From a22dc98a36aaf7fe31d652d6a12e61d43ee42805 Mon Sep 17 00:00:00 2001
From: sadorowo <me@sador.me>
Date: Sun, 5 Oct 2025 13:17:12 +0000
Subject: [PATCH 1/6] invidious: use YAML configuration by default (#448476)

---
 nixos/modules/services/web-apps/invidious.nix | 103 +++++++++++-------
 1 file changed, 62 insertions(+), 41 deletions(-)

diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix
index 2b93e942896c..17f3b0940649 100644
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@@ -7,11 +7,25 @@
 }:
 let
   cfg = config.services.invidious;
-  # To allow injecting secrets with jq, json (instead of yaml) is used
-  settingsFormat = pkgs.formats.json { };
+  isNew = lib.versionAtLeast config.system.stateVersion "25.11";
+
   inherit (lib) types;
 
-  settingsFile = settingsFormat.generate "invidious-settings" cfg.settings;
+  settingsFormat = pkgs.formats.yaml { };
+  yamlSettingsFile = settingsFormat.generate "invidious-settings" cfg.settings;
+
+  # This needs to stay here for backwards compatibility
+  # with pre-25.11 configs
+  convertSettings = file: lib.escapeShellArg (
+    if isNew then
+      file
+    else
+      pkgs.runCommand "converted-settings.yaml" {
+        nativeBuildInputs = [ pkgs.yq-go ];
+      } ''
+        ${pkgs.yq-go}/bin/yq -o=yaml < ${lib.escapeShellArg file} > $out
+      ''
+  );
 
   generatedHmacKeyFile = "/var/lib/invidious/hmac_key";
   generateHmac = cfg.hmacKeyFile == null;
@@ -59,6 +73,50 @@ let
       RuntimeRandomizedExtraSec = lib.mkDefault "5min";
     };
   };
+
+  configScript = scaleIndex:
+    ''
+      configParts=()
+    ''
+    # autogenerated hmac_key
+    + lib.optionalString generateHmac ''
+      configParts+=("$(${pkgs.jq}/bin/jq -R '{"hmac_key":.}' <"${generatedHmacKeyFile}")")
+    ''
+    # generated settings file
+    + ''
+      configParts+=("$(< ${convertSettings yamlSettingsFile})")
+    ''
+    # optional database password file
+    + lib.optionalString (cfg.database.host != null) ''
+      configParts+=("$(${pkgs.jq}/bin/jq -R '{"db":{"password":.}}' ${cfg.database.passwordFile})")
+    ''
+    # optional extra settings file
+    + lib.optionalString (cfg.extraSettingsFile != null) ''
+      configParts+=("$(< ${convertSettings cfg.extraSettingsFile})")
+    ''
+    # explicitly specified hmac key file
+    + lib.optionalString (cfg.hmacKeyFile != null) ''
+      configParts+=("$(< ${cfg.hmacKeyFile})")
+    ''
+    # configure threads for secondary instances
+    + lib.optionalString (scaleIndex > 0) ''
+      configParts+=('{"channel_threads":0, "feed_threads":0}')
+    ''
+    # configure different ports for the instances
+    + ''
+      configParts+=('{"port":${toString (cfg.port + scaleIndex)}}')
+    ''
+    # merge all parts into a single configuration with later elements overriding previous elements
+    + ''
+      export INVIDIOUS_CONFIG="$(${if isNew then
+        "${pkgs.yq-go}/bin/yq ea '. as $item ireduce ({}; . * $item)'"
+      else
+        "${pkgs.jq}/bin/jq -s 'reduce .[] as $item ({}; . * $item)'"
+      } <<<"''${configParts[*]}")"
+
+      exec ${cfg.package}/bin/invidious
+    '';
+
   mkInvidiousService =
     scaleIndex:
     lib.foldl' lib.recursiveUpdate commonInvidousServiceConfig [
@@ -76,44 +134,7 @@ let
         after = commonInvidousServiceConfig.after ++ [ "invidious.service" ];
         wants = commonInvidousServiceConfig.wants ++ [ "invidious.service" ];
       })
-      {
-        script = ''
-          configParts=()
-        ''
-        # autogenerated hmac_key
-        + lib.optionalString generateHmac ''
-          configParts+=("$(${pkgs.jq}/bin/jq -R '{"hmac_key":.}' <"${generatedHmacKeyFile}")")
-        ''
-        # generated settings file
-        + ''
-          configParts+=("$(< ${lib.escapeShellArg settingsFile})")
-        ''
-        # optional database password file
-        + lib.optionalString (cfg.database.host != null) ''
-          configParts+=("$(${pkgs.jq}/bin/jq -R '{"db":{"password":.}}' ${lib.escapeShellArg cfg.database.passwordFile})")
-        ''
-        # optional extra settings file
-        + lib.optionalString (cfg.extraSettingsFile != null) ''
-          configParts+=("$(< ${lib.escapeShellArg cfg.extraSettingsFile})")
-        ''
-        # explicitly specified hmac key file
-        + lib.optionalString (cfg.hmacKeyFile != null) ''
-          configParts+=("$(< ${lib.escapeShellArg cfg.hmacKeyFile})")
-        ''
-        # configure threads for secondary instances
-        + lib.optionalString (scaleIndex > 0) ''
-          configParts+=('{"channel_threads":0, "feed_threads":0}')
-        ''
-        # configure different ports for the instances
-        + ''
-          configParts+=('{"port":${toString (cfg.port + scaleIndex)}}')
-        ''
-        # merge all parts into a single configuration with later elements overriding previous elements
-        + ''
-          export INVIDIOUS_CONFIG="$(${pkgs.jq}/bin/jq -s 'reduce .[] as $item ({}; . * $item)' <<<"''${configParts[*]}")"
-          exec ${cfg.package}/bin/invidious
-        '';
-      }
+      { script = configScript scaleIndex; }
     ];
 
   serviceConfig = {

From 59f3789f45371fe301fd6c3bea2a93cb15c87729 Mon Sep 17 00:00:00 2001
From: Franek <me@sador.me>
Date: Sun, 5 Oct 2025 17:36:58 +0200
Subject: [PATCH 2/6] chore: reformat and fix typo

---
 nixos/modules/services/web-apps/invidious.nix | 44 +++++++++++--------
 1 file changed, 25 insertions(+), 19 deletions(-)

diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix
index 17f3b0940649..f028e40a5008 100644
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@@ -16,21 +16,25 @@ let
 
   # This needs to stay here for backwards compatibility
   # with pre-25.11 configs
-  convertSettings = file: lib.escapeShellArg (
-    if isNew then
-      file
-    else
-      pkgs.runCommand "converted-settings.yaml" {
-        nativeBuildInputs = [ pkgs.yq-go ];
-      } ''
-        ${pkgs.yq-go}/bin/yq -o=yaml < ${lib.escapeShellArg file} > $out
-      ''
-  );
+  convertSettings =
+    file:
+    lib.escapeShellArg (
+      if isNew then
+        file
+      else
+        pkgs.runCommand "converted-settings.yaml"
+          {
+            nativeBuildInputs = [ pkgs.yq-go ];
+          }
+          ''
+          ${pkgs.yq-go}/bin/yq -o=yaml < ${lib.escapeShellArg file} > $out
+          ''
+    );
 
   generatedHmacKeyFile = "/var/lib/invidious/hmac_key";
   generateHmac = cfg.hmacKeyFile == null;
 
-  commonInvidousServiceConfig = {
+  commonInvidiousServiceConfig = {
     description = "Invidious (An alternative YouTube front-end)";
     wants = [ "network-online.target" ];
     after = [ "network-online.target" ] ++ lib.optional cfg.database.createLocally "postgresql.target";
@@ -74,7 +78,8 @@ let
     };
   };
 
-  configScript = scaleIndex:
+  configScript =
+    scaleIndex:
     ''
       configParts=()
     ''
@@ -108,10 +113,11 @@ let
     ''
     # merge all parts into a single configuration with later elements overriding previous elements
     + ''
-      export INVIDIOUS_CONFIG="$(${if isNew then
-        "${pkgs.yq-go}/bin/yq ea '. as $item ireduce ({}; . * $item)'"
-      else
-        "${pkgs.jq}/bin/jq -s 'reduce .[] as $item ({}; . * $item)'"
+      export INVIDIOUS_CONFIG="$(${
+        if isNew then
+          "${pkgs.yq-go}/bin/yq ea '. as $item ireduce ({}; . * $item)'"
+        else
+          "${pkgs.jq}/bin/jq -s 'reduce .[] as $item ({}; . * $item)'"
       } <<<"''${configParts[*]}")"
 
       exec ${cfg.package}/bin/invidious
@@ -119,7 +125,7 @@ let
 
   mkInvidiousService =
     scaleIndex:
-    lib.foldl' lib.recursiveUpdate commonInvidousServiceConfig [
+    lib.foldl' lib.recursiveUpdate commonInvidiousServiceConfig [
       # only generate the hmac file in the first service
       (lib.optionalAttrs (scaleIndex == 0) {
         preStart = lib.optionalString generateHmac ''
@@ -131,8 +137,8 @@ let
       })
       # configure the secondary services to run after the first service
       (lib.optionalAttrs (scaleIndex > 0) {
-        after = commonInvidousServiceConfig.after ++ [ "invidious.service" ];
-        wants = commonInvidousServiceConfig.wants ++ [ "invidious.service" ];
+        after = commonInvidiousServiceConfig.after ++ [ "invidious.service" ];
+        wants = commonInvidiousServiceConfig.wants ++ [ "invidious.service" ];
       })
       { script = configScript scaleIndex; }
     ];

From 3fd6717c2207fd9cae2049c634432e3bbaf1e06c Mon Sep 17 00:00:00 2001
From: Franek <me@sador.me>
Date: Sun, 5 Oct 2025 17:41:05 +0200
Subject: [PATCH 3/6] chore: reformat file properly

---
 nixos/modules/services/web-apps/invidious.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix
index f028e40a5008..0261f3c06b8b 100644
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@@ -27,7 +27,7 @@ let
             nativeBuildInputs = [ pkgs.yq-go ];
           }
           ''
-          ${pkgs.yq-go}/bin/yq -o=yaml < ${lib.escapeShellArg file} > $out
+            ${pkgs.yq-go}/bin/yq -o=yaml < ${lib.escapeShellArg file} > $out
           ''
     );
 

From e9b91d0f2dc4da2556525632838d395193d06db6 Mon Sep 17 00:00:00 2001
From: Franek <me@sador.me>
Date: Sun, 5 Oct 2025 19:27:48 +0200
Subject: [PATCH 4/6] fix: use JSON and then convert to YAML for backwards
 compatibility

---
 nixos/modules/services/web-apps/invidious.nix | 36 +++++--------------
 1 file changed, 9 insertions(+), 27 deletions(-)

diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix
index 0261f3c06b8b..83f41602a670 100644
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@@ -11,25 +11,11 @@ let
 
   inherit (lib) types;
 
-  settingsFormat = pkgs.formats.yaml { };
-  yamlSettingsFile = settingsFormat.generate "invidious-settings" cfg.settings;
-
-  # This needs to stay here for backwards compatibility
-  # with pre-25.11 configs
-  convertSettings =
-    file:
-    lib.escapeShellArg (
-      if isNew then
-        file
-      else
-        pkgs.runCommand "converted-settings.yaml"
-          {
-            nativeBuildInputs = [ pkgs.yq-go ];
-          }
-          ''
-            ${pkgs.yq-go}/bin/yq -o=yaml < ${lib.escapeShellArg file} > $out
-          ''
-    );
+  # This need to be JSON to reduce number of
+  # breaking changes, for backwards
+  # compatibility with pre-25.11
+  settingsFormat = pkgs.formats.json { };
+  settingsFile = settingsFormat.generate "invidious-settings" cfg.settings;
 
   generatedHmacKeyFile = "/var/lib/invidious/hmac_key";
   generateHmac = cfg.hmacKeyFile == null;
@@ -89,7 +75,7 @@ let
     ''
     # generated settings file
     + ''
-      configParts+=("$(< ${convertSettings yamlSettingsFile})")
+      configParts+=("$(< ${settingsFile})")
     ''
     # optional database password file
     + lib.optionalString (cfg.database.host != null) ''
@@ -97,7 +83,7 @@ let
     ''
     # optional extra settings file
     + lib.optionalString (cfg.extraSettingsFile != null) ''
-      configParts+=("$(< ${convertSettings cfg.extraSettingsFile})")
+      configParts+=("$(< ${cfg.extraSettingsFile})")
     ''
     # explicitly specified hmac key file
     + lib.optionalString (cfg.hmacKeyFile != null) ''
@@ -113,12 +99,8 @@ let
     ''
     # merge all parts into a single configuration with later elements overriding previous elements
     + ''
-      export INVIDIOUS_CONFIG="$(${
-        if isNew then
-          "${pkgs.yq-go}/bin/yq ea '. as $item ireduce ({}; . * $item)'"
-        else
-          "${pkgs.jq}/bin/jq -s 'reduce .[] as $item ({}; . * $item)'"
-      } <<<"''${configParts[*]}")"
+      mergedConfig="$(${pkgs.jq}/bin/jq -s 'reduce .[] as $item ({}; . * $item)' <<<"''${configParts[*]}")"
+      export INVIDIOUS_CONFIG=$(echo "$mergedConfig" | ${pkgs.yq-go}/bin/yq -P)
 
       exec ${cfg.package}/bin/invidious
     '';

From 3e5de98fc82f319cccba2371f3647ea89e6cf98e Mon Sep 17 00:00:00 2001
From: Franek <me@sador.me>
Date: Sun, 5 Oct 2025 19:29:53 +0200
Subject: [PATCH 5/6] chore: remove dead code

---
 nixos/modules/services/web-apps/invidious.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix
index 83f41602a670..126dd1fab506 100644
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@@ -7,7 +7,6 @@
 }:
 let
   cfg = config.services.invidious;
-  isNew = lib.versionAtLeast config.system.stateVersion "25.11";
 
   inherit (lib) types;
 

From 63da2caa10ec7ddbe3775b8db6fe826af0193489 Mon Sep 17 00:00:00 2001
From: sadorowo <me@sador.me>
Date: Mon, 6 Oct 2025 13:58:53 +0000
Subject: [PATCH 6/6] fix: add missing lib.escapeShellArg

---
 nixos/modules/services/web-apps/invidious.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix
index 126dd1fab506..29ec8c8ef9b1 100644
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@@ -82,11 +82,11 @@ let
     ''
     # optional extra settings file
     + lib.optionalString (cfg.extraSettingsFile != null) ''
-      configParts+=("$(< ${cfg.extraSettingsFile})")
+      configParts+=("$(< ${lib.escapeShellArg cfg.extraSettingsFile})")
     ''
     # explicitly specified hmac key file
     + lib.optionalString (cfg.hmacKeyFile != null) ''
-      configParts+=("$(< ${cfg.hmacKeyFile})")
+      configParts+=("$(< ${lib.escapeShellArg cfg.hmacKeyFile})")
     ''
     # configure threads for secondary instances
     + lib.optionalString (scaleIndex > 0) ''