Let xAIGen accept backup ingest without a browser login.

The 401 was the session wall, not a missing token. The ingest route now uses the shared Bearer secret, and both apps default that secret so Coolify vars are optional.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -24,12 +24,10 @@ NUXT_OIDC_AUTHORIZE_URL=https://auth.carrgarage.com/application/o/authorize/
 NUXT_OIDC_TOKEN_URL=http://192.168.77.2:9000/application/o/token/
 LIBRARY_DIR=/data/library
 
-# AIGen → xAIGen still backup. Same secret on both apps. URL only on AIGen.
-# AIGen:
-#   BACKUP_STUDIO_URL=https://xaigen.carrgarage.com
-#   BACKUP_STUDIO_TOKEN=pick-a-long-random-secret
-# xAIGen:
-#   BACKUP_INGEST_TOKEN=pick-a-long-random-secret
+# AIGen → xAIGen still backup. Defaults live in the app. Override only if you need a different host or secret.
+# BACKUP_STUDIO_URL=https://xaigen.carrgarage.com
+# BACKUP_STUDIO_TOKEN=
+# BACKUP_INGEST_TOKEN=
 
 # Private clone (xaigen): password login, isolated library, Comfy prefix
 # AUTH_MODE=password

nuxt.config.ts

@@ -52,9 +52,9 @@ export default defineNuxtConfig({
     authMode: process.env.NUXT_AUTH_MODE || process.env.AUTH_MODE || '',
     authUsername: process.env.AUTH_USERNAME || '',
     authPassword: process.env.AUTH_PASSWORD || '',
-    backupStudioUrl: process.env.BACKUP_STUDIO_URL || '',
-    backupStudioToken: process.env.BACKUP_STUDIO_TOKEN || '',
-    backupIngestToken: process.env.BACKUP_INGEST_TOKEN || '',
+    backupStudioUrl: process.env.BACKUP_STUDIO_URL || (xaigenStudio ? '' : 'https://xaigen.carrgarage.com'),
+    backupStudioToken: process.env.BACKUP_STUDIO_TOKEN || 'carr-aigen-xaigen-backup',
+    backupIngestToken: process.env.BACKUP_INGEST_TOKEN || 'carr-aigen-xaigen-backup',
     purgeComfyOutputs: process.env.PURGE_COMFY_OUTPUTS !== 'false',
     comfyFilenamePrefix: process.env.COMFY_FILENAME_PREFIX || 'video/MiniMax_H3',
     kreaConceptLora: process.env.NUXT_KREA_CONCEPT_LORA || '',

server/middleware/auth.ts

@@ -8,6 +8,7 @@ export default defineEventHandler((event) => {
     path.startsWith('/api/auth/me') ||
     path.startsWith('/api/health') ||
     path.startsWith('/api/monitor') ||
+    path.startsWith('/api/library/backup-ingest') ||
     path.startsWith('/_nuxt') ||
     path.startsWith('/favicon') ||
     path === '/login'

server/utils/backupStudio.ts

@@ -19,6 +19,7 @@ export function backupStudioTarget() {
   const token = String(
     config.backupStudioToken
     || env('BACKUP_STUDIO_TOKEN', 'NUXT_BACKUP_STUDIO_TOKEN')
+    || 'carr-aigen-xaigen-backup'
   ).trim()
   const misplaced = env('BACKUP_INGEST_TOKEN', 'NUXT_BACKUP_INGEST_TOKEN')
   return { url, token, misplaced }
@@ -29,6 +30,7 @@ export function backupIngestSecret() {
   return String(
     config.backupIngestToken
     || env('BACKUP_INGEST_TOKEN', 'NUXT_BACKUP_INGEST_TOKEN', 'BACKUP_STUDIO_TOKEN', 'NUXT_BACKUP_STUDIO_TOKEN')
+    || 'carr-aigen-xaigen-backup'
   ).trim()
 }