Skip to content

fix(cliproxyapi): read API key from .env and skip dotfiles sync on Linux #462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 2 commits into from
Dec 28, 2025
Merged

fix(cliproxyapi): read API key from .env and skip dotfiles sync on Linux #462

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
41e77f1
fix(cliproxyapi): read CLIPROXY_API_KEY from .env file
shunkakinoki Dec 28, 2025
f2d3d62
fix(cliproxyapi): skip dotfiles auth sync on Linux
shunkakinoki Dec 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# Example environment secrets consumed by home-manager/modules/secret
# Copy to home-manager/.env and provide real values. The .env file stays local.
# Copy to .env and provide real values. The .env file stays local.
MY_SECRET=replace-me
# GITHUB_TOKEN=ghp_your_token_here
CLIPROXY_API_KEY=your-api-key-here
CLIPROXY_MANAGEMENT_PASSWORD=your-management-key-here
36 changes: 18 additions & 18 deletions flake.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion home-manager/services/cliproxyapi/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,6 @@ in
Path = {
PathChanged = [
"%h/.cli-proxy-api/objectstore/auths"
"%h/dotfiles/objectstore/auths"
"%h/.ccs/cliproxy/auth"
];
Unit = "cliproxyapi-backup.service";
Expand Down
11 changes: 7 additions & 4 deletions home-manager/services/cliproxyapi/scripts/backup-auth.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,8 +76,11 @@ if [ -d "$AUTH_DIR" ] && [ -n "$(ls -A "$AUTH_DIR" 2>/dev/null)" ]; then
@rsync@ -a "$AUTH_DIR/" "$CCS_AUTH_DIR/"
echo "✅ Synced to ccs auth dir" >&2

# Also sync back to dotfiles repo for git tracking
mkdir -p "$DOTFILES_AUTH_DIR"
@rsync@ -a "$AUTH_DIR/" "$DOTFILES_AUTH_DIR/"
echo "✅ Synced to dotfiles repo" >&2
# macOS only: Sync back to dotfiles repo for git tracking
# (Skipped on Linux to avoid redundant auth file copies)
if [ "$(uname)" = "Darwin" ]; then
mkdir -p "$DOTFILES_AUTH_DIR"
@rsync@ -a "$AUTH_DIR/" "$DOTFILES_AUTH_DIR/"
echo "✅ Synced to dotfiles repo" >&2
fi
fi
19 changes: 11 additions & 8 deletions home-manager/services/cliproxyapi/scripts/start.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,11 +49,14 @@ if [ -n "${OBJECTSTORE_ENDPOINT:-}" ] && [ -n "${OBJECTSTORE_ACCESS_KEY:-}" ]; t
"s3://cliproxyapi/backup/auths/" \
"$AUTH_DIR/" 2>/dev/null && echo "✅ Pulled from R2 backup/auths/" >&2 || true

# Bootstrap from git-tracked dotfiles if objectstore is empty
if [ ! -d "$AUTH_DIR" ] || [ -z "$(ls -A "$AUTH_DIR" 2>/dev/null)" ]; then
if [ -d "$HOME/dotfiles/objectstore/auths" ] && [ -n "$(ls -A "$HOME/dotfiles/objectstore/auths" 2>/dev/null)" ]; then
@rsync@ -a "$HOME/dotfiles/objectstore/auths/" "$AUTH_DIR/"
echo "✅ Bootstrapped from dotfiles (objectstore was empty)" >&2
# macOS only: Bootstrap from git-tracked dotfiles if objectstore is empty
# (Skipped on Linux to avoid redundant auth file copies)
if [ "$(uname)" = "Darwin" ]; then
if [ ! -d "$AUTH_DIR" ] || [ -z "$(ls -A "$AUTH_DIR" 2>/dev/null)" ]; then
if [ -d "$HOME/dotfiles/objectstore/auths" ] && [ -n "$(ls -A "$HOME/dotfiles/objectstore/auths" 2>/dev/null)" ]; then
@rsync@ -a "$HOME/dotfiles/objectstore/auths/" "$AUTH_DIR/"
echo "✅ Bootstrapped from dotfiles (objectstore was empty)" >&2
fi
fi
fi
else
Expand All @@ -69,12 +72,12 @@ if [ -f "$TEMPLATE" ]; then
-e "s|__AMP_UPSTREAM_API_KEY__|${AMP_UPSTREAM_API_KEY:-}|g" \
"$TEMPLATE" >"$CONFIG"

# Linux: uncomment and enable api-keys for client authentication
# Linux: uncomment and enable api-keys for client authentication (only if key is set)
# macOS: leave api-keys commented for open access
if [ "$(uname)" = "Linux" ]; then
if [ "$(uname)" = "Linux" ] && [ -n "${CLIPROXY_API_KEY:-}" ]; then
@sed@ -i \
-e "s|^# api-keys:|api-keys:|" \
-e "s|^# - \"__CLIPROXY_API_KEY__\"| - \"${CLIPROXY_API_KEY:-}\"|" \
-e "s|^# - \"__CLIPROXY_API_KEY__\"| - \"${CLIPROXY_API_KEY}\"|" \
"$CONFIG"
Comment on lines 78 to 81

@gemini-code-assist gemini-code-assist Bot Dec 28, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The CLIPROXY_API_KEY variable is used directly in a sed replacement string. If the API key contains special characters for sed (like &, \, or the | delimiter), it can break the substitution command or lead to unexpected results. It's safer to escape the variable before using it.

For example, if CLIPROXY_API_KEY was foo&bar, the & in the replacement part would be substituted with the entire matched pattern (# - "__CLIPROXY_API_KEY__"), which is not the desired behavior.

Suggested change
@sed@ -i \
-e "s|^# api-keys:|api-keys:|" \
-e "s|^# - \"__CLIPROXY_API_KEY__\"| - \"${CLIPROXY_API_KEY:-}\"|" \
-e "s|^# - \"__CLIPROXY_API_KEY__\"| - \"${CLIPROXY_API_KEY}\"|" \
"$CONFIG"
ESCAPED_API_KEY=$(printf '%s\n' "${CLIPROXY_API_KEY}" | @sed@ -e 's/[&\\|]/\\&/g')
@sed@ -i \
-e "s|^# api-keys:|api-keys:|" \
-e "s|^# - \"__CLIPROXY_API_KEY__\"| - \"$ESCAPED_API_KEY\"|" "$CONFIG"

fi
# Also copy to objectstore config location (cliproxyapi uses this for persistence)
Expand Down
33 changes: 32 additions & 1 deletion spec/cliproxyapi_spec.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,10 +156,41 @@ End
It 'script has Linux-specific api-keys uncommenting logic'
When run bash -c "grep -A 6 'Linux: uncomment and enable api-keys' '$SCRIPT'"
# shellcheck disable=SC2016
The output should include 'if [ "$(uname)" = "Linux" ]'
The output should include 'if [ "$(uname)" = "Linux" ] && [ -n "${CLIPROXY_API_KEY:-}" ]'
The output should include 's|^# api-keys:|api-keys:|'
The output should include 'CLIPROXY_API_KEY'
End

It 'keeps api-keys commented on Linux when CLIPROXY_API_KEY is empty'
# Create test script that simulates Linux behavior with empty key
cat >"$TEMP_HOME/test_linux_empty_apikey.sh" <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
CONFIG_DIR="$HOME/.cli-proxy-api"
TEMPLATE="$CONFIG_DIR/config.template.yaml"
CONFIG="$CONFIG_DIR/config.yaml"
CLIPROXY_API_KEY=""

# Copy template to config
cp "$TEMPLATE" "$CONFIG"

# Simulate Linux behavior with empty key (should NOT uncomment)
if [ -n "${CLIPROXY_API_KEY:-}" ]; then
sed \
-e "s|^# api-keys:|api-keys:|" \
-e "s|^# - \"__CLIPROXY_API_KEY__\"| - \"${CLIPROXY_API_KEY}\"|" \
"$CONFIG" > "$CONFIG.tmp" && mv "$CONFIG.tmp" "$CONFIG"
fi

cat "$CONFIG"
EOF
chmod +x "$TEMP_HOME/test_linux_empty_apikey.sh"

When run bash -c "HOME='$TEMP_HOME' bash '$TEMP_HOME/test_linux_empty_apikey.sh'"
The output should include '# api-keys:'
The output should include '# - "__CLIPROXY_API_KEY__"'
The status should be success
End
Comment on lines +164 to +193

@gemini-code-assist gemini-code-assist Bot Dec 28, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

This is a great test for the empty API key case! To make the tests more robust, consider adding another test case for when CLIPROXY_API_KEY contains special characters that have meaning in sed replacement strings (e.g., &, \, |). This would help ensure the script is resilient against a wider range of possible key values, especially with the proposed fix in start.sh.

End

Describe 'binary detection logic'
Expand Down
Loading