AZ-Intec-GmbH/AZ-NIX-SERVERS
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: change zammad domain

Browse Source
This commit is contained in:
sascha.koenig
2026-08-15 09:33:28 +02:00
parent f8f0d0eba3
commit 5132a4de2f
15 changed files with 265 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/AZ-CLD-1/secrets.nix
+12
View File
@@ -88,6 +88,18 @@
file = ../../secrets/pgbouncer-userlist.age;
owner = "pgbouncer";
};
pgbouncer-tls-cert = {
file = ../../secrets/server.crt.age;
owner = "pgbouncer";
group = "pgbouncer";
mode = "0444";
};
pgbouncer-tls-key = {
file = ../../secrets/server.key.age;
owner = "pgbouncer";
group = "pgbouncer";
mode = "0400";
};
vaultwarden-env = {
file = ../../secrets/vaultwarden-env.age;
};
hosts/AZ-CLD-1/services/containers/default.nix
+1 -1
View File
@@ -7,7 +7,7 @@
./litellm.nix
./librechat-dev.nix
./netbird.nix
./portainer.nix
# ./portainer.nix
./zammad-hr.nix
];
system.activationScripts.createPodmanNetworkWeb = lib.mkAfter ''
hosts/AZ-CLD-1/services/containers/homarr.nix
+1
View File
@@ -13,6 +13,7 @@ in {
AUTH_OIDC_CLIENT_NAME = "Azure";
AUTH_OIDC_SCOPE_OVERWRITE = "openid email profile";
AUTH_OIDC_GROUPS_ATTRIBUTE = "roles";
AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT = "true";
};
environmentFiles = [config.age.secrets.homarr-env.path];
ports = ["127.0.0.1:${toString servicePort}:7575"];
hosts/AZ-CLD-1/services/containers/zammad-hr.nix
+27 -3
View File
@@ -21,7 +21,9 @@
ipOffset = 40;
# Domain-Konfiguration
zammadDomain = "hr-ticket.az-gruppe.com";
zammadDomain = "tickets.az-gruppe.com";
# Alte Domain wird per 301 auf zammadDomain weitergeleitet (siehe Traefik-Config unten)
zammadDomainOld = "hr-ticket.az-gruppe.com";
sharedEnvironment = {
MEMCACHE_SERVERS = "zammad-memcached:11211";
@@ -29,7 +31,12 @@
POSTGRESQL_HOST = "10.89.0.1";
POSTGRESQL_USER = "zammad_${instanceName}";
POSTGRESQL_PORT = "6433";
POSTGRESQL_OPTIONS = "?pool=5";
# pool=50 entspricht dem Zammad-Default (config/database/database.yml).
# Der Scheduler startet mehrere BackgroundServices-Threads gleichzeitig
# (ProcessSessions/Scheduled/Delayed/DelayedAI + Cleanup/fetch); pool=5
# war zu klein -> ActiveRecord::ConnectionTimeoutError beim Start.
# Wird durch PgBouncer-Session (default_pool_size=30) server-seitig gedeckelt.
POSTGRESQL_OPTIONS = "?pool=50";
REDIS_URL = "redis://zammad-redis:6379";
TZ = "Europe/Berlin";
BACKUP_DIR = "/var/tmp/zammad";
@@ -232,7 +239,7 @@ in {
--env POSTGRESQL_HOST=10.89.0.1 \
--env POSTGRESQL_USER=zammad_${instanceName} \
--env POSTGRESQL_PORT=6433 \
--env POSTGRESQL_OPTIONS='?pool=5' \
--env POSTGRESQL_OPTIONS='?pool=50' \
--env REDIS_URL=redis://zammad-redis:6379 \
--env TZ=Europe/Berlin \
--env ELASTICSEARCH_ENABLED=true \
@@ -305,6 +312,13 @@ in {
};
};
# Permanenter Redirect von der alten Domain auf die neue
middlewares."${serviceName}-redirect-old-domain".redirectRegex = {
permanent = true;
regex = "^https?://${lib.replaceStrings ["."] ["\\."] zammadDomainOld}/(.*)";
replacement = "https://${zammadDomain}/\${1}";
};
routers.${serviceName} = {
rule = "Host(`${zammadDomain}`)";
tls = {
@@ -314,5 +328,15 @@ in {
entrypoints = "websecure";
middlewares = ["${serviceName}-headers"];
};
routers."${serviceName}-old-domain-redirect" = {
rule = "Host(`${zammadDomainOld}`)";
tls = {
certResolver = "ionos";
};
service = serviceName;
entrypoints = "websecure";
middlewares = ["${serviceName}-redirect-old-domain"];
};
};
}
hosts/AZ-CLD-1/services/pgbouncer.nix
+15 -6
View File
@@ -22,11 +22,17 @@
log_connections = 1;
log_disconnections = 1;
client_tls_sslmode = "require";
client_tls_cert_file = config.age.secrets.pgbouncer-tls-cert.path;
client_tls_key_file = config.age.secrets.pgbouncer-tls-key.path;
client_tls_protocols = "secure";
server_reset_query = "DISCARD ALL";
server_check_query = "SELECT 1";
server_check_delay = 30;
server_tls_sslmode = "prefer";
server_tls_sslmode = "require";
server_tls_protocols = "secure";
};
mkDatabases = dbs:
@@ -92,11 +98,13 @@ in {
admin_users = ${commonSettings.admin_users}
stats_users = ${commonSettings.stats_users}
client_tls_sslmode = ${commonSettings.client_tls_sslmode}
client_tls_cert_file = ${commonSettings.client_tls_cert_file}
client_tls_key_file = ${commonSettings.client_tls_key_file}
client_tls_protocols = ${commonSettings.client_tls_protocols}
max_client_conn = 300
# session-Mode: 1 Client-Conn = 1 Server-Conn. zammad_hr haelt via mehrere
# Prozesse (rails+scheduler+websocket) real ~15 Conns -> pro (user,db) 15.
# outline/vaultwarden schoepfen das nie aus (eigene Slots je user,db).
default_pool_size = 15
default_pool_size = 30
min_pool_size = 1
query_wait_timeout = 30
@@ -105,7 +113,8 @@ in {
server_reset_query = DISCARD ALL
server_check_query = SELECT 1
server_check_delay = 30
server_tls_sslmode = prefer
server_tls_sslmode = ${commonSettings.server_tls_sslmode}
server_tls_protocols = ${commonSettings.server_tls_protocols}
# PID/Socket getrennt von der Haupt-Instanz halten.
pidfile = /run/pgbouncer-session/pgbouncer.pid
hosts/AZ-PRM-1/secrets.nix
+10
View File
@@ -25,6 +25,16 @@ in {
owner = "traefik";
mode = "0400";
};
netbox-secret-key = {
file = ../../secrets/netbox-secret-key.age;
owner = "netbox";
mode = "0400";
};
netbox-api-token-pepper = {
file = ../../secrets/netbox-api-token-pepper.age;
owner = "netbox";
mode = "0400";
};
traefik-env = {
file = ../../secrets/traefik-env.age;
};
hosts/AZ-PRM-1/services/default.nix
+1
View File
@@ -8,6 +8,7 @@
./monitoring
./n8n.nix
./netbird.nix
./netbox.nix
./pgadmin.nix
./phishboard.nix
./postgres.nix
hosts/AZ-PRM-1/services/netbox.nix
+79
View File
@@ -0,0 +1,79 @@
{
config,
pkgs,
...
}: let
serviceName = "netbox";
servicePort = config.m3ta.ports.get serviceName;
staticPort = config.m3ta.ports.get "netbox-static";
hostName = "nb.l.az-gruppe.com";
staticRoot = "${config.services.netbox.dataDir}/static";
in {
services.netbox = {
enable = true;
package = pkgs.unstable.netbox;
listenAddress = "127.0.0.1";
port = servicePort;
secretKeyFile = config.age.secrets.netbox-secret-key.path;
apiTokenPeppersFile = config.age.secrets.netbox-api-token-pepper.path;
settings = {
ALLOWED_HOSTS = [hostName "localhost" "127.0.0.1"];
SECURE_SSL_REDIRECT = true;
SESSION_COOKIE_SECURE = true;
CSRF_COOKIE_SECURE = true;
};
extraConfig = ''
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
'';
};
services.nginx = {
enable = true;
virtualHosts.netbox-static = {
listen = [
{
addr = "127.0.0.1";
port = staticPort;
}
];
locations."/static/" = {
alias = "${staticRoot}/";
extraConfig = ''
expires 1h;
access_log off;
'';
};
};
};
users.users.nginx.extraGroups = ["netbox"];
# Traefik-Routing: zwei Backends (App + Static), ein Host
services.traefik.dynamicConfigOptions.http = {
services = {
${serviceName}.loadBalancer.servers = [
{url = "http://127.0.0.1:${toString servicePort}/";}
];
"${serviceName}-static".loadBalancer.servers = [
{url = "http://127.0.0.1:${toString staticPort}/";}
];
};
routers = {
${serviceName} = {
rule = "Host(`${hostName}`) && !PathPrefix(`/static`)";
tls.certResolver = "ionos";
service = serviceName;
entrypoints = "websecure";
};
"${serviceName}-static" = {
rule = "Host(`${hostName}`) && PathPrefix(`/static`)";
tls.certResolver = "ionos";
service = "${serviceName}-static";
entrypoints = "websecure";
};
};
};
}
hosts/AZ-PRM-1/services/postgres.nix
+2 -1
View File
@@ -39,6 +39,7 @@
authentication = pkgs.lib.mkOverride 10 ''
# Local connections (Unix socket)
local all postgres peer
local netbox netbox peer
local n8n n8n scram-sha-256
# Localhost connections (IPv4 and IPv6)
@@ -64,7 +65,7 @@
services.postgresqlBackup = {
enable = true;
startAt = "03:10:00";
databases = ["baserow" "kestra" "n8n"];
databases = ["baserow" "kestra" "n8n" "netbox"];
};
networking.firewall = {
extraCommands = ''
hosts/common/ports.nix
+2
View File
@@ -35,6 +35,8 @@
litellm = 4000;
n8n = 5678;
netbox = 8001;
netbox-static = 8002;
kestra = 5080;
kestra-metrics = 5081;
zugferd-service = 5060;