From fe4a9da1a5f5bcfbf04d6fd7032d6024993b0e62 Mon Sep 17 00:00:00 2001
From: Shun Kakinoki <shunkakinoki@gmail.com>
Date: Mon, 12 Jan 2026 04:52:10 +0900
Subject: [PATCH] fix: guard cliproxyapi auth on restart

---
 .github/workflows/docker.yml                  |  2 +-
 .github/workflows/nix.yml                     |  1 +
 home-manager/services/cliproxyapi/default.nix |  1 +
 .../services/cliproxyapi/scripts/start.sh     | 42 +++++++++++++++++++
 4 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index dc32e0d12..2267ffc4b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -101,7 +101,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v6
         with:
           path: ${{ runner.temp }}/digests
           pattern: digests-*
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 959e93361..7433556ba 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -93,6 +93,7 @@ jobs:
       - nix-flake
       - nix-format
       - nix-linux
+      - nix-nixos
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
diff --git a/home-manager/services/cliproxyapi/default.nix b/home-manager/services/cliproxyapi/default.nix
index cacffc8f6..5952e4080 100644
--- a/home-manager/services/cliproxyapi/default.nix
+++ b/home-manager/services/cliproxyapi/default.nix
@@ -13,6 +13,7 @@ let
 
   startScript = pkgs.replaceVars ./scripts/start.sh {
     sed = "${pkgs.gnused}/bin/sed";
+    aws = "${pkgs.awscli2}/bin/aws";
   };
 
   dockerStartScript = pkgs.writeShellScript "cliproxyapi-docker-start" ''
diff --git a/home-manager/services/cliproxyapi/scripts/start.sh b/home-manager/services/cliproxyapi/scripts/start.sh
index c8c2c9dd5..28d8c105a 100755
--- a/home-manager/services/cliproxyapi/scripts/start.sh
+++ b/home-manager/services/cliproxyapi/scripts/start.sh
@@ -6,6 +6,7 @@ CONFIG_DIR="${HOME}/.cli-proxy-api"
 TEMPLATE="$CONFIG_DIR/config.template.yaml"
 CONFIG="$CONFIG_DIR/config.yaml"
 ENV_FILE="${HOME}/dotfiles/.env"
+AUTH_DIR="${CONFIG_DIR}/objectstore/auths"
 
 if [ -f "$ENV_FILE" ]; then
   set -a
@@ -26,6 +27,47 @@ OBJECTSTORE_SECRET_KEY="$(strip_quotes "${OBJECTSTORE_SECRET_KEY:-}")"
 MANAGEMENT_PASSWORD="${CLIPROXY_MANAGEMENT_PASSWORD:-}"
 export OBJECTSTORE_ENDPOINT OBJECTSTORE_BUCKET OBJECTSTORE_ACCESS_KEY OBJECTSTORE_SECRET_KEY MANAGEMENT_PASSWORD
 
+if [ -n "$OBJECTSTORE_ENDPOINT" ] && [ -n "$OBJECTSTORE_ACCESS_KEY" ] && [ -n "$OBJECTSTORE_SECRET_KEY" ]; then
+  mkdir -p "$AUTH_DIR"
+
+  if [ -z "$(ls -A "$AUTH_DIR" 2>/dev/null)" ]; then
+    echo "⚠️  Local auth cache empty; hydrating from S3" >&2
+    AWS_ACCESS_KEY_ID="$OBJECTSTORE_ACCESS_KEY" \
+      AWS_SECRET_ACCESS_KEY="$OBJECTSTORE_SECRET_KEY" \
+      @aws@ s3 sync \
+      --endpoint-url="$OBJECTSTORE_ENDPOINT" \
+      --no-progress \
+      "s3://${OBJECTSTORE_BUCKET}/auths/" \
+      "$AUTH_DIR/" || true
+
+    AWS_ACCESS_KEY_ID="$OBJECTSTORE_ACCESS_KEY" \
+      AWS_SECRET_ACCESS_KEY="$OBJECTSTORE_SECRET_KEY" \
+      @aws@ s3 sync \
+      --endpoint-url="$OBJECTSTORE_ENDPOINT" \
+      --no-progress \
+      "s3://${OBJECTSTORE_BUCKET}/backup/auths/" \
+      "$AUTH_DIR/" || true
+  fi
+
+  if [ -n "$(ls -A "$AUTH_DIR" 2>/dev/null)" ]; then
+    AWS_ACCESS_KEY_ID="$OBJECTSTORE_ACCESS_KEY" \
+      AWS_SECRET_ACCESS_KEY="$OBJECTSTORE_SECRET_KEY" \
+      @aws@ s3 sync \
+      --endpoint-url="$OBJECTSTORE_ENDPOINT" \
+      --no-progress \
+      "$AUTH_DIR/" \
+      "s3://${OBJECTSTORE_BUCKET}/auths/" || true
+
+    AWS_ACCESS_KEY_ID="$OBJECTSTORE_ACCESS_KEY" \
+      AWS_SECRET_ACCESS_KEY="$OBJECTSTORE_SECRET_KEY" \
+      @aws@ s3 sync \
+      --endpoint-url="$OBJECTSTORE_ENDPOINT" \
+      --no-progress \
+      "$AUTH_DIR/" \
+      "s3://${OBJECTSTORE_BUCKET}/backup/auths/" || true
+  fi
+fi
+
 # Generate config from template
 if [ -f "$TEMPLATE" ]; then
   @sed@ \