Add genebean.services.filteredPodcastFeeds module - #725
Merged
Merged
Conversation
Republishes an upstream podcast RSS feed with only episodes matching a text filter, so a family member's Audiobookshelf/Absorb setup can subscribe to just one arc of a show instead of the whole catalog. - pkgs/filtered-podcast-feeds: the generator as a real, lintable generator.py, packaged via writers.writePython3Bin (flake8 at build time) and registered in the fleet overlay. - modules/genebean/nixos/services/filtered-podcast-feeds.nix: the reusable systemd oneshot+timer service. Uses a dedicated system user rather than DynamicUser - DynamicUser's state dir lives under /var/lib/private/<name> (0700 root:root), which nginx can never read regardless of the leaf directory's own mode. Same tradeoff already made in nixnuc/social-reader-mcp.nix. - modules/hosts/nixos/nixnuc/filtered-podcast-feeds.nix + nixnuc/default.nix: enables it for Fantasy Fangirls' "Everflame" arc, and adds the podcasts.home.technicalissues.us vhost (DNS-01 ACME, basic auth) alongside this host's other centrally-defined vhosts. - filtered_podcast_feeds_basic_auth secret added to the shared secrets.yaml (set blind via `sops set`, never decrypted). - ruff added to pre-commit/CI/the shared home-manager package list and documented in README/AGENTS.md, since this is the first Python landing in the repo. Verified live against the real Acast feed and the deployed nixnuc host: correct episode filtering, 401 without credentials, 200 with them. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Co-Authored-By: OpenAI Codex <noreply@openai.com>
genebean
enabled auto-merge
September 21, 2026 03:36
2 tasks
genebean
added a commit
that referenced
this pull request
Sep 21, 2026
…Feeds Fail fast at Nix eval time instead of surfacing as a per-feed "ERROR:" line in the generator's journal output at runtime. - since must match YYYY-MM-DD, checked via builtins.match. - publicUrl must not end in a trailing slash, since the generator appends /<slug>.xml. Suggested by a ChatGPT review of the already-merged #725. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Co-Authored-By: OpenAI Codex <noreply@openai.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
genebean.services.filteredPodcastFeedsmodule: republishes an upstream podcast RSS feed with only episodes matching a text filter (and optional since-date), so a family member's Audiobookshelf/Absorb setup can subscribe to just one arc of a show instead of the whole catalog.pkgs/filtered-podcast-feedsas a real, lintablegenerator.py(packaged viawriters.writePython3Bin, flake8-checked at build time), not embedded Nix-string Python.nixnucfor Fantasy Fangirls' "Everflame" arc, served atpodcasts.home.technicalissues.us(DNS-01 ACME, basic auth) alongside the host's other centrally-defined nginx vhosts.DynamicUser—DynamicUser's state directory lives under/var/lib/private/<name>(0700 root:root), which nginx can never read regardless of the leaf directory's own mode. Same tradeoff already made innixnuc/social-reader-mcp.nix.ruffadded to pre-commit/CI/the shared home-manager package list, since this is the first Python landing in the repo.Test plan
pre-commit run --all-filesclean (nixfmt, deadnix, statix, ruff-check, ruff-format)nix build .#filtered-podcast-feedssucceeds, including the build-time flake8 checkdeploy-rs --dry-activatethen real deploy tonixnuc— clean activation401without credentials,200with them, valid feed XML served over the real domain/cert athttps://podcasts.home.technicalissues.us/feeds/fantasy-fangirls-everflame.xml🤖 Generated with Claude Code