This repository has no description
2configs.flix.ipfs: refuse `ipfs add` without --nocopy
Confused agents that did plain `ipfs add` of files already on disk
caused ~9G of blockstore/filestore duplication and ~10G of
blockstore-only content. Shadow the CLI with a wrapper that rejects
`add` calls missing --nocopy; the kubo daemon and pin-watcher use
absolute store paths so they keep working.
Assisted-by: Claude Code (claude-opus-4-7)
author
lassulus
date
(May 17, 2026, 1:46 AM CEST)
commit
d6e4dbb8
d6e4dbb894060426d0376ef70d49688359c57dac
parent
69473dfc
69473dfc0463461c87389702aa0f31a6771bfdb5
+22
+22
2configs/services/flix/ipfs.nix
+22
2configs/services/flix/ipfs.nix
···
389
389
networking.firewall.allowedUDPPorts = [
390
390
4001 # IPFS swarm (QUIC)
391
391
];
392
+
393
+
# Shadow `ipfs` in PATH with a wrapper that rejects `ipfs add` without
394
+
# --nocopy. The kubo daemon and pin-watcher use absolute store paths, so
395
+
# they are unaffected. This blocks confused agents/users from creating
396
+
# blockstore-only duplicates of files that already live in
397
+
# /var/lib/ipfs/download.
398
+
environment.systemPackages = [
399
+
(lib.hiPrio (pkgs.writeShellScriptBin "ipfs" ''
400
+
if [ "''${1-}" = "add" ]; then
401
+
for a in "$@"; do
402
+
case "$a" in
403
+
--nocopy|--nocopy=true) exec ${pkgs.kubo}/bin/ipfs "$@" ;;
404
+
esac
405
+
done
406
+
echo "refused: 'ipfs add' without --nocopy is forbidden on this host." >&2
407
+
echo " Use 'ipfs add --nocopy <path>' so the file is referenced via filestore" >&2
408
+
echo " instead of duplicated into the blockstore." >&2
409
+
exit 1
410
+
fi
411
+
exec ${pkgs.kubo}/bin/ipfs "$@"
412
+
''))
413
+
];
392
414
}