nixos-module: work around upstream language-list caching bug

Migration 2025_08_31_224356_additional_languages_af_ca_id.php runs during `migrate`, before db:seed's LanguageSeeder has populated the other 42 rows of the languages table, and does Cache::forever('languages', Language::all()) - permanently caching just the 3 languages (Afrikaans, Catalan, Indonesian) it sees at that moment. StaticServiceProvider checks this cache key before ever querying the DB again, so every fresh install's language dropdown (e.g. the "Welcome to Invoice Ninja" company setup wizard) was stuck showing only those 3 entries, in their own native-language spelling (ctrans() translates each name using the active locale). Adds an unconditional `invoiceninja-manage cache:forget languages` to invoiceninja-data-setup.service, and a regression test asserting /api/v1/statics returns more than 40 languages. Verified directly: before the fix, a fresh account's statics call returned exactly 3 languages; after, it returns all 45. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
nixos-module: fix caddy Host-header matching for 127.0.0.1/[::1]
2026-09-26 15:17:22 -04:00 · 2026-09-26 14:37:12 -04:00 · 2026-09-26 14:35:53 -04:00 · 2026-09-26 14:33:50 -04:00 · 2026-09-26 13:06:00 -04:00 · 2026-09-26 12:10:41 -04:00
19 changed files with 602 additions and 357 deletions
@@ -0,0 +1,2 @@
+/result
+/nixos.qcow2
@@ -1,11 +0,0 @@
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [2024.07.04] 2024-07-04
-
- Initial release
-
@@ -0,0 +1,139 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What this repo is
+
+A Nix flake that packages [Invoice Ninja](https://github.com/invoiceninja/invoiceninja) (a PHP/Laravel app with a
+separate React frontend) and provides a NixOS module (`services.invoiceninja`) to deploy it as a full service:
+PHP-FPM pool, nginx or Caddy reverse proxy, MariaDB, Redis, a queue-worker systemd unit, and a one-shot
+migration/setup unit.
+
+There is no application source code here — this is packaging/deployment code only. All behavior changes come from
+editing Nix expressions.
+
+## Commands
+
+This project uses `just` (see `justfile`) and Nix directly.
+
+- `just build-vm [proxy]` — cleans previous artifacts and builds the test VM (`nixosConfigurations.test-<proxy>`)
+  via `nom build`. `proxy` is `nginx` (default) or `caddy`.
+- `just boot-vm` — boots the built VM (`result/bin/run-nixos-vm`) in the current terminal. Serves Invoice Ninja on
+  `localhost:8080` (see `QEMU_NET_OPTS` in the `justfile`) with root login `toor`.
+- `just clean` — removes `result`/`nixos.qcow2` and kills any running `qemu` process.
+- `just test` — runs the automated test suite (`nix flake check -L`).
+- `nix build .#invoiceninja` — build just the Invoice Ninja package.
+- `nix build .#checks.x86_64-linux.invoiceninja -L` — run only the automated VM test, with build/test log output.
+- `nix flake check` — evaluate the flake (module options, overlay, package derivation) and run the automated test.
+
+### `tests/`
+
+- `common.nix` — the shared `services.invoiceninja` config used by both the interactive VM and the automated test:
+  imports the module and points at the checked-in test fixtures (`invoice_ninja_test_password`, `test.env`). It's a
+  function taking `{ proxyServer ? "nginx" }` so callers can pick which proxy backend to test.
+- `default.nix` — the interactive VM config (`nixosConfigurations.test-nginx`/`test-caddy` in `flake.nix`), used
+  for manual, click-around verification via `just build-vm [proxy]` / `just boot-vm`. It's also a function taking
+  `{ proxyServer ? "nginx" }`, forwarded straight through to `common.nix`, so `flake.nix` can instantiate one
+  `nixosConfigurations` entry per proxy backend. Adds the qemu-guest profile, a root login, and
+  `nixpkgs.config.allowUnfree = true` (required to build `pkgs.chromium`). It also sets a dummy `fileSystems."/"`
+  and disables `boot.loader.grub` purely to satisfy NixOS's built-in assertions when `nix flake check` evaluates
+  `config.system.build.toplevel` directly — the qemu-vm module overrides both with a tmpfs root and direct kernel
+  boot when actually building `config.system.build.vm` (what `just build-vm` uses), so these values are otherwise
+  unused.
+- `nixos-test.nix` — the automated test (`pkgs.testers.nixosTest`, exposed as `checks.<system>.invoiceninja` in
+  `flake.nix`). Builds its own `pkgs` (with `allowUnfree` baked in — `nixosTest` forbids setting `nixpkgs.config`
+  on a node once `pkgs` is externally supplied) and boots two nodes from `common.nix` — one with
+  `proxyServer = "nginx"`, one with `proxyServer = "caddy"` — so both proxy backends get exercised. The shared
+  assertion suite (factored into a `check_invoiceninja(machine, proxy_unit)` function in the test script) runs
+  against each node: waits for mysql/redis/phpfpm/queue-worker/proxy to be active, checks the
+  `invoiceninja-data-setup` marker files (`.initial-migration`, `.db-seeded`, `.admin-created`) to confirm the
+  one-time setup actually completed (not just that the oneshot unit exited), curls `/` for the app shell, exercises
+  the `invoiceninja-manage` wrapper, and logs in via `/api/v1/login` using the test admin credentials as an
+  end-to-end check that migrations/seeding/account creation all worked. This is the only automated test in the
+  repo — there is no separate unit-test suite.
+
+## Architecture
+
+### `package.nix`
+
+Builds Invoice Ninja in two stages:
+
+1. **`ui`** — the separate `invoiceninja/ui` React frontend repo, built with `buildNpmPackage`. Patches
+   `.env.example` to disable test mode and swaps in `vite.config.ts.react` before building.
+2. **Main package** — built with `php82.buildComposerProject` from the `invoiceninja/invoiceninja` PHP repo. The
+   `ui` build's `dist/` output is copied into `public/` before the PHP build (`preConfigure`), and
+   `public/index.html` is copied to `resources/views/react/index.blade.php` so Laravel serves the React shell.
+
+Both source fetches (`fetchFromGitHub`) run their lockfiles through `npm-lockfile-fix` in `postFetch` to patch
+missing integrity fields — required for `fetchNpmDeps`/`buildNpmPackage` to work with these upstream lockfiles.
+
+Because Laravel needs writable directories that can't live in the read-only Nix store, `postInstall` renames
+`bootstrap` → `bootstrap-static` and `storage` → `storage-static` inside the derivation, then symlinks
+`$out/.env`, `$out/storage`, `$out/public/storage`, and `$out/bootstrap` to paths under the module's `dataDir` /
+`runtimeDir`. This means **the package output is only fully functional when paired with the NixOS module** (or
+something else that populates those runtime paths the same way) — building the package alone will produce
+dangling symlinks.
+
+When bumping the Invoice Ninja or UI version in `package.nix`, all four hashes (`src.hash`, `uiSrc.hash`,
+`ui`'s `npmDepsHash`, and the main package's `vendorHash`/`npmDeps.hash`) generally need to be recomputed —
+expect Nix to report the correct hash on a failed build (or use `nix-prefetch`/`lib.fakeHash` workflow).
+
+### `nixos-module/`
+
+- `default.nix` — the flake's `nixosModules` output. Exposes the `invoiceninja` module and a small
+  `overlayNixpkgsForThisInstance` module that applies the flake's overlay (registers `pkgs.invoiceninja`) to
+  whatever nixpkgs instance imports it.
+- `invoiceninja.nix` — the actual `services.invoiceninja` module. Key structural points:
+  - `cfg.settings` is a submodule with a `freeformType` (`pkgs.formats.keyValue`), so any Laravel `.env` key can be
+    set even if not explicitly declared as an option; explicitly declared options (APP_ENV, MAIL_MAILER,
+    SESSION_DRIVER, etc.) exist mainly to add type-checking/enums and sensible computed defaults (e.g.
+    SESSION_DRIVER/QUEUE_CONNECTION/CACHE_DRIVER default to redis → database → file depending on what's enabled).
+  - **Secrets are deliberately kept out of `cfg.settings`/the Nix store.** `secretFile` (required) and
+    `adminAccount.passwordFile` (required) are consumed via systemd `LoadCredential` in the
+    `invoiceninja-data-setup` service, not written into the generated `.env` derivation. The final `.env` is
+    assembled at activation time by concatenating the Nix-store-rendered non-secret settings with the secret file
+    contents directly on disk in `dataDir`.
+  - `invoiceninja-data-setup.service` (oneshot, runs on every activation) does all first-run and idempotent setup:
+    clears bootstrap/opcode cache, rebuilds `.env`, rsyncs static storage into `dataDir`, symlinks the runtime
+    `app.php`, and guards one-time actions (`migrate`, `db:seed`, admin account creation) behind marker files
+    (`.initial-migration`, `.db-seeded`, `.admin-created`) in `dataDir`. `phpfpm-invoiceninja.service` and
+    `invoiceninja-queue-worker.service` both depend on it. It also unconditionally runs
+    `invoiceninja-manage cache:forget languages` on every activation, working around an upstream bug: migration
+    `2025_08_31_224356_additional_languages_af_ca_id.php` runs during `migrate` (before `db:seed`'s
+    `LanguageSeeder` has populated the other 42 rows) and does `Cache::forever('languages', Language::all())`,
+    permanently caching just the 3 languages it sees at that moment — without this, the language dropdown in
+    the app stays stuck at 3 entries forever, since `StaticServiceProvider` checks that cache key before ever
+    querying the DB again.
+  - `invoiceninja-scheduler.timer`/`.service` run `artisan schedule:run` every minute — this is what drives
+    Invoice Ninja's own internal cron-scheduled jobs (recurring invoices, scheduled reports, etc.); without it the
+    app's dashboard reports "cron jobs are not enabled". Laravel's scheduler is just a dispatcher, so this one
+    timer is sufficient regardless of how many scheduled tasks Invoice Ninja itself defines.
+  - `invoiceninja-manage` is a generated wrapper script (`invoiceninja-manage <artisan-args>`) that `cd`s into the
+    package output and runs `php artisan` as the configured service user (via `sudo` if invoked as another user).
+    It's added to `environment.systemPackages`, so it's the normal way to run artisan commands
+    (`migrate`, `queue:work`, `ninja:create-account`, etc.) by hand on a deployed system.
+  - Both `nginx` and `caddy` proxy backends are supported (`proxy.server`), each independently duplicating the
+    PHP-FPM passthrough config — if changing one, check whether the other needs the same change. Neither sets
+    CORS headers itself: Laravel's own CORS middleware already sends a complete set on every response, and an
+    earlier version of this module additionally set a second, static set of `Access-Control-*` headers at the
+    proxy level, which browsers reject as conflicting duplicates (server-to-server/curl checks don't notice,
+    since only browsers enforce CORS header validation).
+  - Caddy matches vhosts on the exact `Host` header, unlike nginx (where a single vhost acts as the default
+    regardless of `Host`). When `hostname == "localhost"`, the caddy vhost adds `serverAliases` for
+    `127.0.0.1:80`/`[::1]:80` too — otherwise visiting the VM via the IP literal instead of `localhost` matches no
+    vhost and Caddy silently returns an empty `200 OK` (a blank page with no error anywhere).
+  - Chromium is required at runtime for PDF generation (`PDF_GENERATOR=snappdf`, `SNAPPDF_CHROMIUM_PATH`) and is
+    added to the PHP-FPM and data-setup services' `path`.
+
+### `flake.nix`
+
+Standard flake shape: `overlays.default` registers the package, `packages.<system>.invoiceninja` exposes it,
+`nixosModules` re-exports `nixos-module/default.nix`, and `nixosConfigurations.test-nginx`/`test-caddy` each build
+the VM defined in `tests/default.nix` with the corresponding `proxyServer`. Only `x86_64-linux` is currently
+supported.
+
+## Conventions
+
+- Nix files: 2-space indentation (see `.editorconfig`); Unix line endings; final newline required.
+- Prefer `lib.mkDefault`/`lib.mkIf`/`lib.mkMerge` for module config so downstream users can override cleanly —
+  this is used pervasively in `invoiceninja.nix` and should be followed for new options/config.
@@ -1,47 +0,0 @@
-####
-# Target definitions
-####
-
-# Disable echoing of target recipe commands
-# Comment this for debugging
-.SILENT:
-
-# Run target recipes in one shell invocation
-.ONESHELL:
-
-# Since all targets are phony, all targets should be listed here
-# One target per line
-.PHONY: boot-vm \
-	build-vm \
-	clean \
-	format-nix-files \
-	help
-
-# Show the help text
-help:
-	egrep -h '\s##\s' $(MAKEFILE_LIST) \
-		| sort \
-		| awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}'
-
-
-format-nix-files: ## Format nix files using the nixpkgs-fmt tool
-	find . -name "*.nix" -exec nixpkgs-fmt {} \;
-
-clean: ## Clean build artifacts and shutdown running virtual machines
-	rm result > /dev/null 2>&1
-	rm nixos.qcow2 > /dev/null 2>&1
-	pkill qemu
-	exit 0
-
-build-vm: clean ## Build virtual machine for testing
-	nixos-rebuild build-vm \
-		-I nixpkgs=http://nixos.org/channels/nixos-24.05/nixexprs.tar.xz \
-		-I nixos-config=./tests/test-config.nix
-
-boot-vm: ## Run virtual machine in current terminal
-	QEMU_KERNEL_PARAMS=console=ttyS0 \
-	QEMU_NET_OPTS=hostfwd=tcp::8080-:80 \
-	./result/bin/run-nixos-vm \
-		-nographic; \
-	reset
-
@@ -1,13 +0,0 @@
-diff --git a/app/Console/Commands/CreateAccount.php b/app/Console/Commands/CreateAccount.php
-index 228f8e8283..1ff3c54a61 100644
--- a/app/Console/Commands/CreateAccount.php
-+++ b/app/Console/Commands/CreateAccount.php
-@@ -79,7 +79,7 @@ class CreateAccount extends Command
-         $company->save();
- 
-         $account->default_company_id = $company->id;
-        $account->set_react_as_default_ap = true;
-+        $account->set_react_as_default_ap = false;
-         $account->save();
- 
-         $email = $this->option('email') ?? 'admin@example.com';
@@ -3,15 +3,15 @@
    "flake-compat": {
      "flake": false,
      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "edolstra",
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
        "type": "github"
      },
      "original": {
-        "owner": "edolstra",
+        "owner": "NixOS",
        "repo": "flake-compat",
        "type": "github"
      }
@@ -24,11 +24,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1719994518,
-        "narHash": "sha256-pQMhCCHyQGRzdfAkdJ4cIWiw+JNuWsTX7f0ZYSyz0VY=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "9227223f6d922fee3c7b190b2cc238a99527bbb7",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
        "type": "github"
      },
      "original": {
@@ -42,24 +42,17 @@
        "flake-compat": [
          "nix"
        ],
-        "gitignore": [
-          "nix"
-        ],
        "nixpkgs": [
          "nix",
          "nixpkgs"
-        ],
-        "nixpkgs-stable": [
-          "nix",
-          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1721042469,
-        "narHash": "sha256-6FPUl7HVtvRHCCBQne7Ylp4p+dpP3P/OYuzjztZ4s70=",
+        "lastModified": 1783008725,
+        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "f451c19376071a90d8c58ab1a953c6e9840527fd",
+        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
        "type": "github"
      },
      "original": {
@@ -68,39 +61,21 @@
        "type": "github"
      }
    },
-    "libgit2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1715853528,
-        "narHash": "sha256-J2rCxTecyLbbDdsyBWn9w7r3pbKRMkI9E7RvRgAqBdY=",
-        "owner": "libgit2",
-        "repo": "libgit2",
-        "rev": "36f7e21ad757a3dacc58cf7944329da6bc1d6e96",
-        "type": "github"
-      },
-      "original": {
-        "owner": "libgit2",
-        "ref": "v1.8.1",
-        "repo": "libgit2",
-        "type": "github"
-      }
-    },
    "nix": {
      "inputs": {
        "flake-compat": "flake-compat",
        "flake-parts": "flake-parts",
        "git-hooks-nix": "git-hooks-nix",
-        "libgit2": "libgit2",
        "nixpkgs": "nixpkgs",
        "nixpkgs-23-11": "nixpkgs-23-11",
        "nixpkgs-regression": "nixpkgs-regression"
      },
      "locked": {
-        "lastModified": 1735389339,
-        "narHash": "sha256-JfQXQL0MysQSfvbw7xHto9YbqZ1VQLFgus+c4KYt6xg=",
+        "lastModified": 1786478010,
+        "narHash": "sha256-/9wXGp+aLObxqQuOGhDOnbdV0QCRDHH8uSh/4URKVAg=",
        "owner": "NixOS",
        "repo": "nix",
-        "rev": "8a3fc27f1b63a08ac983ee46435a56cf49ebaf4a",
+        "rev": "24b65e35d9d4c9d64c1bd5844a35f2a779356d63",
        "type": "github"
      },
      "original": {
@@ -110,18 +85,15 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1723688146,
-        "narHash": "sha256-sqLwJcHYeWLOeP/XoLwAtYjr01TISlkOfz+NG82pbdg=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "c3d4ac725177c030b1e289015989da2ad9d56af0",
-        "type": "github"
+        "lastModified": 1783148766,
+        "narHash": "sha256-H9+N+GFtsbVC8ZniHliChM7ndizxtqVZs6bnGOLM3WQ=",
+        "rev": "a50de1b7d8a586adc18d2395c19de7d6058e6030",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.4193.a50de1b7d8a5/nixexprs.tar.xz"
      },
      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.05",
-        "repo": "nixpkgs",
-        "type": "github"
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz"
      }
    },
    "nixpkgs-23-11": {
@@ -158,16 +130,16 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1735264675,
-        "narHash": "sha256-MgdXpeX2GuJbtlBrH9EdsUeWl/yXEubyvxM1G+yO4Ak=",
+        "lastModified": 1786430034,
+        "narHash": "sha256-Vux08kA5PICwS2sViCMfwVLAHNoH8TkKAeBo25LjpMI=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "d49da4c08359e3c39c4e27c74ac7ac9b70085966",
+        "rev": "70cc4559b10a6062b05ff1af17e0add065ccaed9",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-26.05",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -1,7 +1,7 @@
 {
-  description = "An Invoice Ninja package and a module which can be added to a NixOS configuration";
+  description = "An Invoice Ninja package and module.";

-  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";

  outputs =
    { self, nixpkgs, nix, }:
@@ -18,19 +18,30 @@
          overlays = overlayList;
        }
      );
-
    in
    rec {
+      nixosConfigurations = {
+        test-nginx = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = [ (import ./tests/default.nix { proxyServer = "nginx"; }) ];
+        };
+        test-caddy = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = [ (import ./tests/default.nix { proxyServer = "caddy"; }) ];
+        };
+      };

-      # A Nixpkgs overlay that provides a 'Invoice Ninja' package.
-      overlays.default = final: prev: { invoice-ninja = final.callPackage ./package.nix { }; };
+      overlays.default = final: prev: { invoiceninja = final.callPackage ./package.nix { }; };

      packages = forEachSystem (system: {
-        invoice-ninja = pkgsBySystem.${system}.invoice-ninja;
-        default = pkgsBySystem.${system}.invoice-ninja;
+        invoiceninja = pkgsBySystem.${system}.invoiceninja;
+        default = pkgsBySystem.${system}.invoiceninja;
+      });
+
+      checks = forEachSystem (system: {
+        invoiceninja = import ./tests/nixos-test.nix { inherit system; nixpkgsPath = nixpkgs; };
      });

      nixosModules = import ./nixos-module { overlays = overlayList; };
-
    };
 }
@@ -0,0 +1,38 @@
+set quiet := true
+
+# Passed to QEMU in boot-vm
+export QEMU_KERNEL_PARAMS := "console=ttyS0"
+export QEMU_NET_OPTS := "hostfwd=tcp::8080-:80"
+export QEMU_OPTS := "-nographic"
+
+[private]
+_default:
+	just --list
+
+[doc('Clean build artifacts and shutdown running virtual machines')]
+[group('maintenance')]
+clean:
+    #!/usr/bin/env bash
+    rm result > /dev/null 2>&1
+    rm nixos.qcow2 > /dev/null 2>&1
+    pkill qemu
+    exit 0
+
+[doc('Build virtual machine for testing (proxy: nginx or caddy)')]
+[group('main')]
+build-vm proxy="nginx": clean
+    nom build ".#nixosConfigurations.test-{{proxy}}.config.system.build.vm"
+
+[doc('Run virtual machine in current terminal')]
+[group('main')]
+boot-vm:
+    #!/usr/bin/env bash
+    [ -x result/bin/run-nixos-vm ] && \
+        ./result/bin/run-nixos-vm
+    reset
+
+[doc('Run the automated NixOS VM test')]
+[group('main')]
+test:
+    nix flake check -L
+
@@ -1,7 +1,7 @@
 { overlays }:

 {
-  invoice-ninja = import ./invoice-ninja.nix;
+  invoiceninja = import ./invoiceninja.nix;
  overlayNixpkgsForThisInstance = 
    { pkgs, ... }: {
      nixpkgs = {
@@ -1,21 +1,20 @@
-{
-  config,
-  lib,
-  modulesPath,
-  options,
-  pkgs,
-  ...
+{ config
+, lib
+, modulesPath
+, options
+, pkgs
+, ...
 }:

 let
-  cfg = config.services.invoice-ninja;
+  cfg = config.services.invoiceninja;
  user = cfg.user;
  group = cfg.group;
-  invoice-ninja = pkgs.callPackage ../package.nix {
+  invoiceninja = pkgs.callPackage ../package.nix {
    inherit (cfg) dataDir runtimeDir;
  };
  configFormat = pkgs.formats.keyValue { };
-  configFile = pkgs.writeText "invoice-ninja-env" (lib.generators.toKeyValue { } cfg.settings);
+  configFile = pkgs.writeText "invoiceninja-env" (lib.generators.toKeyValue { } cfg.settings);

  # PHP environment
  phpPackage = cfg.phpPackage.buildEnv {
@@ -53,8 +52,8 @@ let
  extraPrograms = [ chromium ];

  # Management script
-  invoice-ninja-manage = pkgs.writeShellScriptBin "invoice-ninja-manage" ''
-    cd ${invoice-ninja}
+  invoiceninja-manage = pkgs.writeShellScriptBin "invoiceninja-manage" ''
+    cd ${invoiceninja}
    sudo=exec
    if [[ "$USER" != ${user} ]]; then
      sudo='exec /run/wrappers/bin/sudo -u ${user}'
@@ -63,10 +62,10 @@ let
  '';
 in
 {
-  options.services.invoice-ninja = {
-    enable = lib.mkEnableOption "invoice-ninja";
+  options.services.invoiceninja = {
+    enable = lib.mkEnableOption "invoiceninja";

-    package = lib.mkPackageOption pkgs "invoice-ninja" { };
+    package = lib.mkPackageOption pkgs "invoiceninja" { };

    phpPackage = lib.mkPackageOption pkgs "php82" { };

@@ -94,7 +93,7 @@ in
      '';
    };

-    msmtp.accounts.invoice-ninja = lib.mkOption {
+    msmtp.accounts.invoiceninja = lib.mkOption {
      type = lib.types.attrs;
      default = { };
      example = {
@@ -107,9 +106,9 @@ in
        passwordeval = "cat /secrets/password.txt";
      };
      description = ''
-        Define the msmtp configuration for an invoice-ninja account which
+        Define the msmtp configuration for an invoiceninja account which
        will be used by Invoice Ninja to send email message when
-        `config.services.invoice-ninja.settings.MAIL_MAILER` is `sendmail`.
+        `config.services.invoiceninja.settings.MAIL_MAILER` is `sendmail`.

        It is advised to use the `passwordeval` setting to read the password
        from a secret file to avoid having it written in the world-readable
@@ -125,18 +124,18 @@ in

    dataDir = lib.mkOption {
      type = lib.types.str;
-      default = "/var/lib/invoice-ninja";
+      default = "/var/lib/invoiceninja";
      description = ''
-        State directory of the `invoice-ninja` user which holds
+        State directory of the `invoiceninja` user which holds
        the application's state and data.
      '';
    };

    runtimeDir = lib.mkOption {
      type = lib.types.str;
-      default = "/run/invoice-ninja";
+      default = "/run/invoiceninja";
      description = ''
-        Rutime directory of the `invoice-ninja` user which holds
+        Rutime directory of the `invoiceninja` user which holds
        the application's caches and temporary files.
      '';
    };
@@ -207,7 +206,7 @@ in
        options = {
          APP_NAME = lib.mkOption {
            type = lib.types.str;
-            default = "Invoice Ninja";
+            default = ''"Invoice Ninja"'';
            description = "Your application name - used in client portal title banner";
          };
          APP_DEBUG = lib.mkOption {
@@ -256,13 +255,13 @@ in
          };
          MAIL_SENDMAIL_PATH = lib.mkOption {
            type = lib.types.str;
-            default = ''"/run/wrappers/bin/sendmail -t -a invoice-ninja"'';
+            default = ''"/run/wrappers/bin/sendmail -t -a invoiceninja"'';
            description = ''
              Path to sendmail along with arguments for Invoice Ninja to use when using sendmail
              as mail transport agent.

              :: note
-              The default value will work with the `msmtp.accounts.invoice-ninja` setting. Only
+              The default value will work with the `msmtp.accounts.invoiceninja` setting. Only
              change if you know what your doing.
              ::
            '';
@@ -294,7 +293,7 @@ in
            default =
              if cfg.redis.createLocally then "redis" else (if cfg.database.createLocally then "database" else "file");
            defaultText = lib.literalExpression ''
-              if config.services.invoice-ninja.redis.enable
+              if config.services.invoiceninja.redis.enable
              then "redis"
              else (if config.services.invoie-ninja.database.createLocally then "database" else "file")
            '';
@@ -317,7 +316,7 @@ in
            default =
              if cfg.redis.createLocally then "redis" else (if cfg.database.createLocally then "database" else "sync");
            defaultText = lib.literalExpression ''
-              if config.services.invoice-ninja.redis.enable
+              if config.services.invoiceninja.redis.enable
              then "redis"
              else (if config.services.invoie-ninja.database.createLocally then "database" else "sync")
            '';
@@ -329,7 +328,7 @@ in
              "redis"
            ];
            default = if cfg.redis.createLocally then "redis" else "file";
-            defaultText = lib.literalExpression ''if config.services.invoice-ninja.redis.enable then "redis" else "file"'';
+            defaultText = lib.literalExpression ''if config.services.invoiceninja.redis.enable then "redis" else "file"'';
            description = "Laravel cache driver for Invoice Ninja to use.";
          };
        };
@@ -337,7 +336,7 @@ in
    };

    adminAccount = {
-      createAdmin = lib.mkOption {
+      enable = lib.mkOption {
        type = lib.types.bool;
        default = true;
        description = ''
@@ -347,7 +346,7 @@ in
      };
      email = lib.mkOption {
        type = lib.types.str;
-        default = "example@email.com";
+        default = "admin@email.com";
        description = "Email address of the first (admin) account for this Invoice Ninja installation";
      };
      passwordFile = lib.mkOption {
@@ -423,14 +422,14 @@ in

    users.groups.invoiceninja = lib.mkIf (cfg.group == "invoiceninja") { };

-    environment.systemPackages = [ invoice-ninja-manage ] ++ extraPrograms;
+    environment.systemPackages = [ invoiceninja-manage ] ++ extraPrograms;

    programs.msmtp = lib.mkIf (cfg.settings.MAIL_MAILER == "sendmail") {
      inherit (cfg.msmtp) accounts;
      enable = true;
    };

-    services.invoice-ninja.settings = lib.mkMerge [
+    services.invoiceninja.settings = lib.mkMerge [
      ({
        APP_URL = lib.mkDefault (
          if (cfg.hostname == "localhost") then ("http://" + cfg.hostname) else ("https://" + cfg.hostname)
@@ -452,12 +451,12 @@ in
        DB_USERNAME = lib.mkDefault user;
      })
      (lib.mkIf cfg.redis.createLocally {
-        REDIS_HOST = lib.mkDefault config.services.redis.servers.invoice-ninja.bind;
-        REDIS_PORT = lib.mkDefault config.services.redis.servers.invoice-ninja.port;
+        REDIS_HOST = lib.mkDefault config.services.redis.servers.invoiceninja.bind;
+        REDIS_PORT = lib.mkDefault config.services.redis.servers.invoiceninja.port;
      })
    ];

-    services.phpfpm.pools.invoice-ninja = {
+    services.phpfpm.pools.invoiceninja = {
      inherit user group phpPackage;

      settings = {
@@ -474,7 +473,7 @@ in
      '';
    };

-    services.redis.servers.invoice-ninja = lib.mkIf cfg.redis.createLocally {
+    services.redis.servers.invoiceninja = lib.mkIf cfg.redis.createLocally {
      enable = true;
      port = 6379;
    };
@@ -485,7 +484,7 @@ in
    services.nginx = lib.mkIf (cfg.proxy.server == "nginx") {
      enable = true;

-      recommendedTlsSettings = true;
+      recommendedTlsSettings = (if (cfg.hostname == "localhost") then false else true);
      recommendedGzipSettings = true;
      recommendedProxySettings = true;
      recommendedOptimisation = true;
@@ -495,32 +494,38 @@ in
      virtualHosts."${cfg.hostname}" = lib.mkMerge [
        cfg.proxy.nginxConfig
        {
-          root = lib.mkForce "${invoice-ninja}/public";
-          addSSL = lib.mkForce true;
-          enableACME = lib.mkForce true;
+          root = lib.mkForce "${invoiceninja}/public";
+          addSSL = lib.mkForce (if (cfg.hostname == "localhost") then false else true);
+          enableACME = lib.mkForce (if (cfg.hostname == "localhost") then false else true);
          locations = {
+            # Handle Laravel Routes
            "/".tryFiles = "$uri $uri/ /index.php?$query_string";
-            "/".extraConfig = ''
-              if (!-e $request_filename) {
-                rewrite ^(.+)$ /index.php?q=$1 last;
-              }
-              add_header 'Access-Control-Allow-Origin' '*';
-              add_header 'Access-Control-Allow-Methods' '*';
-              add_header 'Access-Control-Max-Age' 0;
-              add_header 'Content-Length' 0;
-              add_header 'Access-Control-Allow-Headers' 'X-API-COMPANY-KEY,X-API-SECRET,X-API-TOKEN,X-API-PASSWORD,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Disposition,Content-Type,Range,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE';
-              add_header 'Access-Control-Expose-Headers' 'X-APP-VERSION,X-MINIMUM-CLIENT-VERSION,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE';
-              add_header 'Access-Control-Allow-Credentials' false;
-            '';
-            "~ \\.php$".extraConfig = "return 403;";
-            "= /index.php".extraConfig = ''
-              fastcgi_pass unix:${config.services.phpfpm.pools.invoice-ninja.socket};
+
+            # PHP Processing
+            "~ \\.php$".extraConfig = ''
+              include ${config.services.nginx.package}/conf/fastcgi_params;
+              fastcgi_param SCRIPT_FILENAME $request_filename;
+              fastcgi_split_path_info ^(.+\.php)(/.+)$;
+              fastcgi_pass unix:${config.services.phpfpm.pools.invoiceninja.socket};
+              fastcgi_index index.php;
            '';
+
+            # Security: Deny access to hidden files
            "~ /\\.ht".extraConfig = "deny all;";
+
+            # Static Files Caching
+            "~* \\.(jpg|jpeg|png|gif|ico|css|js)$".extraConfig = ''
+              expires 1y;
+              add_header Cache-Control "public, immutable";
+            '';
          };
          extraConfig = ''
-            index index.html index.htm index.php;
+            index index.php index.html index.htm;
            error_page 404 /index.php;
+
+            if (!-e $request_filename) {
+              rewrite ^(.+)$ /index.php?q= last;
+            }
          '';
        }
        (lib.mkIf (cfg.hostname != "localhost") {
@@ -533,35 +538,42 @@ in
    users.users."${config.services.caddy.user}" = lib.mkIf (cfg.proxy.server == "caddy") {
      extraGroups = [ cfg.group ];
    };
-    services.caddy = lib.mkIf (cfg.proxy.server == "caddy") {
-      enable = true;
+    services.caddy = 
+      let
+        proto_hostname = (
+          if (cfg.hostname == "localhost")
+          then (cfg.hostname + ":80")
+          else (cfg.hostname + ":443")
+        );
+      in
+      lib.mkIf (cfg.proxy.server == "caddy") {
+        enable = true;

-      globalConfig = lib.mkIf (cfg.hostname == "localhost") ''
-        auto_https disable_redirects
-      '';
+        globalConfig = lib.mkIf (cfg.hostname == "localhost") ''
+          auto_https disable_redirects
+        '';

-      virtualHosts."${cfg.hostname}" = lib.mkMerge [
-        cfg.proxy.caddyConfig
-        {
-          hostName = lib.mkForce cfg.hostname;
-          extraConfig = ''
-            encode zstd gzip
-            root * ${invoice-ninja}/public
-            php_fastcgi unix/${config.services.phpfpm.pools.invoice-ninja.socket}
-            try_files {path} /index.html
-            header {
-              Access-Control-Allow-Origin "*"
-              Access-Control-Allow-Methods "*"
-              Access-Control-Max-Age "0"
-              Access-Control-Allow-Headers "X-API-COMPANY-KEY,X-API-SECRET,X-API-TOKEN,X-API-PASSWORD,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Disposition,Content-Type,Range,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE"
-              Access-Control-Expose-Headers "X-APP-VERSION,X-MINIMUM-CLIENT-VERSION,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE"
-              Access-Control-Allow-Credentials false
-            }
-            file_server
-          '';
-        }
-      ];
-    };
+        virtualHosts."${proto_hostname}" = lib.mkMerge [
+          cfg.proxy.caddyConfig
+          {
+            hostName = lib.mkForce proto_hostname;
+            # Caddy matches vhosts on the exact Host header, unlike nginx's single-vhost-is-default
+            # behavior. For local dev, accept requests to 127.0.0.1/[::1] too - otherwise visiting
+            # via the IP literal instead of "localhost" hits no vhost and gets an empty 200 response
+            # (a silent white screen, no error anywhere).
+            serverAliases = lib.mkIf (cfg.hostname == "localhost") [
+              "127.0.0.1:80"
+              "[::1]:80"
+            ];
+            extraConfig = ''
+              encode zstd gzip
+              root ${invoiceninja}/public
+              php_fastcgi unix/${config.services.phpfpm.pools.invoiceninja.socket}
+              file_server
+            '';
+          }
+        ];
+      };

    services.mysql = lib.mkIf (cfg.database.createLocally) {
      enable = lib.mkDefault true;
@@ -577,33 +589,59 @@ in
      ];
    };

-    systemd.services.phpfpm-invoice-ninja.after = [ "invoice-ninja-data-setup.service" ];
-    systemd.services.phpfpm-invoice-ninja.requires = [
-      "invoice-ninja-data-setup.service"
+    systemd.services.phpfpm-invoiceninja.after = [ "invoiceninja-data-setup.service" ];
+    systemd.services.phpfpm-invoiceninja.requires = [
+      "invoiceninja-data-setup.service"
    ] ++ lib.optional cfg.database.createLocally "mysql.service";
    # Ensure chromium is available
-    systemd.services.phpfpm-invoice-ninja.path = extraPrograms;
+    systemd.services.phpfpm-invoiceninja.path = extraPrograms;

-    systemd.services.invoice-ninja-queue-worker = {
+    systemd.services.invoiceninja-queue-worker = {
      description = "Invoice Ninja periodic tasks";
-      after = [ "invoice-ninja-data-setup.service" ];
-      requires = [ "phpfpm-invoice-ninja.service" ];
+      after = [ "invoiceninja-data-setup.service" ];
+      requires = [ "phpfpm-invoiceninja.service" ];
      wantedBy = [ "multi-user.target" ];
-      reloadTriggers = [ invoice-ninja ];
-      reload = "${invoice-ninja-manage}/bin/invoice-ninja-manage queue:restart";
+      reloadTriggers = [ invoiceninja ];
+      reload = "${invoiceninja-manage}/bin/invoiceninja-manage queue:restart";

      serviceConfig = {
-        ExecStart = "${invoice-ninja-manage}/bin/invoice-ninja-manage queue:work ${
+        ExecStart = "${invoiceninja-manage}/bin/invoiceninja-manage queue:work ${
          lib.strings.optionalString (cfg.settings.QUEUE_CONNECTION == "redis") "redis"
        }";
        User = user;
        Group = group;
-        StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/invoice-ninja") "invoice-ninja";
+        StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/invoiceninja") "invoiceninja";
        Restart = "always";
      };
    };

-    systemd.services.invoice-ninja-data-setup = {
+    systemd.services.invoiceninja-scheduler = {
+      description = "Invoice Ninja scheduled tasks (artisan schedule:run)";
+      after = [ "invoiceninja-data-setup.service" ];
+      requires = [ "phpfpm-invoiceninja.service" ];
+      # Ensure chromium is available, for any scheduled tasks that generate PDFs.
+      path = extraPrograms;
+
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${invoiceninja-manage}/bin/invoiceninja-manage schedule:run";
+        User = user;
+        Group = group;
+        StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/invoiceninja") "invoiceninja";
+      };
+    };
+
+    systemd.timers.invoiceninja-scheduler = {
+      description = "Run Invoice Ninja's scheduled tasks every minute";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "minutely";
+        Persistent = true;
+        Unit = "invoiceninja-scheduler.service";
+      };
+    };
+
+    systemd.services.invoiceninja-data-setup = {
      description = "Invoice Ninja setup: migrations, environment file update, cache reload, data changes";
      wantedBy = [ "multi-user.target" ];
      after = lib.optional cfg.database.createLocally "mysql.service";
@@ -612,7 +650,7 @@ in
        with pkgs;
        [
          bash
-          invoice-ninja-manage
+          invoiceninja-manage
          rsync
          config.services.mysql.package
        ]
@@ -622,7 +660,7 @@ in
        Type = "oneshot";
        User = user;
        Group = group;
-        StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/invoice-ninja") "invoice-ninja";
+        StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/invoiceninja") "invoiceninja";
        StateDirectoryMode = "0750";
        LoadCredential = [
          "env-secrets:${cfg.secretFile}"
@@ -645,38 +683,41 @@ in
        cat "$CREDENTIALS_DIRECTORY/env-secrets" >> ${cfg.dataDir}/.env

        # Link the static storage (package provided) to the runtime storage
-        # Necessary for cities.json and static images.
-        rsync -av --no-perms ${invoice-ninja}/storage-static/ ${cfg.dataDir}/storage
-
-        # Link the static vendor/bin (package provided) to the runtime vendor/bin
-        # Necessary for cities.json and static images.
-        rsync -av --no-perms ${invoice-ninja}/vendor/bin-static/ ${cfg.dataDir}/vendor/bin
+        rsync -av --no-perms ${invoiceninja}/storage-static/ ${cfg.dataDir}/storage

        # Link the app.php in the runtime folder.
        # We cannot link the cache folder only because bootstrap folder needs to be writeable.
-        ln -sf ${invoice-ninja}/bootstrap-static/app.php ${cfg.runtimeDir}/app.php
+        ln -sf ${invoiceninja}/bootstrap-static/app.php ${cfg.runtimeDir}/app.php

        # Perform the first migration
-        [[ ! -f ${cfg.dataDir}/.initial-migration ]] && invoice-ninja-manage migrate --force && touch ${cfg.dataDir}/.initial-migration
+        [[ ! -f ${cfg.dataDir}/.initial-migration ]] && invoiceninja-manage migrate --force && touch ${cfg.dataDir}/.initial-migration

        # Seed database with records
        # Necessary for languages, currencies, countries, etc.
-        [[ ! -f ${cfg.dataDir}/.db-seeded ]] && invoice-ninja-manage db:seed --force && touch ${cfg.dataDir}/.db-seeded
+        [[ ! -f ${cfg.dataDir}/.db-seeded ]] && invoiceninja-manage db:seed --force && touch ${cfg.dataDir}/.db-seeded
+
+        # Work around an upstream bug: migration 2025_08_31_224356_additional_languages_af_ca_id.php
+        # runs during `migrate` (before db:seed's LanguageSeeder has populated the other 42 rows) and
+        # does `Cache::forever('languages', Language::all())`, permanently caching just the 3 languages
+        # it sees at that moment. Without this, the language list stays stuck at those 3 forever,
+        # since StaticServiceProvider checks this cache key before ever querying the DB again.
+        # Unconditional (not marker-gated) so it also self-heals installs that hit this before the fix.
+        invoiceninja-manage cache:forget languages

        # Create Invoice Ninja admin account
        [[ (! -f ${cfg.dataDir}/.admin-created) && (${
-          if cfg.adminAccount.createAdmin then "true" else "false"
+          if cfg.adminAccount.enable then "true" else "false"
        } == "true") ]] \
-          && invoice-ninja-manage ninja:create-account --email=${cfg.adminAccount.email} --password=$(cat $CREDENTIALS_DIRECTORY/admin-pass) \
+          && invoiceninja-manage ninja:create-account --email=${cfg.adminAccount.email} --password=$(cat $CREDENTIALS_DIRECTORY/admin-pass) \
          && touch ${cfg.dataDir}/.admin-created

-        invoice-ninja-manage route:cache
-        invoice-ninja-manage view:cache
-        invoice-ninja-manage config:cache
+        invoiceninja-manage route:cache
+        invoiceninja-manage view:cache
+        invoiceninja-manage config:cache
      '';
    };

-    systemd.tmpfiles.settings."10-invoice-ninja" =
+    systemd.tmpfiles.settings."10-invoiceninja" =
      lib.attrsets.genAttrs
        [
          cfg.dataDir
@@ -1,62 +1,119 @@
-{ lib
-, php
-, openssl
-, writers
+{ buildNpmPackage
+, npmHooks
 , fetchFromGitHub
-, dataDir ? "/var/lib/invoice-ninja"
-, runtimeDir ? "/run/invoice-ninja"
+, fetchNpmDeps
+, php82
+, nodejs_22
+, npm-lockfile-fix
+, dataDir ? "/var/lib/invoiceninja"
+, runtimeDir ? "/run/invoiceninja"
 }:

-php.buildComposerProject (finalAttrs: {
-  pname = "invoice-ninja";
-  version = "5.11.4";
+let
+  pname = "invoiceninja";

+  version = "5.13.19";
  src = fetchFromGitHub {
-    owner = "invoiceninja";
-    repo = "invoiceninja";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-F2LICmDflAM3qIqmE9n3tAbOpSttEY4pQxPWNWZMWMA=";
+    name = "${pname}";
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-pvZNTiGGX6OqOEqcDrDqqpLD1Ohc/TA4nIRjm2jEp74=";
+
+    postFetch = ''
+      # add missing integrity fields to lockfile
+      ${npm-lockfile-fix}/bin/npm-lockfile-fix $out/package-lock.json
+    '';
  };

-  vendorHash = "sha256-RA7IkPXz1HdqQAyB/VIbYg3BmCnlJKLxIVtODIRmZxg=";
+  uiVersion = "03.05.2026.1";
+  uiSrc = fetchFromGitHub {
+    name = "${pname}-ui";
+    owner = pname;
+    repo = "ui";
+    tag = uiVersion;
+    hash = "sha256-BTaWNHTE+9NvavUYs56DdJHmqXy36N5k/crj3rU2Npg=";

-  # Patch sources for more restrictive permissions
-  patches = [
-    ./disable-react-for-admin.patch
+    postFetch = ''
+      # add missing integrity fields to lockfile
+      ${npm-lockfile-fix}/bin/npm-lockfile-fix $out/package-lock.json
+    '';
+  };
+  
+  # React frontend
+  ui = buildNpmPackage {
+    pname = "${pname}-ui";
+    version = uiVersion;
+    src = uiSrc;
+
+    nodejs = nodejs_22;
+  
+    npmDepsHash = "sha256-JA5TfXeg7iHVjQdjeU6SSD2JFSLISad8hPowaR1roQw=";
+
+    preConfigure = ''
+      sed -i 's/VITE_IS_TEST=true/VITE_IS_TEST=false/' .env.example
+
+      cp .env.example .env
+      cp ${src}/vite.config.ts.react ./vite.config.js
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir $out
+      cp -a * $out
+
+      runHook postInstall
+    '';
+  };
+in
+
+php82.buildComposerProject (finalAttrs: {
+  inherit src version;
+  pname = "${pname}-composer";
+
+  nativeBuildInputs = [
+    nodejs_22
+    npmHooks.npmConfigHook
+    npmHooks.npmBuildHook
  ];

+  vendorHash = "sha256-2CyWKlyCyoCt/WdY7Ta0oEXW2KIkGwhilHtzpBJ5Wnk=";
+
  # Upstream composer.json has invalid license, webpatser/laravel-countries package is pointing
  # to commit-ref, and php required in require and require-dev
  composerStrictValidation = false;

+  CYPRESS_INSTALL_BINARY = 0;
+
+  npmDeps = fetchNpmDeps {
+    name = "${pname}-${version}-npm-deps";
+    inherit src;
+    hash = "sha256-WCadsQVj9eusYWJEOaEp5DIkVcbmPFGe6bmKi9NZDDg=";
+  };
+
+  preConfigure = ''
+    cp -r ${ui}/dist/* public/
+    cp public/index.html resources/views/react/index.blade.php
+  '';
+
  postInstall = ''
    mv "$out/share/php/${finalAttrs.pname}"/* $out
-    rm -R $out/bootstrap/cache

+    # Remove JS/CSS build artifacts
+    rm -rf $out/node_modules
+
+    rm -r $out/bootstrap/cache
    rm -rf $out/public/storage

    # Move static contents for the NixOS module to pick it up, if needed.
    mv $out/bootstrap $out/bootstrap-static
    mv $out/storage $out/storage-static
-    mv $out/vendor/bin $out/vendor/bin-static

    # Link NixOS module files to derivation output
    ln -s ${dataDir}/.env $out/.env
    ln -s ${dataDir}/storage $out/
    ln -s ${dataDir}/storage/app/public $out/public/storage
-    ln -s ${dataDir}/vendor/bin $out/vendor
    ln -s ${runtimeDir} $out/bootstrap
  '';
-
-  meta = {
-    description = "Open-source, self-hosted invoicing application";
-    homepage = "https://www.invoiceninja.com/";
-    license = with lib.licenses; {
-      fullName = "Elastic License 2.0";
-      shortName = "Elastic-2.0";
-      free = false;
-    };
-    platforms = lib.platforms.all;
-  };
 })
-
@@ -1,26 +0,0 @@
-{ pkgs ? import <nixpkgs> { config.allowUnfree = true; }
-, lib ? import <nixpkgs/lib>
-}:
-
-let
-  # Helper script to generate an APP_KEY for .env
-  generate-invoice-ninja-app-key = pkgs.writers.writeBashBin "generate-laravel-key" ''
-    echo "APP_KEY=base64:$(${pkgs.openssl}/bin/openssl rand -base64 32)"
-  '';
-
-  # Invoice Ninja derivation
-  # Add to buildInputs to test in nix-shell environment
-  invoice-ninja = pkgs.callPackage ./default.nix {
-    inherit lib;
-    php = pkgs.php;
-    openssl = pkgs.openssl;
-    fetchFromGitHub = pkgs.fetchFromGitHub;
-  };
-in
-pkgs.mkShell {
-  buildInputs = [
-    generate-invoice-ninja-app-key
-    pkgs.nixpkgs-fmt
-  ];
-}
-  
@@ -0,0 +1,16 @@
+{ proxyServer ? "nginx" }:
+{ ... }:
+
+{
+  imports = [ ../nixos-module/invoiceninja.nix ];
+
+  services.invoiceninja = {
+    enable = true;
+    proxy.server = proxyServer;
+    adminAccount.passwordFile = ./invoice_ninja_test_password;
+    secretFile = ./test.env;
+    settings.APP_DEBUG = true;
+  };
+
+  networking.firewall.enable = false;
+}
@@ -0,0 +1,29 @@
+{ proxyServer ? "nginx" }:
+{ pkgs, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+    (import ./common.nix { inherit proxyServer; })
+  ];
+
+  # Required to build pkgs.chromium, which the module pulls in for PDF generation.
+  nixpkgs.config.allowUnfree = true;
+
+  # `nix flake check` evaluates config.system.build.toplevel directly, which asserts a real root
+  # filesystem and bootloader are configured. `just build-vm` builds config.system.build.vm
+  # instead, where the qemu-vm module overrides both of these with a tmpfs root and direct
+  # kernel boot (virtualisation.useBootLoader defaults to false) - so these values just need to
+  # satisfy the assertions and are otherwise unused.
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+  };
+  boot.loader.grub.enable = false;
+
+  users.users.root = {
+    initialPassword = "toor";
+  };
+
+  services.resolved.enable = true;
+}
@@ -0,0 +1 @@
+password
@@ -0,0 +1,90 @@
+{ nixpkgsPath, system }:
+
+let
+  # nixosTest forbids setting `nixpkgs.config` on a node once `pkgs` is externally supplied,
+  # so allowUnfree (required to build pkgs.chromium) has to be baked into this pkgs instance
+  # up front rather than set from within common.nix like the interactive VM does.
+  pkgs = import nixpkgsPath {
+    inherit system;
+    config.allowUnfree = true;
+  };
+
+  adminEmail = "admin@email.com";
+  adminPassword = pkgs.lib.strings.trim (builtins.readFile ./invoice_ninja_test_password);
+in
+pkgs.testers.nixosTest {
+  name = "invoiceninja";
+
+  nodes = {
+    nginx.imports = [ (import ./common.nix { proxyServer = "nginx"; }) ];
+    caddy.imports = [ (import ./common.nix { proxyServer = "caddy"; }) ];
+  };
+
+  testScript = ''
+    import json
+
+    def check_invoiceninja(machine, proxy_unit):
+        machine.wait_for_unit("mysql.service")
+        machine.wait_for_unit("redis-invoiceninja.service")
+        machine.wait_for_unit("phpfpm-invoiceninja.service")
+        machine.wait_for_unit("invoiceninja-queue-worker.service")
+        machine.wait_for_unit(proxy_unit)
+        machine.wait_for_open_port(80)
+
+        # phpfpm-invoiceninja/invoiceninja-queue-worker both Require= invoiceninja-data-setup,
+        # so systemd already waited for it to finish above. Confirm the one-time setup steps
+        # it guards actually completed, rather than just that the unit exited.
+        with subtest("one-time setup (migrate, seed, admin account) completed"):
+            machine.succeed("test -f /var/lib/invoiceninja/.initial-migration")
+            machine.succeed("test -f /var/lib/invoiceninja/.db-seeded")
+            machine.succeed("test -f /var/lib/invoiceninja/.admin-created")
+
+        with subtest("application shell is served over HTTP"):
+            response = machine.succeed("curl -sf http://localhost/")
+            assert "Invoice Ninja" in response, f"unexpected response from /: {response}"
+
+        with subtest("web UI login page is served"):
+            # The UI is a client-side-routed React SPA, so curl (no JS) only sees the same
+            # index.html shell as "/" - this confirms the proxy/Laravel resolve the /login route
+            # to that shell instead of 404ing, which is what a browser needs before it can
+            # render the actual login form.
+            login_page = machine.succeed("curl -sf http://localhost/login")
+            assert "Invoice Ninja" in login_page, f"unexpected response from /login: {login_page}"
+
+        with subtest("invoiceninja-manage wrapper can run artisan commands"):
+            machine.succeed("invoiceninja-manage migrate:status")
+
+        with subtest("scheduler timer is enabled and schedule:run succeeds"):
+            # Without this, the app's dashboard reports "cron jobs are not enabled".
+            machine.succeed("systemctl is-active invoiceninja-scheduler.timer")
+            machine.succeed("systemctl start --wait invoiceninja-scheduler.service")
+
+        with subtest("admin account can log in via the API"):
+            login_response = machine.succeed(
+                "curl -sf -X POST http://localhost/api/v1/login "
+                + "-H 'Content-Type: application/json' "
+                + "-d '{\"email\":\"${adminEmail}\",\"password\":\"${adminPassword}\"}'"
+            )
+            assert "${adminEmail}" in login_response, f"login did not succeed: {login_response}"
+
+        with subtest("full language list is available, not just the af/ca/id migration's 3"):
+            # Regression check: migration 2025_08_31_224356_additional_languages_af_ca_id.php runs
+            # during `migrate`, before db:seed's LanguageSeeder has populated the other 42 rows, and
+            # does Cache::forever('languages', Language::all()) - permanently caching just the 3
+            # languages it sees at that moment. invoiceninja-data-setup works around this with
+            # `invoiceninja-manage cache:forget languages`; this confirms the workaround is in place.
+            token = json.loads(login_response)["data"][0]["token"]["token"]
+            statics = machine.succeed(
+                f"curl -sf http://localhost/api/v1/statics -H 'X-API-TOKEN: {token}'"
+            )
+            language_count = len(json.loads(statics)["languages"])
+            assert language_count > 40, f"expected ~45 languages, got {language_count}"
+
+
+    nginx.start()
+    caddy.start()
+
+    check_invoiceninja(nginx, "nginx.service")
+    check_invoiceninja(caddy, "caddy.service")
+  '';
+}
@@ -1,53 +0,0 @@
-{ modulesPath, ... }:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-    ../invoice-ninja.nix
-  ];
-
-  system.stateVersion = "24.05";
-
-  nixpkgs.config.allowUnfree = true;
-
-  environment.etc."msmtp-password" = {
-    enable = true;
-    user = "invoiceninja";
-    group = "invoiceninja";
-    mode = "0440";
-    text = ''
-      3t5h638t3a7y7275
-
-    '';
-  };
-
-  users.users.test = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" ];
-    initialPassword = "test";
-  };
-
-  services.invoice-ninja = {
-    enable = true;
-    database.createLocally = true;
-    webserver.caddy.enable = true;
-    webserver.nginx.enable = false;
-    mail.mailFromName = "Andrew Bryant";
-    adminEmail = "billing@allpawcare.com";
-    msmtp.accounts.invoice-ninja = {
-      auth = true;
-      tls = true;
-      tls_starttls = false;
-      from = "billing@allpawcare.com";
-      host = "smtp.fastmail.com";
-      port = 465;
-      user = "awkawb@awkawb.cloud";
-      passwordeval = "cat /etc/msmtp-password";
-    };
-    secretFile = ./test-secrets.env;
-  };
-
-  networking.firewall.enable = false;
-
-  services.resolved.enable = true;
-}
@@ -1 +0,0 @@
-test
Author	SHA1	Message	Date
awkawbandClaude Sonnet 5	7d7d717745	nixos-module: work around upstream language-list caching bug Migration 2025_08_31_224356_additional_languages_af_ca_id.php runs during `migrate`, before db:seed's LanguageSeeder has populated the other 42 rows of the languages table, and does Cache::forever('languages', Language::all()) - permanently caching just the 3 languages (Afrikaans, Catalan, Indonesian) it sees at that moment. StaticServiceProvider checks this cache key before ever querying the DB again, so every fresh install's language dropdown (e.g. the "Welcome to Invoice Ninja" company setup wizard) was stuck showing only those 3 entries, in their own native-language spelling (ctrans() translates each name using the active locale). Adds an unconditional `invoiceninja-manage cache:forget languages` to invoiceninja-data-setup.service, and a regression test asserting /api/v1/statics returns more than 40 languages. Verified directly: before the fix, a fresh account's statics call returned exactly 3 languages; after, it returns all 45. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-26 15:17:22 -04:00
awkawbandClaude Sonnet 5	d7fea37e25	nixos-module: fix caddy Host-header matching for 127.0.0.1/[::1] Caddy strictly matches vhosts on the exact Host header, unlike nginx where a single vhost acts as the default regardless of Host. With hostname = "localhost" (the local-dev default), visiting the VM via http://127.0.0.1:PORT instead of http://localhost:PORT sent a Host header matching no vhost, and Caddy silently returned an empty 200 OK - a genuine white screen with no error anywhere (not in the console, not in the network tab). Adds serverAliases for 127.0.0.1:80 and [::1]:80 to the caddy vhost when hostname is "localhost", so all three ways of reaching the local VM resolve to the same site block. Verified directly: before this fix, curl with `Host: 127.0.0.1` got an empty response while `Host: localhost` got the full app shell; after, all three (localhost, 127.0.0.1, [::1]) return the same 200 response. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-26 14:37:12 -04:00
awkawbandClaude Sonnet 5	a71ccc87bb	nixos-module: remove proxy-level CORS headers Laravel's own CORS middleware already sends a complete, correct set of Access-Control-* headers on every response. The nginx and caddy vhost configs were additionally setting a second, static set of the same headers, producing duplicates with conflicting values (e.g. two Access-Control-Allow-Methods headers, one "*" and one the app's real list). Browsers reject responses with duplicate/conflicting CORS headers - curl-based checks never noticed since only browsers enforce CORS header validation, but it broke real browser usage (login/API calls failing silently). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-26 14:35:53 -04:00
awkawbandClaude Sonnet 5	4c97391a33	tests: exercise both nginx and caddy proxy backends Parameterizes tests/common.nix and tests/default.nix on proxyServer (default "nginx"), giving flake.nix two nixosConfigurations (test-nginx/test-caddy) and `just build-vm [proxy]` a way to pick between them for interactive testing. The automated nixosTest now boots one node per proxy backend and runs the full assertion suite (factored into check_invoiceninja()) against each, so a regression in either nginx or caddy's config gets caught. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-26 14:33:50 -04:00
awkawbandClaude Sonnet 5	fef9406b63	nixos-module: add scheduler timer for artisan schedule:run Invoice Ninja relies on Laravel's scheduler for recurring invoices, scheduled reports, and other internal cron-driven jobs. Without a systemd unit invoking `artisan schedule:run` periodically, the app's dashboard reports "cron jobs are not enabled" after login. Adds invoiceninja-scheduler.timer (every minute, matching upstream's documented cron cadence) and its oneshot service, and extends the automated test to assert the timer is active and schedule:run succeeds. Note: the app's own is_scheduler_running flag only flips on a 5-minute wall-clock boundary (app/Console/Kernel.php's everyFiveMinutes() job), so the dashboard warning can take a few minutes to clear after boot - confirmed working via the "Refresh Data" button in that same modal. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-26 13:06:00 -04:00
awkawbandClaude Sonnet 5	2c0a48b899	Add automated NixOS VM test and CLAUDE.md Adds a pkgs.testers.nixosTest (checks.<system>.invoiceninja) that boots the module end-to-end and checks that mysql/redis/phpfpm/queue-worker/ nginx come up, the one-time migrate/seed/admin-create setup completed, the app shell and /login page are served, invoiceninja-manage works, and the seeded admin can log in via the API. Factors the shared services.invoiceninja config used by both the interactive VM and the new test into tests/common.nix, and satisfies NixOS's fileSystems/bootloader assertions in the interactive VM config so `nix flake check` evaluates nixosConfigurations.test cleanly (the qemu-vm module already overrides both when actually building config.system.build.vm, so this only affects the toplevel-eval path). Also adds a `just test` recipe, a CLAUDE.md codebase overview, and a .gitignore for the result/nixos.qcow2 build artifacts. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-26 12:10:41 -04:00
awkawb	d7633e66ce	flake.lock: updated nixpkgs input	2026-08-14 16:18:30 -04:00
awkawb	f6e5c15afd	flake.nix: updated nixpkgs input to latest NixOS release	2026-08-14 16:18:03 -04:00
awkawb	df90f25778	tests/default.nix: removed user test, added password declaration for root user This makes testing/debugging easier by allowing to login as root directly. The previous test system configuration added a step to this process by forcing devs to login as test and use sudo to escalate to root.	2026-08-14 16:15:55 -04:00
awkawb	554f73d477	tests/default.nix: removed system.stateVersion declaration Having the declaration of system.stateVersion just adds more maintainance for devs. For example, changing the nixpkgs value in flake.nix requires a change of system.stateVersion in tests/default.nix.	2026-08-14 16:15:55 -04:00
awkawb	5de2563c0f	flake.lock: updated flake inputs	2026-05-25 19:12:41 -04:00
awkawb	b37f121f06	flake.nix: updated nixpkgs input to version 25.11	2026-05-25 19:11:06 -04:00
awkawb	878134dd4b	nixos-module/invoiceninja.nix: update nginx to work with Invoice Ninja	2026-05-25 19:09:49 -04:00
awkawb	808b9a7fe9	Replaced Makefile with justfile	2026-05-25 19:02:53 -04:00
awkawb	6b0f38d59e	tests/default.nix: updated system.stateVersion	2026-05-25 19:02:21 -04:00
awkawb	fd776bb9b7	package.nix: updated to build Invoice Ninja with React frontend	2026-05-25 19:01:26 -04:00
awkawb	a42d01edd3	package.nix: bumped version to 5.12.13	2025-08-13 18:34:59 -04:00
awkawb	1df11adbde	Merge branch 'master' of gitea.awkawb.cloud:awkawb/invoiceninja-nixos	2025-03-01 11:11:58 -05:00
awkawb	e8b208accb	flake.lock: updated flake inputs	2025-02-24 17:32:32 -05:00
awkawb	295b299fdd	package.nix: bumped version to 5.11.41	2025-02-24 17:29:51 -05:00
awkawb	d898e26cb1	package.nix: bumped version to 5.11.24	2025-01-14 16:54:51 -05:00
awkawb	7b2072e5b0	package.nix: remove unneeded move and link statements	2025-01-02 16:55:02 -05:00
awkawb	611709cb62	nixos-module/invoiceninja.nix: changed nixos module definition for nginx to allow local development, removed unneeded link in data setup service	2025-01-02 16:53:58 -05:00
awkawb	730715014e	tests/default.nix: modified to reflect package name change	2025-01-02 16:22:09 -05:00
awkawb	4bddba21da	flake.nix: fixed attribute name	2025-01-01 16:15:10 -05:00
awkawb	8549d2f23d	Makefile: build-vm now reflects the repo being a flake	2025-01-01 12:19:25 -05:00
awkawb	91d8d8a908	flake.nix: modified to reflect package name change, add nixos config for development	2025-01-01 12:17:55 -05:00
awkawb	2b98375f9b	tests/default.nix: added stateVersion, added import of nixos module, fixed typo	2025-01-01 12:12:59 -05:00
awkawb	4cb4a1c05d	Package is now 'invoiceninja', modified code to reflect name change, changed nixos module definition for caddy to allow local development	2025-01-01 12:11:18 -05:00
awkawb	14976fdae9	Added tests directory for testing in vm	2024-12-30 10:19:29 -05:00
awkawb	1e48f190da	Removed unused files and directories	2024-12-28 16:19:55 -05:00
awkawb	85de24655f	packages.nix: bumped version to 5.11.7	2024-12-28 16:11:25 -05:00
awkawb	9bb2d8f352	package.nix: bumped version to 5.11.6	2024-12-28 16:09:49 -05:00
awkawb	e043ebbaea	package.nix: bumped version to 5.11.5	2024-12-28 15:40:58 -05:00