespace

Author: kiriwalawren

.github/workflows/ci.yml

@@ -1,9 +1,11 @@
 name: CI
+
 on:
   pull_request:
   push:
     branches:
       - main
+
 jobs:
   prepare:
     name: Find Checks 🔍
@@ -12,19 +14,23 @@ jobs:
       checks: ${{ steps.checks.outputs.checks }}
     steps:
       - uses: actions/checkout@v7
+
       - name: Install Nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
+
       - name: Setup Cachix
         uses: cachix/cachix-action@v17
         with:
           name: kiriwalawren
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
       - name: Find Checks 🔍
         id: checks
         run: |
           nix eval --json '.#checks.x86_64-linux' --apply builtins.attrNames | perl -pe 's|(.*)|checks=\1|' >> $GITHUB_OUTPUT
+
   checks:
     name: ${{ matrix.check }}
     needs: prepare
@@ -35,21 +41,25 @@ jobs:
         check: ${{ fromJSON(needs.prepare.outputs.checks) }}
     steps:
       - uses: actions/checkout@v7
+
       - name: Install Nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
+
       - name: Setup Cachix
         uses: cachix/cachix-action@v17
         with:
           name: kiriwalawren
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
       # Enable KVM for VM tests
       - name: Enable KVM group perms
         run: |
           echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
           sudo udevadm control --reload-rules
           sudo udevadm trigger --name-match=kvm
+
       - name: Run Check 📋
         run: |
           if nix eval --raw ".#checks.x86_64-linux.${{ matrix.check }}.passthru.meta.requiresNetwork" 2>/dev/null | grep -q "true"; then

.github/workflows/docs.yml

@@ -1,39 +1,49 @@
 name: Deploy Documentation
+
 on:
   push:
     branches:
       - main
   workflow_dispatch:
+
 permissions:
   contents: read
   pages: write
   id-token: write
+
 concurrency:
   group: "pages"
   cancel-in-progress: false
+
 jobs:
   build:
     name: Build Documentation
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+
       - name: Install Nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
+
       - name: Setup Cachix
         uses: cachix/cachix-action@v17
         with:
           name: kiriwalawren
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
       - name: Build Documentation
         run: |
           nix build .#docs -L
+
       - name: Copy build artifacts
         run: |
           cp -r result/ _site/
+
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v5
+
   deploy:
     name: Deploy to GitHub Pages
     environment:

.github/workflows/update-flake.yml

@@ -1,28 +1,38 @@
 name: Update Flake Lock
+
 on:
   workflow_dispatch:
   schedule:
     # Run every Sunday at 00:00 UTC
     - cron: '0 0 * * 0'
+
 permissions:
   contents: write
   pull-requests: write
+
 jobs:
   update:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+
       - name: Install Nix
         uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
+
       - name: Setup Cachix
         uses: cachix/cachix-action@v17
         with:
           name: kiriwalawren
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
       - name: Update flake.lock
         run: nix flake update
+
+      - name: Update non-flake pins
+        run: ./update.sh
+
       - name: Create Pull Request
         run: |
           BRANCH="update-flake-lock"

docs/examples/jellyfin-plugins.md

@@ -126,3 +126,4 @@ nix store prefetch-file --json "https://example.com/manifest.json" | jq -r .hash
 ## Secrets
 
 All attributes of `nixflix.jellyfin.plugins.<name>.config` support the `{ _secret = "/path/to/secret"; }` syntax.
+

modules/caddy/default.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib;
+let
+  cfg = config.nixflix;
+in
+{
+
+  config.services.caddy = mkIf (cfg.enable && cfg.caddy.enable) {
+    enable = true;
+    package = mkIf cfg.theme.enable (
+      pkgs.caddy.withPlugins {
+        plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20250618171559-80962887e4c6" ];
+        hash = "sha256-Li9eQjPeyOytfPdJXgtM3fh7qK/4WtgjmaweltQAk14=";
+      }
+    );
+    globalConfig = ''
+      ${optionalString (cfg.caddy.tls.acmeEmail != null) "email ${cfg.caddy.tls.acmeEmail}"}
+    '';
+  };
+}

modules/caddy/update.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+TARGET_FILE="$REPO_ROOT/modules/caddy/default.nix"
+
+ARCH=$(uname -m)
+case "$ARCH" in
+  x86_64) SYSTEM="x86_64-linux" ;;
+  aarch64) SYSTEM="aarch64-linux" ;;
+  *)
+    echo "Unsupported architecture: $ARCH" >&2
+    exit 1
+    ;;
+esac
+
+echo "=== Updating Caddy replace-response plugin ==="
+
+# Get latest commit for caddyserver/replace-response
+RESPONSE=$(curl -sf "https://api.github.com/repos/caddyserver/replace-response/commits?per_page=1")
+NEW_SHA=$(echo "$RESPONSE" | jq -r '.[0].sha')
+COMMIT_DATE=$(echo "$RESPONSE" | jq -r '.[0].commit.committer.date')
+
+# Build Go pseudo-version: v0.0.0-YYYYMMDDHHMMSS-<first 12 chars of SHA>
+TIMESTAMP=$(date -u -d "$COMMIT_DATE" '+%Y%m%d%H%M%S')
+NEW_VERSION="v0.0.0-${TIMESTAMP}-${NEW_SHA:0:12}"
+
+CURRENT_VERSION=$(grep -o 'replace-response@[^"]*' "$TARGET_FILE" | head -1 | cut -d'@' -f2)
+
+if [[ "$NEW_VERSION" == "$CURRENT_VERSION" ]]; then
+  echo "  replace-response: already at $CURRENT_VERSION"
+  echo "Done."
+  exit 0
+fi
+
+echo "  replace-response: $CURRENT_VERSION → $NEW_VERSION"
+
+# Update version string first
+sed -i "s|replace-response@${CURRENT_VERSION}|replace-response@${NEW_VERSION}|g" "$TARGET_FILE"
+
+# Get current vendorHash
+CURRENT_HASH=$(grep -A3 'pkgs.caddy.withPlugins' "$TARGET_FILE" |
+  grep 'hash = ' | sed 's/.*hash = "\(.*\)".*/\1/')
+
+# Build with fake hash to obtain the real vendorHash from the error output
+TMP_NIX=$(mktemp --suffix=.nix)
+trap "rm -f $TMP_NIX" EXIT
+
+cat >"$TMP_NIX" <<EOF
+let
+  flake = builtins.getFlake "path:${REPO_ROOT}";
+  pkgs = flake.inputs.nixpkgs.legacyPackages.${SYSTEM};
+in pkgs.caddy.withPlugins {
+  plugins = [ "github.com/caddyserver/replace-response@${NEW_VERSION}" ];
+  hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+}
+EOF
+
+echo "  Computing new vendorHash (this may take a moment)..."
+BUILD_OUTPUT=$(nix build --impure --file "$TMP_NIX" --no-link 2>&1 || true)
+
+NEW_HASH=$(echo "$BUILD_OUTPUT" | grep "got:" | grep -o 'sha256-[A-Za-z0-9+/]*=' | tail -1)
+
+if [[ -z "$NEW_HASH" ]]; then
+  echo "Error: could not determine new vendorHash" >&2
+  echo "nix build output:" >&2
+  echo "$BUILD_OUTPUT" >&2
+  # Restore original version
+  sed -i "s|replace-response@${NEW_VERSION}|replace-response@${CURRENT_VERSION}|g" "$TARGET_FILE"
+  exit 1
+fi
+
+echo "  New vendorHash: $NEW_HASH"
+sed -i "s|${CURRENT_HASH}|${NEW_HASH}|g" "$TARGET_FILE"
+
+echo ""
+echo "Done."