feat: add Docker support for cliproxyapi service on Linux

home-manager/services/cliproxyapi/default.nix

@@ -11,6 +11,12 @@ let
     rsync = "${pkgs.rsync}/bin/rsync";
   };
 
+  # Wrapper script that runs start.sh with docker group permissions
+  # Note: sg is from shadow package, available as system binary /usr/bin/sg
+  dockerStartScript = pkgs.writeShellScript "cliproxyapi-docker-start" ''
+    exec /usr/bin/sg docker -c "${pkgs.bash}/bin/bash ${startScript}"
+  '';
+
   # Create backup scripts with paths substituted at build time
   backupAuthScript = pkgs.replaceVars ./scripts/backup-auth.sh {
     aws = "${pkgs.awscli2}/bin/aws";
@@ -50,7 +56,11 @@ in
   systemd.user.services.cliproxyapi = lib.mkIf pkgs.stdenv.isLinux {
     Unit = {
       Description = "CLI Proxy API server";
-      After = [ "network.target" ];
+      After = [
+        "network.target"
+        "docker.service"
+      ];
+      Wants = [ "docker.service" ];
     };
     Service = {
       Type = "simple";
@@ -60,9 +70,10 @@ in
           pkgs.bash
           pkgs.coreutils
           pkgs.awscli2
+          pkgs.docker
         ]
       }";
-      ExecStart = "${pkgs.bash}/bin/bash ${startScript}";
+      ExecStart = "${dockerStartScript}";
       Restart = "always";
       RestartSec = 3;
     };

home-manager/services/cliproxyapi/scripts/start.sh

@@ -95,12 +95,33 @@ fi
 # Change to config dir so logs are created there
 cd "$CONFIG_DIR"
 
-# Find and exec cliproxyapi with config file
+# On Linux, prefer Docker for easy upgrades
+if [ "$(uname)" = "Linux" ] && command -v docker >/dev/null 2>&1; then
+  # Stop any existing container
+  docker rm -f cliproxyapi 2>/dev/null || true
+
+  # Create logs directory if it doesn't exist
+  mkdir -p "$CONFIG_DIR/logs"
+
+  exec docker run --rm \
+    --name cliproxyapi \
+    --network host \
+    --ulimit nofile=65536:65536 \
+    -v "$CONFIG:/CLIProxyAPI/config.yaml:ro" \
+    -v "$CONFIG_DIR:/root/.cli-proxy-api" \
+    -v "$CONFIG_DIR/logs:/CLIProxyAPI/logs" \
+    -e MANAGEMENT_PASSWORD="${MANAGEMENT_PASSWORD:-}" \
+    eceasy/cli-proxy-api:latest
+fi
+
+# macOS: use Homebrew binary
 if [ -x /opt/homebrew/bin/cliproxyapi ]; then
   exec /opt/homebrew/bin/cliproxyapi -config "$CONFIG" "$@"
 elif [ -x /usr/local/bin/cliproxyapi ]; then
   exec /usr/local/bin/cliproxyapi -config "$CONFIG" "$@"
 else
-  echo 'cliproxyapi binary not found; install it with "brew install cliproxyapi"' >&2
+  echo 'cliproxyapi not found' >&2
+  echo 'Linux: Docker should be available' >&2
+  echo 'macOS: brew install cliproxyapi' >&2
   exit 1
 fi

home-manager/services/default.nix

@@ -8,6 +8,7 @@ let
   brewUpgrader = import ./brew-upgrader { inherit pkgs; };
   cliproxyapi = import ./cliproxyapi { inherit pkgs; };
   codeSyncer = import ./code-syncer { inherit pkgs; };
+  docker = import ./docker { inherit lib pkgs; };
   dotfilesUpdater = import ./dotfiles-updater { inherit pkgs; };
   neversslKeepalive = import ./neverssl-keepalive { inherit pkgs; };
   ollama = import ./ollama { inherit pkgs; };
@@ -19,6 +20,7 @@ in
   brewUpgrader
   cliproxyapi
   codeSyncer
+  docker
   dotfilesUpdater
   neversslKeepalive
   ollama

home-manager/services/docker/default.nix

@@ -0,0 +1,64 @@
+{ pkgs, lib, ... }:
+let
+  # Systemd service file for Docker daemon
+  dockerServiceFile = pkgs.writeText "docker.service" ''
+    [Unit]
+    Description=Docker Application Container Engine
+    Documentation=https://docs.docker.com
+    After=network-online.target
+    Wants=network-online.target
+
+    [Service]
+    Type=notify
+    ExecStart=${pkgs.docker}/bin/dockerd
+    ExecReload=${pkgs.coreutils}/bin/kill -s HUP $MAINPID
+    Restart=always
+    RestartSec=10s
+
+    [Install]
+    WantedBy=multi-user.target
+  '';
+
+  # Script to ensure user is in docker group and system docker is running
+  setupDockerScript = pkgs.writeShellScript "setup-docker" ''
+    set -euo pipefail
+
+    # Define paths
+    GROUPS=${pkgs.shadow}/bin/groups
+    GREP=${pkgs.gnugrep}/bin/grep
+    USERMOD=${pkgs.shadow}/bin/usermod
+    SYSTEMCTL=${pkgs.systemd}/bin/systemctl
+    TEE=${pkgs.coreutils}/bin/tee
+    DOCKER_SERVICE_FILE=${dockerServiceFile}
+
+    # Check if docker group exists and user is in it
+    if ! $GROUPS | $GREP -q docker; then
+      echo "Adding user to docker group..."
+      sudo $USERMOD -aG docker $USER
+      echo "✅ Added to docker group. Please log out and back in, or run: newgrp docker"
+    fi
+
+    # Check if system docker service exists and is running
+    if ! $SYSTEMCTL is-active --quiet docker 2>/dev/null; then
+      echo "Starting Docker daemon..."
+      if [ ! -f /etc/systemd/system/docker.service ]; then
+        echo "Installing Docker systemd service..."
+        sudo $TEE /etc/systemd/system/docker.service > /dev/null < "$DOCKER_SERVICE_FILE"
+        sudo $SYSTEMCTL daemon-reload
+        sudo $SYSTEMCTL enable docker
+      fi
+      sudo $SYSTEMCTL start docker
+      echo "✅ Docker daemon started"
+    else
+      echo "✅ Docker daemon is already running"
+    fi
+  '';
+in
+{
+  # Provide setup script for system Docker
+  home.packages = lib.mkIf pkgs.stdenv.isLinux [
+    (pkgs.writeShellScriptBin "docker-setup" ''
+      exec ${setupDockerScript}
+    '')
+  ];
+}

spec/cliproxyapi_spec.sh

@@ -90,8 +90,8 @@ The output should include '/usr/local/bin/cliproxyapi'
 End
 
 It 'shows error message when binary not found'
-When run bash -c "grep 'cliproxyapi binary not found' '$SCRIPT'"
-The output should include 'cliproxyapi binary not found'
+When run bash -c "grep 'cliproxyapi not found' '$SCRIPT'"
+The output should include 'cliproxyapi not found'
 End
 
 It 'suggests installation command in error message'