From f57fc6b43957b4e6760aee0928eb505261453865 Mon Sep 17 00:00:00 2001
From: Kieran Klukas <kieran@dunkirk.sh>
Date: Mon, 21 Sep 2026 18:26:42 -0400
Subject: [PATCH] fix: stop the emoji bots deploying unreviewed code at boot
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both instances ran a fetch and hard reset against the default branch on every
start, then reinstalled dependencies, inside a sixty second budget on a two-core
machine. That made three things true: a reboot without working connectivity left
them permanently down, restarting the unit silently shipped whatever was on main,
and a slow install got killed midway leaving a torn dependency tree.

Now scaffolding only, matching every other service here. Updates come from the
repository's own deploy workflow, which is where they already were.

💘 Generated with Crush

Assisted-by: Crush:claude-opus-5
---
 modules/nixos/services/emojibot.nix | 27 ++++++++++-----------------
 1 file changed, 10 insertions(+), 17 deletions(-)

diff --git a/modules/nixos/services/emojibot.nix b/modules/nixos/services/emojibot.nix
index 4f669d8..b1ad798 100644
--- a/modules/nixos/services/emojibot.nix
+++ b/modules/nixos/services/emojibot.nix
@@ -118,26 +118,19 @@ in
           set -e
           export GIT_TERMINAL_PROMPT=0
 
-          # Clone repository if not present
+          # Scaffolding only, matching mkService: a start must not depend on
+          # reaching GitHub, and `systemctl restart` must not deploy whatever
+          # happens to be on main. Deploys come from the repo's own workflow.
           if [ ! -d /var/lib/emojibot-${name}/app/.git ]; then
-            echo "Cloning ${instanceCfg.repository}..."
-            ${pkgs.git}/bin/git clone -b main ${instanceCfg.repository} /var/lib/emojibot-${name}/app || {
-              echo "Failed to clone repository. If this is a private repo, ensure SSH keys are configured."
-              echo "For public repos, check network connectivity."
-              exit 1
-            }
+            echo "First start: cloning ${instanceCfg.repository}..."
+            ${pkgs.git}/bin/git clone -b main ${instanceCfg.repository} /var/lib/emojibot-${name}/app
           fi
 
-          cd /var/lib/emojibot-${name}/app
-          ${pkgs.git}/bin/git fetch origin
-          ${pkgs.git}/bin/git reset --hard origin/main
-
-          if [ -f package.json ]; then
-            echo "Installing dependencies..."
-            ${pkgs.unstable.bun}/bin/bun install || {
-              echo "Failed to install dependencies, trying again..."
-              ${pkgs.unstable.bun}/bin/bun install
-            }
+          if [ -f /var/lib/emojibot-${name}/app/package.json ] \
+            && [ ! -d /var/lib/emojibot-${name}/app/node_modules ]; then
+            cd /var/lib/emojibot-${name}/app
+            echo "First start: installing dependencies..."
+            ${pkgs.unstable.bun}/bin/bun install
           fi
         '';
 
-- 
knotmirror 0.0.1