update: again fix stat command

.gitignore

@@ -14,3 +14,4 @@ devenv.local.nix
 
 # pre-commit
 .pre-commit-config.yaml
+/result

Readme.md

@@ -0,0 +1,48 @@
+# Frajul's F-Droid Repo
+
+This contains the code for the deployment of my own F-Droid.
+
+## Deployment overview
+The deployment works via `docker`.
+The container is defined in `flake.nix`.
+Every `30 min`, it runs the script `hosting/update.sh`, which git-pulls this repo to update its scripts, then executes `scripts/update-apks.sh` and if any apks have been added or removed, it runs `fdroid update` to re-build the repo, which is located in the `fdroid` directory.
+
+This repo is served by a `caddy` server from the container on port `:8080`.
+
+### How to build and deploy
+To build the container run:
+```sh
+nix build .#container
+```
+
+To load the resulting `gitlab.julian-mutter.de/julian/fdroid-frajul:latest` container into the local docker daemon, run:
+```sh
+docker load < result
+```
+
+For building and deploying the container to the remote registry, simply run the following command, which is provided by the `flake.nix` dev shell:
+```sh
+deploy
+```
+
+## Container configuration
+### Environment variables
+- *SOPS_AGE_KEY*
+
+The files `fdroid/config.yml` and `fdroid/keystore.p12` are encrypted with `sops`.
+The update script automatically decrypts them on the first start of the container.
+For this to work the environment variable `SOPS_AGE_KEY` must be set to the age key used for encrypting.
+This key can be generated by running `age-keygen -o key.txt`.
+
+### External volumes
+- */apks*
+
+The update script downloads new apk versions into the `/apks` directory.
+The apks in there are synced on each update run to the `/src/code/fdroid/repo` directory, where they are served from.
+Therefore, the `/apks` directory is the perfect place to mount an external volume to persist all apks and avoid re-downloading on container restart.
+This also allows manually placing apks to be served into this directory.
+
+## Apk update scripts
+To automatically pull new versions of an apk, create a bash script in the `scripts/apk-update-scripts` directory.
+This script should be idempotent and download all available apk versions with differring file names into the `/apks` directory, if not already present. 
+All these scripts are automatically run regularly by `scripts/update-apks.sh`.

flake.nix

@@ -46,19 +46,20 @@
       tag = "latest";
 
       contents = with pkgs; [
-        coreutils
-        bashInteractive
-        caddy
         dockerTools.fakeNss # Provides fake /etc/passwd for basic user emulation
         dockerTools.usrBinEnv
         dockerTools.binSh
         dockerTools.caCertificates
-
+        coreutils
+        bashInteractive
+        caddy
         fdroidserver
         jq
         curl
         sops
         git
+        rsync
+        busybox
       ];
 
       config = {
@@ -67,6 +68,9 @@
         ExposedPorts = {
           "8080/tcp" = {};
         };
+        Env = [
+          "PATH=/bin:${pkgs.jdk21_headless}/bin"
+        ];
       };
       maxLayers = 10;
     };
@@ -74,6 +78,8 @@
     # nix build .#container
     # docker load < result
     packages.${system}.container = dockerImage;
+
+    # deploy
     devShells.${system}.default = pkgs.mkShell {
       packages = [
         deploy-script

hosting/Caddyfile

@@ -5,9 +5,8 @@
     # 2. Redirect without trailing slash to ensure correct routing
     redir /fdroid/repo /fdroid/repo/ 302
 
-    # 3. Strip '/fdroid/repo' from the URL and serve the underlying files
     handle_path /fdroid/repo/* {
-        root * /repo/fdroid/repo
-        file_server browse
+        root * /src/code/fdroid/repo
+        file_server
     }
 }

hosting/deploy-docker.sh

@@ -1,4 +0,0 @@
-#!/usr/bin/env sh
-
-docker build . -t gitlab.julian-mutter.de/julian/fdroid-frajul:latest
-docker push gitlab.julian-mutter.de/julian/fdroid-frajul:latest

scripts/update-apks.sh

@@ -17,12 +17,12 @@ done
 SOURCE="/apks/"
 DEST="/src/code/fdroid/repo/"
 
-HASH_BEFORE=$(ls -l "$DEST" | sha256sum)
+HASH_BEFORE=$(stat -c "%A %h %U %G %s %n" "$DEST"* | sha256sum)
 
 echo "Syncing apks in directory $DEST with $SOURCE..."
 rsync -rv --include="*.apk" --exclude="*" --delete "$SOURCE" "$DEST"
 
-HASH_AFTER=$(ls -l "$DEST" | sha256sum)
+HASH_AFTER=$(stat -c "%A %h %U %G %s %n" "$DEST"* | sha256sum)
 
 if [ "$HASH_BEFORE" == "$HASH_AFTER" ]; then
     echo "No APKs were added or removed. Skipping F-Droid update."