rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

redlib: build from upstream main, nixpkgs build is TLS-blocked

Browse source
This commit is contained in:
rope 2026-08-29 14:16:13 +01:00
parent f97d7ac829
commit ce18b829cb
3 changed files with 43 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

20
services/redlib.nix
View file

@ -1,11 +1,29 @@
# services/redlib.nix — Private Reddit front-end at reddit.nordhammer.it
{ config, lib, ... }:
{ config, lib, inputs, pkgs, ... }:
{
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
services.redlib = {
enable = true;
address = "127.0.0.1";
port = 8087;
# nixpkgs pins a Dec 2025 redlib that talks to Reddit over plain rustls.
# Reddit fingerprints TLS and 403s every oauth.reddit.com call from it —
# the token mints fine, then every API request fails. Upstream main
# switched to wreq with Chrome/Firefox fingerprint emulation. Its own
# flake is unusable (locked to Rust 1.82, older than wreq's edition2024),
# so take the source from the input and build it with nixpkgs' toolchain.
# Drop all of this once the wreq commit lands in the pinned channel.
package = pkgs.rustPlatform.buildRustPackage {
pname = "redlib";
version = "0.36.0-unstable-2026-04-24";
src = inputs.redlib;
cargoLock.lockFile = "${inputs.redlib}/Cargo.lock";
# boring-sys2 (wreq's TLS backend) builds BoringSSL from source
# git: boring-sys2 patches BoringSSL in place before building it
nativeBuildInputs = with pkgs; [ cmake perl go git rustPlatform.bindgenHook ];
doCheck = false; # upstream tests hit the live Reddit API
};
};
};
}