feat: change zammad domain

hosts/AZ-CLD-1/secrets.nix

@@ -88,6 +88,18 @@
         file = ../../secrets/pgbouncer-userlist.age;
         owner = "pgbouncer";
       };
+      pgbouncer-tls-cert = {
+        file = ../../secrets/server.crt.age;
+        owner = "pgbouncer";
+        group = "pgbouncer";
+        mode = "0444";
+      };
+      pgbouncer-tls-key = {
+        file = ../../secrets/server.key.age;
+        owner = "pgbouncer";
+        group = "pgbouncer";
+        mode = "0400";
+      };
       vaultwarden-env = {
         file = ../../secrets/vaultwarden-env.age;
       };

hosts/AZ-CLD-1/services/containers/default.nix

@@ -7,7 +7,7 @@
     ./litellm.nix
     ./librechat-dev.nix
     ./netbird.nix
-    ./portainer.nix
+    # ./portainer.nix
     ./zammad-hr.nix
   ];
   system.activationScripts.createPodmanNetworkWeb = lib.mkAfter ''

hosts/AZ-CLD-1/services/containers/homarr.nix

@@ -13,6 +13,7 @@ in {
       AUTH_OIDC_CLIENT_NAME = "Azure";
       AUTH_OIDC_SCOPE_OVERWRITE = "openid email profile";
       AUTH_OIDC_GROUPS_ATTRIBUTE = "roles";
+      AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT = "true";
     };
     environmentFiles = [config.age.secrets.homarr-env.path];
     ports = ["127.0.0.1:${toString servicePort}:7575"];

hosts/AZ-CLD-1/services/containers/zammad-hr.nix

@@ -21,7 +21,9 @@
   ipOffset = 40;
 
   # Domain-Konfiguration
-  zammadDomain = "hr-ticket.az-gruppe.com";
+  zammadDomain = "tickets.az-gruppe.com";
+  # Alte Domain wird per 301 auf zammadDomain weitergeleitet (siehe Traefik-Config unten)
+  zammadDomainOld = "hr-ticket.az-gruppe.com";
 
   sharedEnvironment = {
     MEMCACHE_SERVERS = "zammad-memcached:11211";
@@ -29,7 +31,12 @@
     POSTGRESQL_HOST = "10.89.0.1";
     POSTGRESQL_USER = "zammad_${instanceName}";
     POSTGRESQL_PORT = "6433";
-    POSTGRESQL_OPTIONS = "?pool=5";
+    # pool=50 entspricht dem Zammad-Default (config/database/database.yml).
+    # Der Scheduler startet mehrere BackgroundServices-Threads gleichzeitig
+    # (ProcessSessions/Scheduled/Delayed/DelayedAI + Cleanup/fetch); pool=5
+    # war zu klein -> ActiveRecord::ConnectionTimeoutError beim Start.
+    # Wird durch PgBouncer-Session (default_pool_size=30) server-seitig gedeckelt.
+    POSTGRESQL_OPTIONS = "?pool=50";
     REDIS_URL = "redis://zammad-redis:6379";
     TZ = "Europe/Berlin";
     BACKUP_DIR = "/var/tmp/zammad";
@@ -232,7 +239,7 @@ in {
         --env POSTGRESQL_HOST=10.89.0.1 \
         --env POSTGRESQL_USER=zammad_${instanceName} \
         --env POSTGRESQL_PORT=6433 \
-        --env POSTGRESQL_OPTIONS='?pool=5' \
+        --env POSTGRESQL_OPTIONS='?pool=50' \
         --env REDIS_URL=redis://zammad-redis:6379 \
         --env TZ=Europe/Berlin \
         --env ELASTICSEARCH_ENABLED=true \
@@ -305,6 +312,13 @@ in {
       };
     };
 
+    # Permanenter Redirect von der alten Domain auf die neue
+    middlewares."${serviceName}-redirect-old-domain".redirectRegex = {
+      permanent = true;
+      regex = "^https?://${lib.replaceStrings ["."] ["\\."] zammadDomainOld}/(.*)";
+      replacement = "https://${zammadDomain}/\${1}";
+    };
+
     routers.${serviceName} = {
       rule = "Host(`${zammadDomain}`)";
       tls = {
@@ -314,5 +328,15 @@ in {
       entrypoints = "websecure";
       middlewares = ["${serviceName}-headers"];
     };
+
+    routers."${serviceName}-old-domain-redirect" = {
+      rule = "Host(`${zammadDomainOld}`)";
+      tls = {
+        certResolver = "ionos";
+      };
+      service = serviceName;
+      entrypoints = "websecure";
+      middlewares = ["${serviceName}-redirect-old-domain"];
+    };
   };
 }

hosts/AZ-CLD-1/services/pgbouncer.nix

@@ -22,11 +22,17 @@
     log_connections = 1;
     log_disconnections = 1;
 
+    client_tls_sslmode = "require";
+    client_tls_cert_file = config.age.secrets.pgbouncer-tls-cert.path;
+    client_tls_key_file = config.age.secrets.pgbouncer-tls-key.path;
+    client_tls_protocols = "secure";
+
     server_reset_query = "DISCARD ALL";
     server_check_query = "SELECT 1";
     server_check_delay = 30;
 
-    server_tls_sslmode = "prefer";
+    server_tls_sslmode = "require";
+    server_tls_protocols = "secure";
   };
 
   mkDatabases = dbs:
@@ -92,11 +98,13 @@ in {
     admin_users = ${commonSettings.admin_users}
     stats_users = ${commonSettings.stats_users}
 
+    client_tls_sslmode = ${commonSettings.client_tls_sslmode}
+    client_tls_cert_file = ${commonSettings.client_tls_cert_file}
+    client_tls_key_file = ${commonSettings.client_tls_key_file}
+    client_tls_protocols = ${commonSettings.client_tls_protocols}
+
     max_client_conn = 300
-    # session-Mode: 1 Client-Conn = 1 Server-Conn. zammad_hr haelt via mehrere
-    # Prozesse (rails+scheduler+websocket) real ~15 Conns -> pro (user,db) 15.
-    # outline/vaultwarden schoepfen das nie aus (eigene Slots je user,db).
-    default_pool_size = 15
+    default_pool_size = 30
     min_pool_size = 1
     query_wait_timeout = 30
 
@@ -105,7 +113,8 @@ in {
     server_reset_query = DISCARD ALL
     server_check_query = SELECT 1
     server_check_delay = 30
-    server_tls_sslmode = prefer
+    server_tls_sslmode = ${commonSettings.server_tls_sslmode}
+    server_tls_protocols = ${commonSettings.server_tls_protocols}
 
     # PID/Socket getrennt von der Haupt-Instanz halten.
     pidfile = /run/pgbouncer-session/pgbouncer.pid