package.nix: updated to build Invoice Ninja with React frontend

Added package.json/package-lock.json for use in importNpmLock function
2026-05-18 17:41:34 -04:00 · 2026-05-18 17:36:16 -04:00
15 changed files with 19584 additions and 799 deletions
@@ -1,2 +0,0 @@
-/result
-/nixos.qcow2
@@ -1,155 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## What this repo is
-
-A Nix flake that packages [Invoice Ninja](https://github.com/invoiceninja/invoiceninja) (a PHP/Laravel app with a
-separate React frontend) and provides a NixOS module (`services.invoiceninja`) to deploy it as a full service:
-PHP-FPM pool, nginx or Caddy reverse proxy, MariaDB, Redis, a queue-worker systemd unit, and a one-shot
-migration/setup unit.
-
-There is no application source code here — this is packaging/deployment code only. All behavior changes come from
-editing Nix expressions.
-
-## Commands
-
-This project uses `just` (see `justfile`) and Nix directly.
-
- `just build-vm [proxy]` — cleans previous artifacts and builds the test VM (`nixosConfigurations.test-<proxy>`)
-  via `nom build`. `proxy` is `nginx` (default) or `caddy`.
- `just boot-vm` — boots the built VM (`result/bin/run-nixos-vm`) in the current terminal. Serves Invoice Ninja on
-  `localhost:8080` (see `QEMU_NET_OPTS` in the `justfile`) with root login `toor`.
- `just clean` — removes `result`/`nixos.qcow2` and kills any running `qemu` process.
- `just test` — runs the automated test suite (`nix flake check -L`).
- `nix build .#invoiceninja` — build just the Invoice Ninja package.
- `nix build .#checks.x86_64-linux.invoiceninja -L` — run only the automated VM test, with build/test log output.
- `nix flake check` — evaluate the flake (module options, overlay, package derivation) and run the automated test.
-
-### `tests/`
-
- `common.nix` — the shared `services.invoiceninja` config used by both the interactive VM and the automated test:
-  imports the module and points at the checked-in test fixtures (`invoice_ninja_test_password`, `test.env`). It's a
-  function taking `{ proxyServer ? "nginx" }` so callers can pick which proxy backend to test.
- `default.nix` — the interactive VM config (`nixosConfigurations.test-nginx`/`test-caddy` in `flake.nix`), used
-  for manual, click-around verification via `just build-vm [proxy]` / `just boot-vm`. It's also a function taking
-  `{ proxyServer ? "nginx" }`, forwarded straight through to `common.nix`, so `flake.nix` can instantiate one
-  `nixosConfigurations` entry per proxy backend. Adds the qemu-guest profile and a root login. It also sets a
-  dummy `fileSystems."/"` and disables `boot.loader.grub` purely to satisfy NixOS's built-in assertions when
-  `nix flake check` evaluates
-  `config.system.build.toplevel` directly — the qemu-vm module overrides both with a tmpfs root and direct kernel
-  boot when actually building `config.system.build.vm` (what `just build-vm` uses), so these values are otherwise
-  unused. Also raises `virtualisation.cores`/`memorySize` to 2/2560 (qemu-vm's defaults, 1 core/1024MB, are too
-  tight for real interactive use — see the module architecture notes below on PDF generation's memory cost).
- `nixos-test.nix` — the automated test (`pkgs.testers.nixosTest`, exposed as `checks.<system>.invoiceninja` in
-  `flake.nix`). Builds its own `pkgs` externally (needed regardless of config, since `nixosTest` itself is called
-  as `pkgs.testers.nixosTest`) and boots two nodes from `common.nix` — one with `proxyServer = "nginx"`, one with
-  `proxyServer = "caddy"` — so both proxy backends get exercised. The shared
-  assertion suite (factored into a `check_invoiceninja(machine, proxy_unit)` function in the test script) runs
-  against each node: waits for mysql/redis/phpfpm/queue-worker/proxy to be active, checks the
-  `invoiceninja-data-setup` marker files (`.db-seeded`, `.admin-created`) to confirm the
-  one-time setup actually completed (not just that the oneshot unit exited), curls `/` for the app shell, exercises
-  the `invoiceninja-manage` wrapper, logs in via `/api/v1/login` using the test admin credentials as an
-  end-to-end check that migrations/seeding/account creation all worked, checks the full language list is
-  available (see the `cache:forget languages` note above), and exercises PDF generation end-to-end (POSTs to
-  `/api/v1/preview` with no entity, which falls back to a self-contained mock PDF built via the same
-  chromium/snappdf pipeline real invoices use, and checks for the `%PDF` magic bytes — no client/invoice setup
-  needed). This is the only automated test in the repo — there is no separate unit-test suite.
-
-## Architecture
-
-### `package.nix`
-
-Builds Invoice Ninja in two stages:
-
-1. **`ui`** — the separate `invoiceninja/ui` React frontend repo, built with `buildNpmPackage`. Patches
-   `.env.example` to disable test mode and swaps in `vite.config.ts.react` before building.
-2. **Main package** — built with `php82.buildComposerProject` from the `invoiceninja/invoiceninja` PHP repo. The
-   `ui` build's `dist/` output is copied into `public/` before the PHP build (`preConfigure`), and
-   `public/index.html` is copied to `resources/views/react/index.blade.php` so Laravel serves the React shell.
-
-Both source fetches (`fetchFromGitHub`) run their lockfiles through `npm-lockfile-fix` in `postFetch` to patch
-missing integrity fields — required for `fetchNpmDeps`/`buildNpmPackage` to work with these upstream lockfiles.
-
-Because Laravel needs writable directories that can't live in the read-only Nix store, `postInstall` renames
-`bootstrap` → `bootstrap-static` and `storage` → `storage-static` inside the derivation, then symlinks
-`$out/.env`, `$out/storage`, `$out/public/storage`, and `$out/bootstrap` to paths under the module's `dataDir` /
-`runtimeDir`. This means **the package output is only fully functional when paired with the NixOS module** (or
-something else that populates those runtime paths the same way) — building the package alone will produce
-dangling symlinks.
-
-When bumping the Invoice Ninja or UI version in `package.nix`, all four hashes (`src.hash`, `uiSrc.hash`,
-`ui`'s `npmDepsHash`, and the main package's `vendorHash`/`npmDeps.hash`) generally need to be recomputed —
-expect Nix to report the correct hash on a failed build (or use `nix-prefetch`/`lib.fakeHash` workflow).
-
-### `nixos-module/`
-
- `default.nix` — the flake's `nixosModules` output. Exposes the `invoiceninja` module and a small
-  `overlayNixpkgsForThisInstance` module that applies the flake's overlay (registers `pkgs.invoiceninja`) to
-  whatever nixpkgs instance imports it.
- `invoiceninja.nix` — the actual `services.invoiceninja` module. Key structural points:
-  - `cfg.settings` is a submodule with a `freeformType` (`pkgs.formats.keyValue`), so any Laravel `.env` key can be
-    set even if not explicitly declared as an option; explicitly declared options (APP_ENV, MAIL_MAILER,
-    SESSION_DRIVER, etc.) exist mainly to add type-checking/enums and sensible computed defaults (e.g.
-    SESSION_DRIVER/QUEUE_CONNECTION/CACHE_DRIVER default to redis → database → file depending on what's enabled).
-  - **Secrets are deliberately kept out of `cfg.settings`/the Nix store.** `secretFile` (required) and
-    `adminAccount.passwordFile` (required) are consumed via systemd `LoadCredential` in the
-    `invoiceninja-data-setup` service, not written into the generated `.env` derivation. The final `.env` is
-    assembled at activation time by concatenating the Nix-store-rendered non-secret settings with the secret file
-    contents directly on disk in `dataDir`.
-  - `invoiceninja-data-setup.service` (oneshot, runs on every activation) does all first-run and idempotent setup:
-    clears bootstrap/opcode cache, rebuilds `.env`, rsyncs static storage into `dataDir`, symlinks the runtime
-    `app.php`, runs `migrate --force` unconditionally on every activation (safe/idempotent — Laravel tracks
-    applied migrations in the DB and only runs new ones; this must NOT be marker-gated, since a later invoiceninja
-    version upgrade can ship new migrations that need to run on an already-migrated install), and guards the
-    remaining one-time actions (`db:seed`, admin account creation) behind marker files (`.db-seeded`,
-    `.admin-created`) in `dataDir`. `phpfpm-invoiceninja.service` and
-    `invoiceninja-queue-worker.service` both depend on it. It also unconditionally runs
-    `invoiceninja-manage cache:forget languages` on every activation, working around an upstream bug: migration
-    `2025_08_31_224356_additional_languages_af_ca_id.php` runs during `migrate` (before `db:seed`'s
-    `LanguageSeeder` has populated the other 42 rows) and does `Cache::forever('languages', Language::all())`,
-    permanently caching just the 3 languages it sees at that moment — without this, the language dropdown in
-    the app stays stuck at 3 entries forever, since `StaticServiceProvider` checks that cache key before ever
-    querying the DB again.
-  - `invoiceninja-scheduler.timer`/`.service` run `artisan schedule:run` every minute — this is what drives
-    Invoice Ninja's own internal cron-scheduled jobs (recurring invoices, scheduled reports, etc.); without it the
-    app's dashboard reports "cron jobs are not enabled". Laravel's scheduler is just a dispatcher, so this one
-    timer is sufficient regardless of how many scheduled tasks Invoice Ninja itself defines.
-  - `invoiceninja-manage` is a generated wrapper script (`invoiceninja-manage <artisan-args>`) that `cd`s into the
-    package output and runs `php artisan` as the configured service user (via `sudo` if invoked as another user).
-    It's added to `environment.systemPackages`, so it's the normal way to run artisan commands
-    (`migrate`, `queue:work`, `ninja:create-account`, etc.) by hand on a deployed system.
-  - Both `nginx` and `caddy` proxy backends are supported (`proxy.server`), each independently duplicating the
-    PHP-FPM passthrough config — if changing one, check whether the other needs the same change. Neither sets
-    CORS headers itself: Laravel's own CORS middleware already sends a complete set on every response, and an
-    earlier version of this module additionally set a second, static set of `Access-Control-*` headers at the
-    proxy level, which browsers reject as conflicting duplicates (server-to-server/curl checks don't notice,
-    since only browsers enforce CORS header validation).
-  - Caddy matches vhosts on the exact `Host` header, unlike nginx (where a single vhost acts as the default
-    regardless of `Host`). When `hostname == "localhost"`, the caddy vhost adds `serverAliases` for
-    `127.0.0.1:80`/`[::1]:80` too — otherwise visiting the VM via the IP literal instead of `localhost` matches no
-    vhost and Caddy silently returns an empty `200 OK` (a blank page with no error anywhere).
-  - A headless browser is required at runtime for PDF generation (`PDF_GENERATOR=snappdf`,
-    `SNAPPDF_CHROMIUM_PATH`) and is added to the PHP-FPM and data-setup services' `path`. This is
-    `nixpkgs.playwright-driver`'s `chromium-headless-shell` component (Google's official "Chrome for Testing"
-    headless-only build, selected via `playwright-driver.browsers.override { ... }` with every other
-    browser/ffmpeg disabled) rather than `pkgs.chromium` — snappdf only ever shells out to
-    `$SNAPPDF_CHROMIUM_PATH --headless --print-to-pdf=...`, so the full browser UI/GPU stack `pkgs.chromium` ships
-    is dead weight; the headless-shell closure is ~1.45GB smaller and needs no `allowUnfree`. Each PDF request
-    still launches a full instance of the underlying browser engine (not a lightweight renderer), and PHP-FPM's
-    default `pm.max_children = 8` means up to 8 of these can run concurrently — on a memory-constrained deployment
-    this can exhaust RAM (confirmed: even a couple of concurrent PDF requests OOM-killed a 1024MB VM). Size
-    deployments accordingly, or lower `phpfpm.settings."pm.max_children"`.
-
-### `flake.nix`
-
-Standard flake shape: `overlays.default` registers the package, `packages.<system>.invoiceninja` exposes it,
-`nixosModules` re-exports `nixos-module/default.nix`, and `nixosConfigurations.test-nginx`/`test-caddy` each build
-the VM defined in `tests/default.nix` with the corresponding `proxyServer`. Only `x86_64-linux` is currently
-supported.
-
-## Conventions
-
- Nix files: 2-space indentation (see `.editorconfig`); Unix line endings; final newline required.
- Prefer `lib.mkDefault`/`lib.mkIf`/`lib.mkMerge` for module config so downstream users can override cleanly —
-  this is used pervasively in `invoiceninja.nix` and should be followed for new options/config.
@@ -0,0 +1,45 @@
+####
+# Target definitions
+####
+
+# Disable echoing of target recipe commands
+# Comment this for debugging
+.SILENT:
+
+# Run target recipes in one shell invocation
+.ONESHELL:
+
+# Since all targets are phony, all targets should be listed here
+# One target per line
+.PHONY: boot-vm \
+	build-vm \
+	clean \
+	format-nix-files \
+	help
+
+# Show the help text
+help:
+	egrep -h '\s##\s' $(MAKEFILE_LIST) \
+		| sort \
+		| awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}'
+
+
+format-nix-files: ## Format nix files using the nixpkgs-fmt tool
+	find . -name "*.nix" -exec nixpkgs-fmt {} \;
+
+clean: ## Clean build artifacts and shutdown running virtual machines
+	rm result > /dev/null 2>&1
+	rm nixos.qcow2 > /dev/null 2>&1
+	pkill qemu
+	exit 0
+
+build-vm: clean ## Build virtual machine for testing
+	nix build ".#nixosConfigurations.test.config.system.build.vm"
+
+boot-vm: ## Run virtual machine in current terminal
+	QEMU_KERNEL_PARAMS=console=ttyS0 \
+	QEMU_NET_OPTS=hostfwd=tcp::8080-:80 \
+	QEMU_OPTS=-nographic \
+	./result/bin/run-nixos-vm
+	reset
+
@@ -0,0 +1,13 @@
+diff --git a/app/Console/Commands/CreateAccount.php b/app/Console/Commands/CreateAccount.php
+index 228f8e8283..1ff3c54a61 100644
+--- a/app/Console/Commands/CreateAccount.php
+++ b/app/Console/Commands/CreateAccount.php
+@@ -79,7 +79,7 @@ class CreateAccount extends Command
+         $company->save();
+ 
+         $account->default_company_id = $company->id;
+-        $account->set_react_as_default_ap = true;
+        $account->set_react_as_default_ap = false;
+         $account->save();
+ 
+         $email = $this->option('email') ?? 'admin@example.com';
@@ -3,15 +3,15 @@
    "flake-compat": {
      "flake": false,
      "locked": {
-        "lastModified": 1767039857,
-        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "NixOS",
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
        "type": "github"
      },
      "original": {
-        "owner": "NixOS",
+        "owner": "edolstra",
        "repo": "flake-compat",
        "type": "github"
      }
@@ -24,11 +24,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1782949081,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
        "type": "github"
      },
      "original": {
@@ -42,17 +42,24 @@
        "flake-compat": [
          "nix"
        ],
+        "gitignore": [
+          "nix"
+        ],
        "nixpkgs": [
          "nix",
          "nixpkgs"
+        ],
+        "nixpkgs-stable": [
+          "nix",
+          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1783008725,
-        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
+        "lastModified": 1734279981,
+        "narHash": "sha256-NdaCraHPp8iYMWzdXAt5Nv6sA3MUzlCiGiR586TCwo0=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
+        "rev": "aa9f40c906904ebd83da78e7f328cd8aeaeae785",
        "type": "github"
      },
      "original": {
@@ -71,11 +78,11 @@
        "nixpkgs-regression": "nixpkgs-regression"
      },
      "locked": {
-        "lastModified": 1786478010,
-        "narHash": "sha256-/9wXGp+aLObxqQuOGhDOnbdV0QCRDHH8uSh/4URKVAg=",
+        "lastModified": 1740432616,
+        "narHash": "sha256-2yad3RqbLhCeMK01lpSLXmeZR7J74YeBg4yNAqhzLLk=",
        "owner": "NixOS",
        "repo": "nix",
-        "rev": "24b65e35d9d4c9d64c1bd5844a35f2a779356d63",
+        "rev": "8384e41b7608b5ff50306d3dec6171483cf2d4cd",
        "type": "github"
      },
      "original": {
@@ -85,15 +92,18 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1783148766,
-        "narHash": "sha256-H9+N+GFtsbVC8ZniHliChM7ndizxtqVZs6bnGOLM3WQ=",
-        "rev": "a50de1b7d8a586adc18d2395c19de7d6058e6030",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.4193.a50de1b7d8a5/nixexprs.tar.xz"
+        "lastModified": 1734359947,
+        "narHash": "sha256-1Noao/H+N8nFB4Beoy8fgwrcOQLVm9o4zKW1ODaqK9E=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "48d12d5e70ee91fe8481378e540433a7303dbf6a",
+        "type": "github"
      },
      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz"
+        "owner": "NixOS",
+        "ref": "release-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
      }
    },
    "nixpkgs-23-11": {
@@ -130,16 +140,16 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1786430034,
-        "narHash": "sha256-Vux08kA5PICwS2sViCMfwVLAHNoH8TkKAeBo25LjpMI=",
+        "lastModified": 1740339700,
+        "narHash": "sha256-cbrw7EgQhcdFnu6iS3vane53bEagZQy/xyIkDWpCgVE=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "70cc4559b10a6062b05ff1af17e0add065ccaed9",
+        "rev": "04ef94c4c1582fd485bbfdb8c4a8ba250e359195",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-26.05",
+        "ref": "nixos-24.11",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -1,14 +1,7 @@
 {
  description = "An Invoice Ninja package and module.";

-  nixConfig = {
-    extra-substituters = [ "https://invoiceninja-nixos.cachix.org" ];
-    extra-trusted-public-keys = [
-      "invoiceninja-nixos.cachix.org-1:TmRZaji8FFVjjIw9KZmvLrxMxfP+JDThOyOX04z526A="
-    ];
-  };
-
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";

  outputs =
    { self, nixpkgs, nix, }:
@@ -27,15 +20,9 @@
      );
    in
    rec {
-      nixosConfigurations = {
-        test-nginx = nixpkgs.lib.nixosSystem {
+      nixosConfigurations.test = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
-          modules = [ (import ./tests/default.nix { proxyServer = "nginx"; }) ];
-        };
-        test-caddy = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          modules = [ (import ./tests/default.nix { proxyServer = "caddy"; }) ];
-        };
+        modules = [ ./tests ];
      };

      overlays.default = final: prev: { invoiceninja = final.callPackage ./package.nix { }; };
@@ -45,10 +32,6 @@
        default = pkgsBySystem.${system}.invoiceninja;
      });

-      checks = forEachSystem (system: {
-        invoiceninja = import ./tests/nixos-test.nix { inherit system; nixpkgsPath = nixpkgs; };
-      });
-
      nixosModules = import ./nixos-module { overlays = overlayList; };
    };
 }
@@ -1,52 +0,0 @@
-set quiet := true
-
-# Passed to QEMU in boot-vm
-export QEMU_KERNEL_PARAMS := "console=ttyS0"
-export QEMU_NET_OPTS := "hostfwd=tcp::8080-:80"
-export QEMU_OPTS := "-nographic"
-
-[private]
-_default:
-	just --list
-
-[doc('Clean build artifacts and shutdown running virtual machines')]
-[group('maintenance')]
-clean:
-    #!/usr/bin/env bash
-    rm result > /dev/null 2>&1
-    rm nixos.qcow2 > /dev/null 2>&1
-    pkill qemu
-    exit 0
-
-[doc('Build virtual machine for testing (proxy: nginx or caddy)')]
-[group('main')]
-build-vm proxy="nginx": clean
-    nom build ".#nixosConfigurations.test-{{proxy}}.config.system.build.vm"
-
-[doc('Run virtual machine in current terminal')]
-[group('main')]
-boot-vm:
-    #!/usr/bin/env bash
-    [ -x result/bin/run-nixos-vm ] && \
-        ./result/bin/run-nixos-vm
-    reset
-
-[doc('Run the automated NixOS VM test')]
-[group('main')]
-test:
-    nix flake check -L
-
-[doc('Update invoiceninja and ui to their latest upstream versions, recomputing hashes')]
-[group('maintenance')]
-update:
-    ./scripts/update-versions.sh
-
-[doc('Build the package and automated test, then push results to the invoiceninja-nixos cachix cache')]
-[group('maintenance')]
-push-cache:
-    nix build --print-out-paths --no-link \
-        ".#invoiceninja" \
-        ".#invoiceninja.ui" \
-        ".#checks.x86_64-linux.invoiceninja" \
-        | cachix push invoiceninja-nixos
-
@@ -47,22 +47,8 @@ let
    extraConfig = "memory_limit = 1024M";
  };

-  # A headless browser is required for PDF invoice generation (PDF_GENERATOR=snappdf). snappdf
-  # just shells out to `$SNAPPDF_CHROMIUM_PATH --headless --print-to-pdf=... <url>`, so a full
-  # browser UI/GPU stack isn't needed -- Google's own "Chrome for Testing" headless-only build
-  # (as packaged by nixpkgs' playwright-driver) does the same job for a ~1.45GB smaller closure
-  # than pkgs.chromium, with no allowUnfree requirement.
-  chromiumHeadlessShellBrowsers = pkgs.playwright-driver.browsers.override {
-    withChromium = false;
-    withFirefox = false;
-    withWebkit = false;
-    withFfmpeg = false;
-    withChromiumHeadlessShell = true;
-  };
-  chromium = pkgs.runCommand "chromium-headless-shell" { } ''
-    mkdir -p $out/bin
-    ln -s ${chromiumHeadlessShellBrowsers}/chromium_headless_shell-*/chrome-headless-shell-linux64/chrome-headless-shell $out/bin/chromium
-  '';
+  # Chromium is required for PDF invoice generation
+  chromium = pkgs.chromium;
  extraPrograms = [ chromium ];

  # Management script
@@ -500,6 +486,7 @@ in

      recommendedTlsSettings = (if (cfg.hostname == "localhost") then false else true);
      recommendedGzipSettings = true;
+      recommendedProxySettings = true;
      recommendedOptimisation = true;

      clientMaxBodySize = cfg.maxUploadSize;
@@ -511,34 +498,28 @@ in
          addSSL = lib.mkForce (if (cfg.hostname == "localhost") then false else true);
          enableACME = lib.mkForce (if (cfg.hostname == "localhost") then false else true);
          locations = {
-            # Handle Laravel Routes
            "/".tryFiles = "$uri $uri/ /index.php?$query_string";
-
-            # PHP Processing
-            "~ \\.php$".extraConfig = ''
-              include ${config.services.nginx.package}/conf/fastcgi_params;
-              fastcgi_param SCRIPT_FILENAME $request_filename;
-              fastcgi_split_path_info ^(.+\.php)(/.+)$;
+            "/".extraConfig = ''
+              if (!-e $request_filename) {
+                rewrite ^(.+)$ /index.php?q=$1 last;
+              }
+              add_header 'Access-Control-Allow-Origin' '*';
+              add_header 'Access-Control-Allow-Methods' '*';
+              add_header 'Access-Control-Max-Age' 0;
+              add_header 'Content-Length' 0;
+              add_header 'Access-Control-Allow-Headers' 'X-API-COMPANY-KEY,X-API-SECRET,X-API-TOKEN,X-API-PASSWORD,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Disposition,Content-Type,Range,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE';
+              add_header 'Access-Control-Expose-Headers' 'X-APP-VERSION,X-MINIMUM-CLIENT-VERSION,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE';
+              add_header 'Access-Control-Allow-Credentials' false;
+            '';
+            "~ \\.php$".extraConfig = "return 403;";
+            "= /index.php".extraConfig = ''
              fastcgi_pass unix:${config.services.phpfpm.pools.invoiceninja.socket};
-              fastcgi_index index.php;
            '';
-
-            # Security: Deny access to hidden files
            "~ /\\.ht".extraConfig = "deny all;";
-
-            # Static Files Caching
-            "~* \\.(jpg|jpeg|png|gif|ico|css|js)$".extraConfig = ''
-              expires 1y;
-              add_header Cache-Control "public, immutable";
-            '';
          };
          extraConfig = ''
-            index index.php index.html index.htm;
+            index index.html index.htm index.php;
            error_page 404 /index.php;
-
-            if (!-e $request_filename) {
-              rewrite ^(.+)$ /index.php?q= last;
-            }
          '';
        }
        (lib.mkIf (cfg.hostname != "localhost") {
@@ -570,18 +551,19 @@ in
          cfg.proxy.caddyConfig
          {
            hostName = lib.mkForce proto_hostname;
-            # Caddy matches vhosts on the exact Host header, unlike nginx's single-vhost-is-default
-            # behavior. For local dev, accept requests to 127.0.0.1/[::1] too - otherwise visiting
-            # via the IP literal instead of "localhost" hits no vhost and gets an empty 200 response
-            # (a silent white screen, no error anywhere).
-            serverAliases = lib.mkIf (cfg.hostname == "localhost") [
-              "127.0.0.1:80"
-              "[::1]:80"
-            ];
            extraConfig = ''
              encode zstd gzip
-              root ${invoiceninja}/public
+              root * ${invoiceninja}/public
              php_fastcgi unix/${config.services.phpfpm.pools.invoiceninja.socket}
+              try_files {path} /index.html
+              header {
+                Access-Control-Allow-Origin "*"
+                Access-Control-Allow-Methods "*"
+                Access-Control-Max-Age "0"
+                Access-Control-Allow-Headers "X-API-COMPANY-KEY,X-API-SECRET,X-API-TOKEN,X-API-PASSWORD,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Disposition,Content-Type,Range,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE"
+                Access-Control-Expose-Headers "X-APP-VERSION,X-MINIMUM-CLIENT-VERSION,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE"
+                Access-Control-Allow-Credentials false
+              }
              file_server
            '';
          }
@@ -628,32 +610,6 @@ in
      };
    };

-    systemd.services.invoiceninja-scheduler = {
-      description = "Invoice Ninja scheduled tasks (artisan schedule:run)";
-      after = [ "invoiceninja-data-setup.service" ];
-      requires = [ "phpfpm-invoiceninja.service" ];
-      # Ensure chromium is available, for any scheduled tasks that generate PDFs.
-      path = extraPrograms;
-
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = "${invoiceninja-manage}/bin/invoiceninja-manage schedule:run";
-        User = user;
-        Group = group;
-        StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/invoiceninja") "invoiceninja";
-      };
-    };
-
-    systemd.timers.invoiceninja-scheduler = {
-      description = "Run Invoice Ninja's scheduled tasks every minute";
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnCalendar = "minutely";
-        Persistent = true;
-        Unit = "invoiceninja-scheduler.service";
-      };
-    };
-
    systemd.services.invoiceninja-data-setup = {
      description = "Invoice Ninja setup: migrations, environment file update, cache reload, data changes";
      wantedBy = [ "multi-user.target" ];
@@ -702,24 +658,13 @@ in
        # We cannot link the cache folder only because bootstrap folder needs to be writeable.
        ln -sf ${invoiceninja}/bootstrap-static/app.php ${cfg.runtimeDir}/app.php

-        # Run migrations on every activation, not just the first: `migrate` is idempotent
-        # (Laravel tracks applied migrations in the DB and only runs new ones), and gating this
-        # behind a marker file meant migrations shipped by a later invoiceninja version upgrade
-        # would never run.
-        invoiceninja-manage migrate --force
+        # Perform the first migration
+        [[ ! -f ${cfg.dataDir}/.initial-migration ]] && invoiceninja-manage migrate --force && touch ${cfg.dataDir}/.initial-migration

        # Seed database with records
        # Necessary for languages, currencies, countries, etc.
        [[ ! -f ${cfg.dataDir}/.db-seeded ]] && invoiceninja-manage db:seed --force && touch ${cfg.dataDir}/.db-seeded

-        # Work around an upstream bug: migration 2025_08_31_224356_additional_languages_af_ca_id.php
-        # runs during `migrate` (before db:seed's LanguageSeeder has populated the other 42 rows) and
-        # does `Cache::forever('languages', Language::all())`, permanently caching just the 3 languages
-        # it sees at that moment. Without this, the language list stays stuck at those 3 forever,
-        # since StaticServiceProvider checks this cache key before ever querying the DB again.
-        # Unconditional (not marker-gated) so it also self-heals installs that hit this before the fix.
-        invoiceninja-manage cache:forget languages
-
        # Create Invoice Ninja admin account
        [[ (! -f ${cfg.dataDir}/.admin-created) && (${
          if cfg.adminAccount.enable then "true" else "false"
@@ -0,0 +1,194 @@
+{
+  "name": "@invoiceninja/ui",
+  "version": "03.05.2026.1",
+  "private": true,
+  "dependencies": {
+    "@azure/msal-browser": "^3.28.1",
+    "@docuninja/builder2.0": "^0.0.90",
+    "@emotion/styled": "^11.14.0",
+    "@excalidraw/excalidraw": "^0.18.0",
+    "@fontsource/alex-brush": "^5.2.6",
+    "@fontsource/dancing-script": "^5.2.6",
+    "@fontsource/great-vibes": "^5.2.6",
+    "@fontsource/pacifico": "^5.2.6",
+    "@fontsource/satisfy": "^5.2.6",
+    "@fortawesome/fontawesome-free": "^7.0.1",
+    "@headlessui/react": "^1.7.19",
+    "@headlessui/tailwindcss": "^0.2.2",
+    "@hello-pangea/dnd": "^16.6.0",
+    "@monaco-editor/react": "^4.7.0",
+    "@react-oauth/google": "^0.12.1",
+    "@reduxjs/toolkit": "^1.9.7",
+    "@sentry/react": "^7.120.3",
+    "@sentry/tracing": "^7.120.3",
+    "@stripe/stripe-js": "^4.10.0",
+    "@tinymce/tinymce-react": "^5.1.1",
+    "@tippyjs/react": "^4.2.6",
+    "@tiptap/extension-color": "^3.11.1",
+    "@tiptap/extension-font-family": "^3.11.1",
+    "@tiptap/extension-highlight": "^3.11.1",
+    "@tiptap/extension-image": "^3.12.1",
+    "@tiptap/extension-link": "^3.11.1",
+    "@tiptap/extension-placeholder": "^3.11.1",
+    "@tiptap/extension-strike": "^3.11.1",
+    "@tiptap/extension-subscript": "^3.11.1",
+    "@tiptap/extension-superscript": "^3.11.1",
+    "@tiptap/extension-table": "^3.11.1",
+    "@tiptap/extension-table-cell": "^3.11.1",
+    "@tiptap/extension-table-header": "^3.11.1",
+    "@tiptap/extension-table-row": "^3.11.1",
+    "@tiptap/extension-task-item": "^3.11.1",
+    "@tiptap/extension-task-list": "^3.11.1",
+    "@tiptap/extension-text-align": "^3.11.1",
+    "@tiptap/extension-underline": "^3.11.1",
+    "@tiptap/react": "^3.11.1",
+    "@tiptap/starter-kit": "^3.11.1",
+    "@types/js-beautify": "^1.14.3",
+    "antd": "^5.24.3",
+    "array-move": "^4.0.0",
+    "axios": "^1.8.3",
+    "classnames": "^2.5.1",
+    "collect.js": "^4.36.1",
+    "currency.js": "^2.0.4",
+    "dayjs": "^1.11.13",
+    "deep-object-diff": "^1.1.9",
+    "dompurify": "^3.2.4",
+    "dotenv": "^16.4.7",
+    "driver.js": "^1.4.0",
+    "font-awesome": "^4.7.0",
+    "formik": "^2.4.6",
+    "grapesjs": "^0.22.13",
+    "grapesjs-blocks-basic": "^1.0.2",
+    "grapesjs-parser-postcss": "^1.0.3",
+    "grapesjs-plugin-export": "^1.0.12",
+    "grapesjs-preset-webpage": "^1.0.3",
+    "grapesjs-style-bg": "^2.0.2",
+    "grapesjs-tui-image-editor": "^1.0.2",
+    "hex-color-regex": "^1.1.0",
+    "history": "^5.3.0",
+    "i18next": "^22.5.1",
+    "jotai": "^2.12.2",
+    "js-beautify": "^1.15.4",
+    "js-sha256": "^0.11.0",
+    "katex": "^0.16.22",
+    "lodash": "^4.17.21",
+    "lodash-es": "^4.17.21",
+    "mitt": "^3.0.1",
+    "monaco-editor": "^0.53.0",
+    "papaparse": "^5.5.2",
+    "playwright": "^1.59.0",
+    "pretty-bytes": "^6.1.1",
+    "pusher-js": "^8.4.0",
+    "randexp": "^0.5.3",
+    "react": "^18.3.1",
+    "react-apple-signin-auth": "^1.1.0",
+    "react-colorful": "^5.6.1",
+    "react-date-range": "^1.4.0",
+    "react-datepicker": "^4.25.0",
+    "react-day-picker": "^9.10.0",
+    "react-debounce-input": "^3.3.0",
+    "react-dom": "^18.3.1",
+    "react-dropzone": "^14.3.8",
+    "react-feather": "^2.0.10",
+    "react-hot-toast": "^2.5.2",
+    "react-i18next": "^12.3.1",
+    "react-icons": "^4.12.0",
+    "react-image-crop": "^11.0.10",
+    "react-json-tree": "^0.20.0",
+    "react-markdown": "^10.1.0",
+    "react-number-format": "^5.4.3",
+    "react-phone-number-input": "^3.4.12",
+    "react-qr-code": "^2.0.15",
+    "react-query": "^3.39.3",
+    "react-redux": "^8.1.3",
+    "react-resizable-panels": "^2.1.7",
+    "react-responsive": "^9.0.2",
+    "react-router-dom": "^6.30.0",
+    "react-select": "^5.10.1",
+    "react-string-replace": "^1.1.1",
+    "react-turnstile": "^1.1.4",
+    "react-use": "^17.6.0",
+    "react-verification-input": "^3.3.1",
+    "recharts": "^2.15.1",
+    "rehype-raw": "^7.0.0",
+    "remove": "^0.1.5",
+    "sha256": "^0.2.0",
+    "signature_pad": "^5.0.10",
+    "socket.io-client": "^4.8.3",
+    "styled-components": "^6.1.15",
+    "tailwind-scrollbar": "^3.1.0",
+    "tiptap-extension-font-size": "^1.2.0",
+    "uuid": "^11.1.0",
+    "v": "^0.3.0",
+    "y-websocket": "^3.0.0",
+    "zustand": "^5.0.8"
+  },
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc && vite build",
+    "format": "prettier --write src/",
+    "lint": "eslint src --max-warnings=0",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepare": "husky install",
+    "preview": "vite build && vite preview"
+  },
+  "browserslist": {
+    "production": [
+      ">0.2%",
+      "not dead",
+      "not op_mini all"
+    ],
+    "development": [
+      "last 1 chrome version",
+      "last 1 firefox version",
+      "last 1 safari version"
+    ]
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.22.0",
+    "@faker-js/faker": "^9.0.0",
+    "@playwright/test": "^1.58.2",
+    "@tailwindcss/forms": "^0.5.10",
+    "@tailwindcss/typography": "^0.5.16",
+    "@types/dompurify": "^3.2.0",
+    "@types/hex-color-regex": "^1.1.3",
+    "@types/lodash": "^4.17.16",
+    "@types/lodash-es": "^4.17.12",
+    "@types/node": "^22.19.11",
+    "@types/papaparse": "^5.3.15",
+    "@types/prettier": "^2.7.3",
+    "@types/react": "^18.3.18",
+    "@types/react-date-range": "^1.4.10",
+    "@types/react-datepicker": "^4.19.6",
+    "@types/react-dom": "^18.3.5",
+    "@types/uuid": "^9.0.8",
+    "@vitejs/plugin-react": "^5.1.0",
+    "autoprefixer": "^10.4.21",
+    "eslint": "^9.22.0",
+    "eslint-plugin-react": "^7.37.4",
+    "eslint-plugin-unused-imports": "^4.1.4",
+    "globals": "^16.0.0",
+    "husky": "^8.0.3",
+    "postcss": "^8.5.3",
+    "prettier": "^2.8.8",
+    "tailwindcss": "^3.4.17",
+    "typescript": "^5.8.2",
+    "typescript-eslint": "^8.26.1",
+    "vite": "^7.3.1",
+    "vite-tsconfig-paths": "^6.1.0",
+    "vitest": "^4.0.18"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "engineStrict": true,
+  "type": "module",
+  "overrides": {
+    "@docuninja/builder2.0": {
+      "react": "$react",
+      "react-dom": "$react-dom"
+    },
+    "socket.io-parser": "^4.2.6"
+  }
+}
@@ -1,47 +1,47 @@
-{ lib
-, buildNpmPackage
-, npmHooks
+{ buildNpmPackage
 , fetchFromGitHub
-, fetchNpmDeps
-, jq
+, importNpmLock
+, lib
+, openssl
 , php82
 , nodejs_22
-, npm-lockfile-fix
+, symlinkJoin
+, writers
 , dataDir ? "/var/lib/invoiceninja"
 , runtimeDir ? "/run/invoiceninja"
 }:

 let
  pname = "invoiceninja";
-
-  version = "5.13.53";
+  version = "5.13.19";
+  uiVersion = "03.05.2026.1";
  src = fetchFromGitHub {
-    name = "${pname}";
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-KQMb1W2S1YrRZOgjV3NPDpQaz5BbF/xtziNFd34wvxo=";
-
-    postFetch = ''
-      # add missing integrity fields to lockfile
-      ${npm-lockfile-fix}/bin/npm-lockfile-fix $out/package-lock.json
-    '';
+    hash = "sha256-PlFu9MQ4nZ2oHgSwOLffqERpZPIWkpgZ/qTqru63a9Y=";
  };
-
-  uiVersion = "18.10.2026.1";
  uiSrc = fetchFromGitHub {
-    name = "${pname}-ui";
    owner = pname;
    repo = "ui";
    tag = uiVersion;
-    hash = "sha256-56szHmIWU9De04Orykp2RxrW0RV87JxB7Y1yvdrSJm4=";
-
-    postFetch = ''
-      # add missing integrity fields to lockfile
-      ${npm-lockfile-fix}/bin/npm-lockfile-fix $out/package-lock.json
-    '';
+    hash = "sha256-aEqYX/YNUV5UR631X4zQyqoXSSuUqvILplV8Mm557Bc=";
  };

+  # PHP composer
+  composer = php82.buildComposerProject (finalAttrs: {
+    inherit src version;
+    pname = "${pname}-composer";
+
+    vendorHash = "sha256-2CyWKlyCyoCt/WdY7Ta0oEXW2KIkGwhilHtzpBJ5Wnk=";
+
+    # Upstream composer.json has invalid license, webpatser/laravel-countries package is pointing
+    # to commit-ref, and php required in require and require-dev
+    composerStrictValidation = false;
+
+    postInstall = ''mv "$out/share/php/${finalAttrs.pname}"/* $out'';
+  });
+  
  # React frontend
  ui = buildNpmPackage {
    pname = "${pname}-ui";
@@ -50,86 +50,35 @@ let

    nodejs = nodejs_22;
  
-    npmDepsHash = "sha256-j5XocHvBfMvzNrkaVkTsck2+yPraYWrXQxAbf3EYfIk=";
+    #npmDepsHash = "sha256-T2/0POKcr4x98cy3rfeNyTIBZrHuLfqpC1J6nymGcys=";

-    preConfigure = ''
+    #npmPackFlags = [ "--ignore-scripts" ];
+    #npmInstallFlags = [ "--omit=dev" ];
+
+    npmConfigHook = importNpmLock.npmConfigHook;
+    #npmDeps = importNpmLock {
+    #  package = builtins.readFile ./. + "/package.json";
+    #  packageLock = builtins.readFile ./. + "/package-lock.json";
+    #};
+    npmDeps = importNpmLock { npmRoot = ./.; };
+
+    prePatch = ''
      sed -i 's/VITE_IS_TEST=true/VITE_IS_TEST=false/' .env.example
-
      cp .env.example .env
-      cp ${src}/vite.config.ts.react ./vite.config.js
-    '';

-    installPhase = ''
-      runHook preInstall
+      # This will make the build output a single bundle file (bundle.[hash].js)
+      cp ${composer}/vite.config.ts.react ./vite.config.js

-      mkdir $out
-      cp -a * $out
-
-      runHook postInstall
+      #${npm-lockfile-fix}/bin/npm-lockfile-fix ./package-lock.json
    '';
  };
-in

-php82.buildComposerProject (finalAttrs: {
-  inherit src version;
-  pname = "${pname}-composer";
-
-  passthru.ui = ui;
-
-  nativeBuildInputs = [
-    jq
-    nodejs_22
-    npmHooks.npmConfigHook
-    npmHooks.npmBuildHook
+  invoiceNinja = symlinkJoin {
+    name = "invoiceninja";
+    paths = [
+      composer
+      ui
    ];
-
-  vendorHash = "sha256-sFpfnCt8jv8z9cLoFE8utPQiGz7q/KkqUXabEhcJP3M=";
-
-  # Upstream composer.json has invalid license, webpatser/laravel-countries package is pointing
-  # to commit-ref, and php required in require and require-dev
-  composerStrictValidation = false;
-
-  CYPRESS_INSTALL_BINARY = 0;
-
-  npmDeps = fetchNpmDeps {
-    name = "${pname}-${version}-npm-deps";
-    inherit src;
-    hash = "sha256-ditAbluBzs5OV/fCMV5Q4w1amao6ofOlee4YXMpZ37I=";
  };
+in ui

-  preConfigure = ''
-    cp -r ${ui}/dist/* public/
-    cp public/index.html resources/views/react/index.blade.php
-  '';
-
-  postInstall = ''
-    mv "$out/share/php/${finalAttrs.pname}"/* $out
-
-    # Remove JS/CSS build artifacts
-    rm -rf $out/node_modules
-
-    # composer.lock and vendor/composer/installed.json record each package's "dist.url" as the
-    # store path of the composer-repository mirror it was installed from, which otherwise drags
-    # that whole (500+MB) fixed-output derivation into the runtime closure for no reason -- it's
-    # provenance metadata, not something Laravel's package manifest (which only reads
-    # name/extra) or Composer\InstalledVersions (which reads vendor/composer/installed.php, not
-    # this file) consult at runtime.
-    jq '(.packages[]?.dist.url) |= "removed"' $out/vendor/composer/installed.json > $out/vendor/composer/installed.json.tmp
-    mv $out/vendor/composer/installed.json.tmp $out/vendor/composer/installed.json
-    jq '(.packages[]?.dist.url, .["packages-dev"][]?.dist.url) |= "removed"' $out/composer.lock > $out/composer.lock.tmp
-    mv $out/composer.lock.tmp $out/composer.lock
-
-    rm -r $out/bootstrap/cache
-    rm -rf $out/public/storage
-
-    # Move static contents for the NixOS module to pick it up, if needed.
-    mv $out/bootstrap $out/bootstrap-static
-    mv $out/storage $out/storage-static
-
-    # Link NixOS module files to derivation output
-    ln -s ${dataDir}/.env $out/.env
-    ln -s ${dataDir}/storage $out/
-    ln -s ${dataDir}/storage/app/public $out/public/storage
-    ln -s ${runtimeDir} $out/bootstrap
-  '';
-})
@@ -1,174 +0,0 @@
-#!/usr/bin/env bash
-# Bumps invoiceninja/package.nix to the latest upstream invoiceninja and
-# invoiceninja/ui versions, then rebuilds repeatedly -- using the
-# "specified vs. got" hash mismatch that Nix reports for each
-# fixed-output derivation -- to fill in the correct src/npmDeps/vendor
-# hashes. Invoked via `just update`.
-set -euo pipefail
-
-cd "$(dirname "${BASH_SOURCE[0]}")/.."
-
-pkg=package.nix
-
-# Replaces the RHS (between the first "=" and the last ";") of the line
-# immediately following the first line containing $anchor.
-set_after() {
-  local file="$1" anchor="$2" newrhs="$3"
-  awk -v anchor="$anchor" -v newrhs="$newrhs" '
-    {
-      if (found) {
-        sub(/=.*;/, "= " newrhs ";")
-        found = 0
-      }
-      if (index($0, anchor) > 0) found = 1
-      print
-    }
-  ' "$file" > "${file}.tmp"
-  mv "${file}.tmp" "$file"
-}
-
-# Replaces the RHS of the first line assigning to $field. Only the first
-# match is touched -- "version" is assigned twice in package.nix (the
-# top-level invoiceninja version, and buildNpmPackage's own "version"
-# attribute for the ui derivation, which must stay "= uiVersion;") and the
-# top-level one always comes first.
-set_field() {
-  local file="$1" field="$2" newrhs="$3"
-  awk -v field="$field" -v newrhs="$newrhs" '
-    {
-      if (!done && $0 ~ "^[[:space:]]*" field "[[:space:]]*=") {
-        sub(/=.*;/, "= " newrhs ";")
-        done = 1
-      }
-      print
-    }
-  ' "$file" > "${file}.tmp"
-  mv "${file}.tmp" "$file"
-}
-
-current_main_version=$(grep -m1 -E '^\s*version = "' "$pkg" | sed -E 's/.*"([^"]+)".*/\1/')
-current_ui_version=$(grep -m1 -E '^\s*uiVersion = "' "$pkg" | sed -E 's/.*"([^"]+)".*/\1/')
-
-echo "Current: invoiceninja=$current_main_version ui=$current_ui_version"
-
-latest_main_version=$(curl -sf https://api.github.com/repos/invoiceninja/invoiceninja/releases/latest | jq -r '.tag_name' | sed 's/^v//')
-
-# invoiceninja/ui has no GitHub Releases, just date-stamped tags
-# (DD.MM.YYYY.N) -- paginate through all tags and pick the newest by
-# calendar date, ignoring "-release" hotfix tags and other one-off tag
-# names that don't fit that scheme.
-ui_tags=""
-page=1
-while :; do
-  batch=$(curl -sf "https://api.github.com/repos/invoiceninja/ui/tags?per_page=100&page=${page}" | jq -r '.[].name')
-  [ -z "$batch" ] && break
-  ui_tags="${ui_tags}
-${batch}"
-  page=$((page + 1))
-done
-
-latest_ui_version=$(printf '%s\n' "$ui_tags" \
-  | grep -E '^[0-9]{2}\.[0-9]{2}\.[0-9]{4}\.[0-9]+$' \
-  | awk -F. '{printf "%s%02d%02d%s %s\n", $3, $2, $1, $4, $0}' \
-  | sort \
-  | tail -1 \
-  | awk '{print $2}')
-
-if [ -z "$latest_main_version" ] || [ -z "$latest_ui_version" ]; then
-  echo "error: failed to determine latest versions (main=$latest_main_version ui=$latest_ui_version)" >&2
-  exit 1
-fi
-
-echo "Latest:  invoiceninja=$latest_main_version ui=$latest_ui_version"
-
-main_changed=0
-ui_changed=0
-
-if [ "$latest_main_version" != "$current_main_version" ]; then
-  main_changed=1
-  set_field "$pkg" version "\"$latest_main_version\""
-fi
-
-if [ "$latest_ui_version" != "$current_ui_version" ]; then
-  ui_changed=1
-  set_field "$pkg" uiVersion "\"$latest_ui_version\""
-fi
-
-if [ "$main_changed" = 0 ] && [ "$ui_changed" = 0 ]; then
-  echo "Already up to date."
-  exit 0
-fi
-
-# Invalidate every hash that could have changed as a result of the version
-# bump(s) above, so the rebuild loop below reports the real ones.
-if [ "$main_changed" = 1 ]; then
-  set_after "$pkg" 'rev = "v${version}";' 'lib.fakeHash'
-  set_after "$pkg" 'inherit src;' 'lib.fakeHash'
-  set_field "$pkg" vendorHash 'lib.fakeHash'
-fi
-
-if [ "$ui_changed" = 1 ]; then
-  set_after "$pkg" 'tag = uiVersion;' 'lib.fakeHash'
-  set_field "$pkg" npmDepsHash 'lib.fakeHash'
-fi
-
-echo "Rebuilding to discover the correct hashes (this takes a few iterations)..."
-
-max_iterations=10
-for ((i = 1; i <= max_iterations; i++)); do
-  echo "--- build attempt $i/$max_iterations ---"
-  set +e
-  build_output=$(nix build ".#invoiceninja" ".#invoiceninja.ui" --no-link -L 2>&1)
-  status=$?
-  set -e
-
-  if [ "$status" -eq 0 ]; then
-    echo "Build succeeded."
-    exit 0
-  fi
-
-  mismatch_line=$(printf '%s\n' "$build_output" | grep -m1 "hash mismatch in fixed-output derivation" || true)
-  if [ -z "$mismatch_line" ]; then
-    echo "$build_output" | tail -80
-    echo "error: build failed for a reason other than a hash mismatch; see output above" >&2
-    exit 1
-  fi
-
-  drv_path=$(printf '%s\n' "$mismatch_line" | sed -E "s/.*'([^']+)'.*/\1/")
-  # Store paths are "<32-char hash>-<name>"; strip the hash to get the name.
-  name=$(basename "$drv_path" .drv | sed -E 's/^[0-9a-z]{32}-//')
-  got_hash=$(printf '%s\n' "$build_output" | grep -m1 -E '^\s+got: ' | awk '{print $2}')
-
-  if [ -z "$got_hash" ]; then
-    echo "$build_output" | tail -80
-    echo "error: could not parse the correct hash out of the build output above" >&2
-    exit 1
-  fi
-
-  echo "Fixing hash for '$name': $got_hash"
-
-  case "$name" in
-    invoiceninja)
-      set_after "$pkg" 'rev = "v${version}";' "\"$got_hash\""
-      ;;
-    invoiceninja-ui)
-      set_after "$pkg" 'tag = uiVersion;' "\"$got_hash\""
-      ;;
-    invoiceninja-ui-*-npm-deps)
-      set_field "$pkg" npmDepsHash "\"$got_hash\""
-      ;;
-    invoiceninja-composer-composer-repository-*)
-      set_field "$pkg" vendorHash "\"$got_hash\""
-      ;;
-    invoiceninja-*-npm-deps)
-      set_after "$pkg" 'inherit src;' "\"$got_hash\""
-      ;;
-    *)
-      echo "error: unrecognized derivation '$name' in hash mismatch; don't know which field to update" >&2
-      exit 1
-      ;;
-  esac
-done
-
-echo "error: exceeded $max_iterations build attempts without resolving all hash mismatches" >&2
-exit 1
@@ -1,16 +0,0 @@
-{ proxyServer ? "nginx" }:
-{ ... }:
-
-{
-  imports = [ ../nixos-module/invoiceninja.nix ];
-
-  services.invoiceninja = {
-    enable = true;
-    proxy.server = proxyServer;
-    adminAccount.passwordFile = ./invoice_ninja_test_password;
-    secretFile = ./test.env;
-    settings.APP_DEBUG = true;
-  };
-
-  networking.firewall.enable = false;
-}
@@ -1,52 +1,30 @@
-{ proxyServer ? "nginx" }:
-{ pkgs, modulesPath, ... }:
+{ modulesPath, ... }:

 {
  imports = [
    (modulesPath + "/profiles/qemu-guest.nix")
-    # Not imported by default for a plain nixosSystem in this nixpkgs (only nixosTest nodes get it
-    # automatically) - needed explicitly so virtualisation.cores/memorySize below are real options.
-    (modulesPath + "/virtualisation/qemu-vm.nix")
-    (import ./common.nix { inherit proxyServer; })
+    ../nixos-module/invoiceninja.nix
  ];

-  # `nix flake check` evaluates config.system.build.toplevel directly, which asserts a real root
-  # filesystem and bootloader are configured. `just build-vm` builds config.system.build.vm
-  # instead, where the qemu-vm module overrides both of these with a tmpfs root and direct
-  # kernel boot (virtualisation.useBootLoader defaults to false) - so these values just need to
-  # satisfy the assertions and are otherwise unused.
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/nixos";
-    fsType = "ext4";
-  };
-  boot.loader.grub.enable = false;
+  system.stateVersion = "24.11";

-  users.users.root = {
-    initialPassword = "toor";
+  nixpkgs.config.allowUnfree = true;
+
+  users.users.test = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    initialPassword = "test";
  };

+  services.invoiceninja = {
+    enable = true;
+    proxy.server = "caddy";
+    adminAccount.passwordFile = ./invoice_ninja_test_password;
+    secretFile = ./test.env;
+  };
+
+  networking.firewall.enable = false;
+
  services.resolved.enable = true;
-
-  # `just boot-vm` forwards the guest's port 80 to host port 8080 (QEMU_NET_OPTS in the justfile),
-  # but the backend builds absolute URLs (e.g. the stored company logo path) from APP_URL, which
-  # defaults to plain "http://localhost" with no port. The SPA's own relative URLs are fine (they
-  # inherit whatever port the browser is already on), but any backend-generated absolute URL then
-  # points at host port 80 - where nothing is listening - instead of the forwarded 8080, giving a
-  # silent net::ERR_CONNECTION_REFUSED for things like the logo image. Override to match the actual
-  # forwarded port.
-  services.invoiceninja.settings.APP_URL = "http://localhost:8080";
-
-  # The qemu-vm module's defaults (1 core, 1024MB) are too tight for real interactive use: MySQL +
-  # Redis + PHP-FPM + chromium (PDF generation, spawned per request - each is a full multi-process
-  # browser, not a lightweight renderer) running concurrently can exhaust 1GB fast, and this VM
-  # boots with panic_on_oom - so it's not a graceful slowdown, the whole VM goes down. Confirmed by
-  # reproducing a "logo upload hangs" report this way: at the 1024MB default, even a couple of
-  # concurrent PDF-generation requests triggered `redis-server invoked oom-killer` and a kernel
-  # panic. 2 cores / 2560MB comfortably handles 2 concurrent PDF generations alongside normal
-  # traffic (verified: ~1.4GB still free afterward); a deliberate flood of many concurrent PDF
-  # requests can still exhaust even this, since each is a full chromium instance - if that's a
-  # concern for your deployment, consider capping `phpfpm.settings."pm.max_children"` below its
-  # default of 8, or provisioning more RAM.
-  virtualisation.cores = 2;
-  virtualisation.memorySize = 2560;
 }
+
@@ -1,131 +0,0 @@
-{ nixpkgsPath, system }:
-
-let
-  pkgs = import nixpkgsPath { inherit system; };
-
-  adminEmail = "admin@email.com";
-  adminPassword = pkgs.lib.strings.trim (builtins.readFile ./invoice_ninja_test_password);
-in
-pkgs.testers.nixosTest {
-  name = "invoiceninja";
-
-  nodes = {
-    nginx.imports = [ (import ./common.nix { proxyServer = "nginx"; }) ];
-    caddy.imports = [ (import ./common.nix { proxyServer = "caddy"; }) ];
-  };
-
-  testScript = ''
-    import json
-
-    def api_get(machine, path, token):
-        return json.loads(machine.succeed(f"curl -sf http://localhost{path} -H 'X-API-TOKEN: {token}'"))
-
-    def api_post(machine, path, payload, token=None):
-        auth_header = f"-H 'X-API-TOKEN: {token}' " if token else ""
-        return json.loads(machine.succeed(
-            f"curl -sf -X POST http://localhost{path} "
-            + auth_header
-            + "-H 'Content-Type: application/json' "
-            + f"-d '{json.dumps(payload)}'"
-        ))
-
-    def check_invoiceninja(machine, proxy_unit):
-        machine.wait_for_unit("mysql.service")
-        machine.wait_for_unit("redis-invoiceninja.service")
-        machine.wait_for_unit("phpfpm-invoiceninja.service")
-        machine.wait_for_unit("invoiceninja-queue-worker.service")
-        machine.wait_for_unit(proxy_unit)
-        machine.wait_for_open_port(80)
-
-        # phpfpm-invoiceninja/invoiceninja-queue-worker both Require= invoiceninja-data-setup,
-        # so systemd already waited for it to finish above. Confirm the one-time setup steps
-        # it guards actually completed, rather than just that the unit exited. (Migrations run
-        # unconditionally on every activation rather than being marker-gated, so there's no
-        # marker file to check for them here.)
-        with subtest("one-time setup (seed, admin account) completed"):
-            machine.succeed("test -f /var/lib/invoiceninja/.db-seeded")
-            machine.succeed("test -f /var/lib/invoiceninja/.admin-created")
-
-        with subtest("application shell is served over HTTP"):
-            response = machine.succeed("curl -sf http://localhost/")
-            assert "Invoice Ninja" in response, f"unexpected response from /: {response}"
-
-        with subtest("web UI login page is served"):
-            # The UI is a client-side-routed React SPA, so curl (no JS) only sees the same
-            # index.html shell as "/" - this confirms the proxy/Laravel resolve the /login route
-            # to that shell instead of 404ing, which is what a browser needs before it can
-            # render the actual login form.
-            login_page = machine.succeed("curl -sf http://localhost/login")
-            assert "Invoice Ninja" in login_page, f"unexpected response from /login: {login_page}"
-
-        with subtest("invoiceninja-manage wrapper can run artisan commands"):
-            machine.succeed("invoiceninja-manage migrate:status")
-
-        with subtest("scheduler timer is enabled and schedule:run succeeds"):
-            # Without this, the app's dashboard reports "cron jobs are not enabled".
-            machine.succeed("systemctl is-active invoiceninja-scheduler.timer")
-            machine.succeed("systemctl start --wait invoiceninja-scheduler.service")
-
-        with subtest("admin account can log in via the API"):
-            login_response = api_post(machine, "/api/v1/login", {"email": "${adminEmail}", "password": "${adminPassword}"})
-            assert "${adminEmail}" in json.dumps(login_response), f"login did not succeed: {login_response}"
-            token = login_response["data"][0]["token"]["token"]
-
-        with subtest("full language list is available, not just the af/ca/id migration's 3"):
-            # Regression check: migration 2025_08_31_224356_additional_languages_af_ca_id.php runs
-            # during `migrate`, before db:seed's LanguageSeeder has populated the other 42 rows, and
-            # does Cache::forever('languages', Language::all()) - permanently caching just the 3
-            # languages it sees at that moment. invoiceninja-data-setup works around this with
-            # `invoiceninja-manage cache:forget languages`; this confirms the workaround is in place.
-            language_count = len(api_get(machine, "/api/v1/statics", token)["languages"])
-            assert language_count > 40, f"expected ~45 languages, got {language_count}"
-
-        with subtest("PDF generation works (chromium/snappdf)"):
-            # /api/v1/preview with no entity falls back to a self-contained mock PDF (no invoice/client
-            # setup needed), exercising the same chromium/snappdf pipeline real invoice PDFs use.
-            # This fallback only triggers when the company has no invoices/invitations at all yet
-            # (PreviewController::blankEntity), so this must run before the client/invoice/payment
-            # subtest below creates one.
-            machine.succeed(
-                "curl -sf -X POST http://localhost/api/v1/preview "
-                + f"-H 'X-API-TOKEN: {token}' -H 'Content-Type: application/json' "
-                + "-d '{}' -o /tmp/preview.pdf"
-            )
-            magic_bytes = machine.succeed("head -c 4 /tmp/preview.pdf")
-            assert magic_bytes == "%PDF", f"expected a PDF, got: {magic_bytes!r}"
-
-        with subtest("a client can be created, invoiced, and pay that invoice in full"):
-            client = api_post(machine, "/api/v1/clients", {"name": "Test Client"}, token)["data"]
-
-            invoice = api_post(machine, "/api/v1/invoices", {
-                "client_id": client["id"],
-                "line_items": [
-                    {"quantity": 1, "cost": 100, "product_key": "test-product", "notes": "test line item"},
-                ],
-            }, token)["data"]
-            assert invoice["amount"] == 100, f"unexpected invoice amount: {invoice}"
-
-            # Mirrors the normal workflow of sending an invoice to a client before it's paid,
-            # rather than relying on the fact that draft invoices also happen to be payable.
-            api_get(machine, f"/api/v1/invoices/{invoice['id']}/mark_sent", token)
-
-            payment = api_post(machine, "/api/v1/payments", {
-                "client_id": client["id"],
-                "amount": invoice["amount"],
-                "invoices": [{"invoice_id": invoice["id"], "amount": invoice["amount"]}],
-            }, token)["data"]
-            assert payment["applied"] == invoice["amount"], f"payment not fully applied: {payment}"
-
-            paid_invoice = api_get(machine, f"/api/v1/invoices/{invoice['id']}", token)["data"]
-            # status_id 4 == STATUS_PAID
-            assert paid_invoice["status_id"] == "4", f"invoice not marked paid: {paid_invoice}"
-            assert paid_invoice["balance"] == 0, f"invoice balance not zero: {paid_invoice}"
-
-
-    nginx.start()
-    caddy.start()
-
-    check_invoiceninja(nginx, "nginx.service")
-    check_invoiceninja(caddy, "caddy.service")
-  '';
-}
Author	SHA1	Message	Date
awkawb	311d5f8d76	package.nix: updated to build Invoice Ninja with React frontend	2026-05-18 17:41:34 -04:00
awkawb	1033041fd2	Added package.json/package-lock.json for use in importNpmLock function	2026-05-18 17:36:16 -04:00