diff options
Diffstat (limited to 'packaging/build/build-node.sh')
| -rwxr-xr-x | packaging/build/build-node.sh | 47 |
1 files changed, 37 insertions, 10 deletions
diff --git a/packaging/build/build-node.sh b/packaging/build/build-node.sh index bd81096..8970176 100755 --- a/packaging/build/build-node.sh +++ b/packaging/build/build-node.sh @@ -45,26 +45,53 @@ ln -sf /opt/meshbay-common/venv/bin/meshbay-node "$ROOT/usr/bin/meshbay-node" # --- Node-specific assets ------------------------------------------------- mkdir -p "$ROOT/opt/meshbay-node/share" -# Default env with TMDB token (read at build time). -# Override with MESHBAY_TMDB_TOKEN_FILE; falls back to QE/node.env (gitignored). -TMDB_TOKEN_FILE="${MESHBAY_TMDB_TOKEN_FILE:-$REPO/QE/node.env}" -TMDB_TOKEN="" -if [ -f "$TMDB_TOKEN_FILE" ]; then - TMDB_TOKEN=$(grep -oP 'MESHBAY_TMDB_DEFAULT_TOKEN=\K.*' "$TMDB_TOKEN_FILE" || true) +# Default env with the shared TMDB token, read at build time and copied to +# <config>/node.env by `meshbay-node init`. +# +# tmdb.py sends `Authorization: Bearer`, so this is the v4 *read access token* +# (a JWT, "eyJ..."), not the 32-char v3 API key that sits beside it in the same +# note file. Sources, in order: an explicit variable, an explicit file, the +# KEY=VALUE form, then QE/tmdb.txt -- which is free-form prose, so the token is +# matched by shape rather than by a label. +extract_tmdb_token() { + local file="$1" tok="" + [ -f "$file" ] || return 0 + tok=$(sed -n 's/^[[:space:]]*MESHBAY_TMDB_DEFAULT_TOKEN[[:space:]]*=[[:space:]]*//p' \ + "$file" | head -1) + [ -n "$tok" ] || tok=$(grep -oE '^eyJ[A-Za-z0-9._-]{40,}$' "$file" | head -1 || true) + printf '%s' "$tok" | tr -d '"'"'"'\r' +} + +TMDB_TOKEN="${MESHBAY_TMDB_TOKEN:-}" +if [ -z "$TMDB_TOKEN" ] && [ -n "${MESHBAY_TMDB_TOKEN_FILE:-}" ]; then + TMDB_TOKEN=$(extract_tmdb_token "$MESHBAY_TMDB_TOKEN_FILE") fi +[ -n "$TMDB_TOKEN" ] || TMDB_TOKEN=$(extract_tmdb_token "$REPO/QE/node.env") +[ -n "$TMDB_TOKEN" ] || TMDB_TOKEN=$(extract_tmdb_token "$REPO/QE/tmdb.txt") + if [ -n "$TMDB_TOKEN" ]; then cat > "$ROOT/opt/meshbay-node/share/default.env" <<EOF # Default environment for meshbay-node. -# Copied to ~/.config/meshbay/node.env by 'meshbay-node init' if it does not exist. +# Copied to <config>/node.env by 'meshbay-node init' if it does not exist. # The operator may override any value there or in the systemd EnvironmentFile. # TMDB API token for the Videos app (read-only, shared across installations) MESHBAY_TMDB_DEFAULT_TOKEN=$TMDB_TOKEN EOF - echo " TMDB token baked into default.env" + chmod 600 "$ROOT/opt/meshbay-node/share/default.env" + echo " TMDB token baked into default.env (${#TMDB_TOKEN} chars)" +elif [ "${MESHBAY_ALLOW_NO_TMDB:-0}" = "1" ]; then + echo " !! no TMDB token; default.env left empty (MESHBAY_ALLOW_NO_TMDB=1)" >&2 + : > "$ROOT/opt/meshbay-node/share/default.env" else - echo " !! TMDB token not found in QE/node.env — default.env will be empty" >&2 - touch "$ROOT/opt/meshbay-node/share/default.env" + # Failing here is deliberate: an empty default.env is invisible until a user + # opens the Videos app and finds no metadata, which is exactly how this + # shipped empty on two platforms at once. + echo "!! TMDB token not found. Looked at:" >&2 + echo " \$MESHBAY_TMDB_TOKEN, \$MESHBAY_TMDB_TOKEN_FILE," >&2 + echo " $REPO/QE/node.env, $REPO/QE/tmdb.txt" >&2 + echo " Set MESHBAY_ALLOW_NO_TMDB=1 to build without it." >&2 + exit 1 fi # --- Systemd units -------------------------------------------------------- |