From a22dc98a36aaf7fe31d652d6a12e61d43ee42805 Mon Sep 17 00:00:00 2001
From: sadorowo <me@sador.me>
Date: Sun, 5 Oct 2025 13:17:12 +0000
Subject: [PATCH] invidious: use YAML configuration by default (#448476)

---
 nixos/modules/services/web-apps/invidious.nix | 103 +++++++++++-------
 1 file changed, 62 insertions(+), 41 deletions(-)

diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix
index 2b93e942896c..17f3b0940649 100644
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@@ -7,11 +7,25 @@
 }:
 let
   cfg = config.services.invidious;
-  # To allow injecting secrets with jq, json (instead of yaml) is used
-  settingsFormat = pkgs.formats.json { };
+  isNew = lib.versionAtLeast config.system.stateVersion "25.11";
+
   inherit (lib) types;
 
-  settingsFile = settingsFormat.generate "invidious-settings" cfg.settings;
+  settingsFormat = pkgs.formats.yaml { };
+  yamlSettingsFile = settingsFormat.generate "invidious-settings" cfg.settings;
+
+  # This needs to stay here for backwards compatibility
+  # with pre-25.11 configs
+  convertSettings = file: lib.escapeShellArg (
+    if isNew then
+      file
+    else
+      pkgs.runCommand "converted-settings.yaml" {
+        nativeBuildInputs = [ pkgs.yq-go ];
+      } ''
+        ${pkgs.yq-go}/bin/yq -o=yaml < ${lib.escapeShellArg file} > $out
+      ''
+  );
 
   generatedHmacKeyFile = "/var/lib/invidious/hmac_key";
   generateHmac = cfg.hmacKeyFile == null;
@@ -59,6 +73,50 @@ let
       RuntimeRandomizedExtraSec = lib.mkDefault "5min";
     };
   };
+
+  configScript = scaleIndex:
+    ''
+      configParts=()
+    ''
+    # autogenerated hmac_key
+    + lib.optionalString generateHmac ''
+      configParts+=("$(${pkgs.jq}/bin/jq -R '{"hmac_key":.}' <"${generatedHmacKeyFile}")")
+    ''
+    # generated settings file
+    + ''
+      configParts+=("$(< ${convertSettings yamlSettingsFile})")
+    ''
+    # optional database password file
+    + lib.optionalString (cfg.database.host != null) ''
+      configParts+=("$(${pkgs.jq}/bin/jq -R '{"db":{"password":.}}' ${cfg.database.passwordFile})")
+    ''
+    # optional extra settings file
+    + lib.optionalString (cfg.extraSettingsFile != null) ''
+      configParts+=("$(< ${convertSettings cfg.extraSettingsFile})")
+    ''
+    # explicitly specified hmac key file
+    + lib.optionalString (cfg.hmacKeyFile != null) ''
+      configParts+=("$(< ${cfg.hmacKeyFile})")
+    ''
+    # configure threads for secondary instances
+    + lib.optionalString (scaleIndex > 0) ''
+      configParts+=('{"channel_threads":0, "feed_threads":0}')
+    ''
+    # configure different ports for the instances
+    + ''
+      configParts+=('{"port":${toString (cfg.port + scaleIndex)}}')
+    ''
+    # merge all parts into a single configuration with later elements overriding previous elements
+    + ''
+      export INVIDIOUS_CONFIG="$(${if isNew then
+        "${pkgs.yq-go}/bin/yq ea '. as $item ireduce ({}; . * $item)'"
+      else
+        "${pkgs.jq}/bin/jq -s 'reduce .[] as $item ({}; . * $item)'"
+      } <<<"''${configParts[*]}")"
+
+      exec ${cfg.package}/bin/invidious
+    '';
+
   mkInvidiousService =
     scaleIndex:
     lib.foldl' lib.recursiveUpdate commonInvidousServiceConfig [
@@ -76,44 +134,7 @@ let
         after = commonInvidousServiceConfig.after ++ [ "invidious.service" ];
         wants = commonInvidousServiceConfig.wants ++ [ "invidious.service" ];
       })
-      {
-        script = ''
-          configParts=()
-        ''
-        # autogenerated hmac_key
-        + lib.optionalString generateHmac ''
-          configParts+=("$(${pkgs.jq}/bin/jq -R '{"hmac_key":.}' <"${generatedHmacKeyFile}")")
-        ''
-        # generated settings file
-        + ''
-          configParts+=("$(< ${lib.escapeShellArg settingsFile})")
-        ''
-        # optional database password file
-        + lib.optionalString (cfg.database.host != null) ''
-          configParts+=("$(${pkgs.jq}/bin/jq -R '{"db":{"password":.}}' ${lib.escapeShellArg cfg.database.passwordFile})")
-        ''
-        # optional extra settings file
-        + lib.optionalString (cfg.extraSettingsFile != null) ''
-          configParts+=("$(< ${lib.escapeShellArg cfg.extraSettingsFile})")
-        ''
-        # explicitly specified hmac key file
-        + lib.optionalString (cfg.hmacKeyFile != null) ''
-          configParts+=("$(< ${lib.escapeShellArg cfg.hmacKeyFile})")
-        ''
-        # configure threads for secondary instances
-        + lib.optionalString (scaleIndex > 0) ''
-          configParts+=('{"channel_threads":0, "feed_threads":0}')
-        ''
-        # configure different ports for the instances
-        + ''
-          configParts+=('{"port":${toString (cfg.port + scaleIndex)}}')
-        ''
-        # merge all parts into a single configuration with later elements overriding previous elements
-        + ''
-          export INVIDIOUS_CONFIG="$(${pkgs.jq}/bin/jq -s 'reduce .[] as $item ({}; . * $item)' <<<"''${configParts[*]}")"
-          exec ${cfg.package}/bin/invidious
-        '';
-      }
+      { script = configScript scaleIndex; }
     ];
 
   serviceConfig = {